AronAxe · Oct 6, 2026 · Oct 6, 2026
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
@@ -34,6 +34,8 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ github.token }}
         run: ./scripts/build_release.ps1
+      - name: Exercise the actual Windows window, native dialogs and save-on-close
+        run: python scripts/native_smoke.py --executable dist/GraphPaper/GraphPaper.exe --out test-results/native-package
       - uses: actions/upload-artifact@v4
         with:
           name: GraphPaper-Windows-x64
@@ -49,7 +51,7 @@ jobs:
           $version = python -c "from graphpaper import __version__; print(__version__)"
           if ($env:GITHUB_REF_NAME -ne "v$version") { throw 'Tag does not match application version.' }
           gh release view $env:GITHUB_REF_NAME *> $null
-          if ($LASTEXITCODE -ne 0) { gh release create $env:GITHUB_REF_NAME --verify-tag --title "GraphPaper $env:GITHUB_REF_NAME" --notes-file docs/RELEASE-0.2.md }
+          if ($LASTEXITCODE -ne 0) { gh release create $env:GITHUB_REF_NAME --verify-tag --title "GraphPaper $env:GITHUB_REF_NAME" --notes-file docs/RELEASE-0.2.1.md }
           gh release upload $env:GITHUB_REF_NAME "dist/GraphPaper-v$version-Windows-x64.zip" dist/SHA256SUMS.txt --clobber
       - uses: actions/upload-artifact@v4
         if: always()

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.2.1 ? 2026-10-06
+
+- Fix recursive native-window exposure in the JavaScript bridge.
+- Fix native close/save deadlock without discarding pending edits.
+- Add real Windows mouse, bridge, dialog and save-on-close regression tests for the compiled release.
+
 ## 0.2.0 — 2026-10-05
 
 - Learn and edit an author voice from uploaded writing or selected article URLs.

diff --git a/README.md b/README.md
@@ -3,6 +3,9 @@
 ![GraphPaper — Graph-first AI writing studio](docs/images/graphpaper-header.svg)
 ### A studio for connected thought.
 
+**Windows fix: [v0.2.1](https://github.com/AronAxe/GraphPaper/releases/tag/v0.2.1)** fixes the native interface freeze and the save-on-close deadlock. Existing projects remain intact. See the [patch notes](docs/RELEASE-0.2.1.md).
+
+
 **Source material → knowledge graph → a distinctive angle → an editable outline → writing worth reading.**
 
 GraphPaper is a local-first, Windows-oriented writing studio for **nonfiction and fiction**. It is a graphical application, not a command-line writing tool. Bring your sources, see how their ideas connect, guide the interpretation, and keep authorship of the result.

diff --git a/docs/QUALITY.md b/docs/QUALITY.md
@@ -1,5 +1,26 @@
 # Quality, tests and known limits
 
+## 0.2.1 native Windows correction ? 6 October 2026
+
+The reported interface freeze exposed a gap in the earlier validation: the
+Windows startup probe and Chromium tests did not initialize or interact with
+the native JavaScript/Python bridge. That bridge exposed a public native Window,
+so pywebview recursively inspected Windows/COM objects. A separate close callback
+also waited for JavaScript while holding the WinForms UI thread. Both are fixed.
+
+The corrected **compiled executable**, not just a browser substitute, passed all
+9 native interaction checks: Windows mouse input, restricted API initialization,
+promise round-trip, project creation/typing, Connections, native Save As open/cancel,
+and saving pending text before a normal Windows close. The same native test also
+passed from source. 126 automated Windows tests passed, with one symlink-permission
+skip. All 26 browser workflows passed; no JavaScript page errors occurred.
+
+Reports: [release summary](validation/v0.2.1/summary.json) and
+[native executable test](validation/v0.2.1/native-package.json). All tests used
+isolated temporary projects. No user manuscript or credentials were used, and no
+live model or OAuth request was made. The strict CSP is unchanged.
+
+
 ## Version 0.2 validation update
 
