Track what changed without parsing raw release markdown first.

Added

• Added Adobe online installer publication to the Windows release pipeline so OFX and Adobe installers are uploaded together.
• Added more focused host-plugin runtime timing fields for transport, render RPC, writeback, prewarm, and TorchTRT stages.

Changed

• Changed the After Effects Blue runtime path to keep zero-reference TorchTRT sessions warm across host lifecycle handoffs.
• Changed host-plugin frame processing to write into shared output frames when the engine can avoid an extra broker copy.
• Changed Blue request construction so source-detail passthrough is disabled for screen modes where it is not valid.

Fixed

• Fixed the slow After Effects Blue re-render path caused by destroying and recreating TorchTRT sessions between host requests.
• Fixed Adobe Blue quality metadata resolution so the runtime uses the packaged model resolution when available.

Added

• Added separate CorridorKey Green and CorridorKey Blue OFX descriptors so host node menus expose each screen family directly.
• Added build-reference labels for local Windows packages so the OFX panel, CLI, logs, and installer filename identify the exact build attempt.

Changed

• Changed the online installer upgrade path to preserve verified model/runtime pack caches while refreshing plugin binaries.
• Changed Windows GitHub prerelease publishing so a newly created tag targets the build commit being published.

Fixed

• Fixed Blue TorchTRT runtime loading by staging the wrapper and resolving the bundle Win64 directory before starting the runtime server.
• Fixed Nuke teardown crashes by skipping the optional persistent-message clear during Nuke instance destruction.
• Fixed Resolve teardown fail-fast behavior on the same optional host message clear.
• Fixed the online installer pack-marker migration so it no longer expands the application directory before Inno Setup initializes it.

Added

• Added the dynamic blue-screen path alongside the existing optimized green-screen path.
• Added deterministic screen handling for Green, Blue, and Blue-Green Channel Swap.
• Added Windows installer artwork and application icon branding.

Changed

• Changed Windows GitHub releases to publish the online installer only.
• Changed the online installer default selection to include all available packs while preserving custom green-only installs.
• Changed the CUDA/NPP hot path to use explicit NPP stream contexts for clean CUDA 12.9 builds.

Fixed

• Fixed Resolve panel version labeling so local and pre-release builds expose the published display label.
• Fixed installer component text to stay in English.
• Fixed installer icon generation so Inno Setup receives a compatible `.ico` resource.
• Fixed blue runtime cache handling so unchanged model/runtime packs are preserved across upgrades.

Added

• **`OfxProgressSuiteV2` modal during prepare/warmup.** First TensorRT engine compile of any quality (the documented 10–30 s cold-start) now surfaces as a modal "Loading..." dialog with a Cancel button on Nuke and as a status-bar progress on Resolve. Both hosts advertise this suite (openfx-misc README-hosts.txt); the channel was not wired up before.
• **"Open Log Folder" push-button** at the top of the runtime group on both hosts. Opens `%LOCALAPPDATA%\CorridorKey\Logs` directly in Explorer for the rich per-frame telemetry (stage timings, GPU detection, TensorRT compile traces) — no PowerShell paste-and-pray, no hidden menu hunt.
• **Spawned-PID capture + early child-death detection on Windows.** When the sidecar exits during the 10 s spawn window the plugin now surfaces *"OFX runtime server process (pid=N) exited during startup. See <log path>."* immediately, instead of waiting the full timeout. Saves the ~2 s Windows TCP connect-refused retry on a dead sidecar.
• **`event=server_listen_failed` log line on the sidecar side.** Previous versions died silently if `bind/listen` failed; the log now always reflects why the process exited.

