[Proxicon]

Why

The owner campaign needs authoritative Services refresh completion, an administrator Web surface for bounded operator policies, and a supported way to recover an older Windows client before observing a genuine automatic successor update. The requested dependency PRs overlap and need one compatible update set.

Changes

• Persist and expose Services refresh request outcomes, capability negotiation, session fencing, coalescing, throttling, timeout and legacy unattributed behavior. A completed snapshot cannot absorb a newly admitted request.
• Add account-authorized operator policy preview/confirm lifecycle and credential-admission inspection in Web. Preserve parent scope, current authority, exact target/version, self-escalation prevention, durable receipts and audit. Distinguish accepted results from unavailable or later readback.
• Package an offline Windows recovery script from the canonical installer. Verify archive hash/runtime/version/source; preserve enrollment, configuration and native update evidence; recover through the existing protected cutover/rollback path. Extend installer trust only to the exact registered product-service SID. Document recovery to an earlier fixed candidate followed by a real automatic successor.
• Consolidate package updates Chore: Bump CodeBeam.MudBlazor.Extensions and 47 others #354, Chore: Bump VeloxDev.Core and VeloxDev.Razor #353, Chore: Bump YamlDotNet from 16.3.0 to 18.1.0 #332, Chore: Bump VeloxDev.Core and VeloxDev.Razor #331 and Chore: Bump the minor-and-patch group with 51 updates #329; SDK updates Bump dotnet/sdk from 10.0.401-noble to 10.0.402-noble in /docker/client #328, Bump dotnet/sdk from 10.0.401-noble to 10.0.402-noble in /docker/migrations #327, Bump dotnet/sdk from 10.0.401-noble to 10.0.402-noble in /docker/mcp-http #326, Bump dotnet/sdk from 10.0.401-noble to 10.0.402-noble in /docker/web #325 and Bump dotnet/sdk from 10.0.401-noble to 10.0.402-noble in /docker/api #324; and pinned action updates Chore(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 #218, Chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 #217 and Chore(deps): Bump actions/upload-artifact from 7.0.1 to 7.0.2 #216. Do not reintroduce the previously removed vulnerable MudBlazor.Extensions package.
• Set the product version in Directory.Build.props, advance the catalog revision, and update canonical release/campaign documentation. Preserve all historical acceptance outcomes; explicitly link prospective successor tests where an original prerequisite is permanently unavailable.

Validation

Local Debug builds and focused behavior tests cover Services attribution, policy lifecycle/admission and Windows recovery. Source/release contracts, documentation layout and disclosure checks pass. All 23 restored projects have no reported vulnerable dependencies. The final hosted run 40069292628 passed on 1f2845aeb9272a9cb4a6b1f7afc53a1b3eb04769 in 14m06s (.NET job 13m59s): Core 4,552, API/PostgreSQL 36, components 603, all with zero failures/skips/timeouts; 177 source/release contracts also passed. Restore took 25s and Release build 2m15s. Test stages were 490s / 118s / 25s. Both earlier failed runs remain in the record, with strict SDK and navigation expectations corrected in separate commits. All-target release building and public distribution verification follow the tag.

The Windows function probes executed with PowerShell 7.5.4 on Linux. Actual Windows PowerShell 5.1, SCM/ACL/LocalSystem recovery and subsequent automatic progression remain owner acceptance.

Acceptance status

References #399, #398, #394, #390, #382, #361, #312, #294 and #141. These references do not close the live gates. Previously delivered callback, paired-authoring and SSO fixes remain included; genuine deployed companion/SSO/monitoring and native updater receipts are still required. The beta.46 checkpoint advanced 16 of 53 retained rows, leaving 37; the 17 exclusions stay inside the original 518-context universe.

No deployment is performed by this PR. Publication must retain pending-owner-testing functional status until live evidence establishes otherwise.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	🔄 Running since 2026-10-24T05:27:42.326236Z	2a87b65	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Proxicon]

The first hosted validation run (40066330689) is retained as failed. Its four failures were existing SDK-pin assertions still expecting 10.0.401: one global.json case and three Docker cases. The requested dependency update correctly pins 10.0.402.

Commit e269a1f0bd6888caf71dccee6c5ef22e6bd90021 updates only those two expected-version literals. Assertions, test selection, failure propagation, and the workflow budget are unchanged. The focused platform class passes locally: 5 tests, 0 failed, 0 skipped. The first hosted release-contract suite passed 177 tests; the corrected source now requires a new successful hosted validation before merge.

[Proxicon]

The second hosted run (40067727289) finished with Core 4,552/4,552 passed and API/PostgreSQL 36/36 passed, but remains failed: the component receipt has 599 passing cases and two timed-out assertions. Both exact administrator-navigation expectations omitted the newly added /admin/operator-policies link. The .NET job took 17m55s; this was not a workflow deadline failure.

Commit 1f2845aeb9272a9cb4a6b1f7afc53a1b3eb04769 corrects that expected navigation contract and models the explicit mcp.policy.admin capability in the existing fixture. It preserves ordered exact link equality, roles, all prior assertions and timeouts, and adds policy-only authority and direct-page expansion coverage. All 30 focused MainLayout cases passed, with zero failures, skips or timeouts. No production permissions, package versions, test timeouts or CI gates changed. A new full hosted run is required before merge.