 The 0.2 update was tested on a native Windows 11 machine with an isolated Python 3.13 environment: **120 automated tests passed**, with one symlink-permission test skipped; **all 26 real-HTTP browser workflow checks passed** with zero JavaScript page errors. The official bundled **Codex CLI 0.160.1** passed its signed-out app-server handshake and required-command checks. These are local Windows results, not GitHub-hosted CI results; the hosted runner remained queued and that run was cancelled. Reports are in [validation/v0.2](validation/v0.2/) (or the corresponding directory from this documentation page).

diff --git a/docs/RELEASE-0.2.1.md b/docs/RELEASE-0.2.1.md
@@ -0,0 +1,42 @@
+# GraphPaper 0.2.1 ? Windows interface freeze fix
+
+This is a corrective release for the Windows interface in 0.2.0. It retains
+all author-voice, project-folder, prose-editing and Codex sign-in features.
+
+## Fixed
+
+- Restricted the Python/JavaScript bridge to four explicit methods. Its store,
+  job runner and native window are now private and cannot be recursively
+  reflected into the browser API. Native testing of the old bridge produced
+  recursion-limit and wrong-thread COM/WebView2 errors while API initialization
+  failed to finish.
+- Fixed a second native deadlock on closing: the WinForms closing handler now
+  returns immediately and performs the save handshake on a worker, rather than
+  waiting for JavaScript while holding the UI event loop.
+- Failed saves and declined close prompts reset the handshake so closing can be
+  retried. The original manuscript is not discarded to make the window close.
+
+## Windows download
+
+Extract **GraphPaper-v0.2.1-Windows-x64.zip** into a new folder and open
+**GraphPaper.exe**. Keep its `_internal` companion folder. No Python installation
+is needed. Close the old executable first. Existing projects and credentials
+remain in the same local data directory; this patch does not reset them.
+
+## Native regression coverage
+
+The new `scripts/native_smoke.py` launches the actual Windows/WebView2 shell in
+an isolated temporary project directory. It sends a genuine Windows mouse click,
+checks the restricted bridge and its returned promise, creates a project, types
+in the editor, opens Connections, opens and cancels a native Save As dialog, and
+sends the Windows close message before autosave's delay expires. It then verifies
+that the pending manuscript was written and the process exited normally.
+
+It runs against source and the compiled executable. This is not the browser-only
+or HTTP-startup check used in previous releases. The release workflow now requires
+the compiled native regression before uploading its Windows artifact.
+
+126 automated Windows tests passed; one symlink-permission test was skipped.
+Native test reports are recorded with this release after the packaged run.
+No live model request or OAuth login is part of these tests. The binary remains
+unsigned. SHA256SUMS.txt records the exact downloadable ZIP checksum.
diff --git a/docs/validation/v0.2.1/browser.json b/docs/validation/v0.2.1/browser.json
@@ -0,0 +1,25 @@
+{
+  "mode": "HTTP browser",
+  "live_models": false,
+  "checks": [
+    "Welcome and empty state",
+    "Illustrative graph renders with 18 nodes",
+    "Inspect graph node and persist pin",
+    "Path query and highlight",
+    "Edit and select an angle",
+    "Edit and reorder outline",
+    "Manuscript autosave and safe live preview",
+    "Clickable source references",
+    "Read and restore earlier version",
+    "Export options and valid Word output",
+    "Configure provider through UI (mock transport only)",
+    "Browser file-input upload and source ingestion",
+    "Complete graph \u2192 JEV \u2192 angle \u2192 outline \u2192 draft \u2192 review path with deterministic AI",
+    "Explicit revision job and versioning",
+    "Fiction from premise, scene generation and continuity ledger",
+    "Light theme",
+    "Responsive 390px layout without horizontal overflow"
+  ],
+  "page_errors": [],
+  "ok": true
+}
diff --git a/docs/validation/v0.2.1/native-package.json b/docs/validation/v0.2.1/native-package.json
@@ -0,0 +1,33 @@
+{
+  "native_windows": true,