Changed

• **Visual C++ Redistributable bundled app-local.** Foundry Nuke calls `SetDllDirectory()` at startup, which propagates into child processes. The CorridorKey sidecar previously loaded Nuke's `MSVCP140.dll` v14.36 instead of System32 v14.50 and crashed on missing exports before `listen()` ever ran. The bundle now ships `vcruntime140.dll`, `msvcp140.dll`, `msvcp140_1.dll`, `vcruntime140_1.dll` (and friends) inside `CorridorKey.ofx.bundle/Contents/Win64/` so the loader picks the version the binaries were built against. Microsoft's documented app-local deployment path. The release validator now hard-fails packaging if any redist DLL is missing (`scripts/validate_ofx_win.ps1` + `tests/regression/test_regression_0056_bundle_vcruntime.cpp`).
• **Persistent-message dedup.** `setPersistentMessage` is what Foundry Nuke uses to paint the coloured node badge in the Node Graph and the alert in the Viewer. Nuke's Error Console pane appends each call rather than coalescing per `message_id`, so calling it every render frame was flooding the console (the "wall of WARNINGs" testers reported). The plugin now only re-emits when the (severity, body) pair actually changes — so the node badge stays accurate, but the Error Console gets one line per real state change. Resolve skips this channel entirely because openfx-misc README-hosts.txt:75 documents Resolve's `setPersistentMessage` as `NULL` / unreliable.
• **Per-frame status fields hidden on Nuke.** `Last Frame`, `Guide Source`, `Runtime Path`, `Backend Work` are now `kOfxParamPropSecret=1` when the host is Foundry Nuke. `ofxParam.h:1088` forbids `paramSetValue` from the render thread, so on Nuke those fields could only ever lag the actual frame — showing them was dishonest UI. They remain visible on DaVinci Resolve, which permits mid-render `paramSetValue` and refreshes them live. openfx-misc README-hosts.txt:150 documents Nuke's "secret can never be revealed" rule, which is exactly the permanence we want for this host-aware decision.
• **`is_process_alive` runs before each Health probe.** Previous logic burned the full 10 s timeout polling Health on a dead sidecar; the alive check now short-circuits the loop within ~50 ms.

Fixed

• **Foundry Nuke 17 cold-start "Failed to prepare runtime session for Draft (512) using corridorkey_fp16_512.onnx: Timed out waiting for the OFX runtime server to start."** Root cause was the VC++ Redist DLL inheritance described above. Fixed by app-local deployment of the redistributable. ([#56](https://github.com/alexandremendoncaalvaro/CorridorKey-Runtime/issues/56))
• **OFX runtime server process leaked across host crashes.** The plugin now always captures and tracks the spawned sidecar PID on every supported platform; previously the handle was closed and the PID discarded on Win32 and on POSIX, leaving no way to verify the child was alive.

Added

• **Foundry Nuke 17 best-effort host support**, validated end-to-end through the parameter panel and an Alpha Hint render. The plugin now negotiates host-specific paths so DaVinci Resolve keeps its rich OFX 1.5 surface (live status panel updates during render, host-managed colourspaces, output colourspace negotiation) while Nuke takes the canonical spec-strict path with manual sRGB / Linear handling.
• Host-aware help routing, installer, and tutorial copy: NSIS installer detects Resolve and Nuke independently, the Help & Docs group surfaces a host-qualified tutorial label, and Foundry Nuke is documented as a best-effort host on Windows RTX.
• Operator log instrumentation in the OFX plugin: `paramDefine` failures now log `name`, type, and OFX status; `kOfxActionSyncPrivateData` and `update_runtime_panel_values` log entry / exit with the deferral flags. A panel-empty or silent-hang report can now be diagnosed from `%LOCALAPPDATA%\CorridorKey\Logs\ofx.log` alone, without rebuilding with ad-hoc tracing.
• Headless Nuke smoke probe in `scripts/validate_ofx_win.ps1` (optional path) that loads the plugin in a Nuke session as a release-time guard.