+  "packaged_executable": true,
+  "live_models": false,
+  "checks": [
+    "Actual Windows/WebView2 window starts and responds to Windows messages",
+    "Native bridge initializes with only four explicit methods and resolves its promise",
+    "Strict application CSP remains enabled",
+    "A Windows mouse click opens the project dialog without freezing the host",
+    "Native window supports typing and project creation",
+    "Connections dialog opens and closes in the native window",
+    "Native Save As dialog opens, cancels and returns without blocking the interface",
+    "Windows close completes the save handshake and exits normally",
+    "Pending manuscript text is persisted before the native process exits"
+  ],
+  "page_errors": [],
+  "ok": true,
+  "bridge_methods": [
+    "cancel_close",
+    "notify_ready",
+    "request_close",
+    "save_export"
+  ],
+  "native_child_classes": [
+    "Chrome_RenderWidgetHostHWND",
+    "Chrome_WidgetWin_0",
+    "Chrome_WidgetWin_1",
+    "Intermediate D3D Window",
+    "WindowsForms10.Window.8.app.0.aec740_r21_ad1"
+  ],
+  "exit_code": 0,
+  "recursion_errors": false
+}
diff --git a/docs/validation/v0.2.1/native-source.json b/docs/validation/v0.2.1/native-source.json
@@ -0,0 +1,33 @@
+{
+  "native_windows": true,
+  "packaged_executable": false,
+  "live_models": false,
+  "checks": [
+    "Actual Windows/WebView2 window starts and responds to Windows messages",
+    "Native bridge initializes with only four explicit methods and resolves its promise",
+    "Strict application CSP remains enabled",
+    "A Windows mouse click opens the project dialog without freezing the host",
+    "Native window supports typing and project creation",
+    "Connections dialog opens and closes in the native window",
+    "Native Save As dialog opens, cancels and returns without blocking the interface",
+    "Windows close completes the save handshake and exits normally",
+    "Pending manuscript text is persisted before the native process exits"
+  ],
+  "page_errors": [],
+  "ok": true,
+  "bridge_methods": [
+    "cancel_close",
+    "notify_ready",
+    "request_close",
+    "save_export"
+  ],
+  "native_child_classes": [
+    "Chrome_RenderWidgetHostHWND",
+    "Chrome_WidgetWin_0",
+    "Chrome_WidgetWin_1",
+    "Intermediate D3D Window",
+    "WindowsForms10.Window.8.app.0.aec740_r21_ad1"
+  ],
+  "exit_code": 0,
+  "recursion_errors": false
+}
diff --git a/docs/validation/v0.2.1/package.json b/docs/validation/v0.2.1/package.json
@@ -0,0 +1,21 @@
+{
+  "ok": true,
+  "checks": {
+    "/health": {
+      "status": 200,
+      "bytes": 29
+    },
+    "/": {
+      "status": 200,
+      "bytes": 705
+    },
+    "/static/app.js": {
+      "status": 200,
+      "bytes": 71060
+    },
+    "/static/styles.css": {
+      "status": 200,
+      "bytes": 25023
+    }
+  }
+}
diff --git a/docs/validation/v0.2.1/studio.json b/docs/validation/v0.2.1/studio.json
@@ -0,0 +1,17 @@
+{
+  "mode": "real HTTP",
+  "live_models": false,
+  "checks": [
+    "Voice sample upload through the actual file input",
+    "Learn, inspect and edit a persistent author voice profile",
+    "Project folder import and automatic source ownership",
+    "Idle folder watcher detects and imports new files without an AI call",
+    "Local explainable prose inspection",
+    "Humanizer proposal, side-by-side comparison and explicit acceptance",
+    "Separate deslopping pass and non-destructive rejection",
+    "Codex subscription provider selectable without an API key",
+    "New controls fit a smaller desktop window"
+  ],
+  "page_errors": [],
+  "ok": true
+}
diff --git a/docs/validation/v0.2.1/summary.json b/docs/validation/v0.2.1/summary.json
@@ -0,0 +1,16 @@
+{
+  "version": "0.2.1",
+  "windows_unit_tests": {
+    "passed": 126,
+    "skipped": 1,
+    "failed": 0
+  },
+  "native_source_checks": 9,
+  "native_packaged_executable_checks": 9,
+  "browser_workflow_checks": 26,
+  "native_page_errors": [],
+  "live_model_calls": false,
+  "archive": "GraphPaper-v0.2.1-Windows-x64.zip",
+  "size_bytes": 157603152,
+  "sha256": "988cd93b4a1a1f7a4f849de800ea385a0dcc528c69a667f81a0c728f46e357b4"
+}