Changed

• **Windows ladder is now FP16-only on RTX.** The INT8 ONNX rung and the CPU rendering path are retired across the OFX panel, the runtime, packaging, and user docs. Auto continues to respect the safe quality ceiling of the active GPU tier; manual fixed quality may attempt a higher packaged rung directly. The runtime / installer footprint shrinks accordingly.
• Plugin DLL is isolated from ONNX Runtime imports (Path B refactor). All inference work runs in a separate `corridorkey_ofx_runtime_server.exe` process, which closed the auto-update / hot-reload hangs Resolve users hit on v0.7.5.
• Runtime client bootstrap is deferred from `kOfxImageEffectActionCreateInstance` to the first `render()` call, matching the OFX 1.4 canonical pattern (Examples/Basic, openfx-misc Anaglyph). `createInstance` is now caching of handles only.
• OFX 1.5 colour management properties (`kOfxImageEffectPropColourManagementStyle`, `kOfxImageClipPropPreferredColourspaces`, `kOfxImageClipPropColourspace`) are declared on Resolve and skipped on Foundry Nuke. Foundry Nuke 17.0 release notes do not advertise OFX 1.5 colour-management support, and the openfx-misc PIK reference chroma keyer (validated in Nuke + Resolve + Natron) does not declare these properties either; with the declarations active the Nuke panel rendered partially and crashed when an Alpha Hint clip was connected. Resolve keeps the rich negotiation; Nuke gets the manual sRGB / Linear path through the Input Color Space parameter. References: <https://learn.foundry.com/nuke/content/release_notes/17.0/nuke_17.0v1_releasenotes.html>, <https://github.com/NatronGitHub/openfx-misc/blob/master/PIK/PIK.cpp>.

Fixed

• **Foundry Nuke parameter panel empty.** `kParamRuntimePath` and `kParamRuntimeBackendWork` were each defined twice in `describe_in_context` (in `runtime_group` and again in `runtime_details_group`). The OFX 1.5 spec requires every parameter name to be unique to all parameters in the plug-in (`vendor/openfx/include/ofxParam.h:912` verbatim "name -- unique name of the parameter"). Resolve silently kept the first definition; Nuke rejected the descriptor on the duplicate, leaving the panel empty after every other compatibility fix was already in place. The duplicates are removed.
• **Foundry Nuke Alpha Hint render path stable.** Combined effect of the threading-model defer, the secret-polarity workaround (params declared as secret in `describe` can never be revealed afterwards on strict hosts; the update-banner params are now declared visible and forced secret at the end of `create_instance` per the Natron OFX advanced-issues guide), the OFX 1.5 colour-management host-branching, and the unique-name fix.
• DaVinci Resolve compatibility regression from the Path B refactor: the placeholder `Backend::Auto` introduced when the plugin DLL was decoupled from ONNX Runtime caused the candidate-selection loop to iterate past the first FP16 success into INT8 fallback artifacts, and the runtime server crashed mid-prepare on INT8. `backend_matches_request` now treats `Auto` as a wildcard so the loop short-circuits exactly as it did before the Path B refactor.
• `capture_host_name` no longer aborts on hosts whose property suite throws; `format_host_memory_fields` is cross-platform; `test_ofx_plugin_exceptions` no longer silently breaks under hardened strict mode.

Added

• `metal_memory_probe` (`src/core/metal_memory_probe.hpp` / `.mm`) wrapping `MTLCreateSystemDefaultDevice().recommendedMaxWorkingSetSize`. The probe is the only backend-specific hook needed to drive the new admission policy; it returns zero on non-Apple builds or when the Metal device is unavailable, which the policy treats as fall-open so non-macOS environments do not regress.
• `ErrorCode::InsufficientMemory` in the public `corridorkey::types` header. Returned by `OfxSessionBroker::prepare_session` when `can_admit_session` refuses the requested shape. The OFX plugin intercepts this code in both `create_instance` and `ensure_engine_for_quality` and calls the host's `post_message` with `kOfxMessageError` so the user sees an actionable alert rather than a silent resolution change.
• `PrewarmMemorySnapshot`, `estimate_mlx_resident_bytes(shape_px)`, `estimate_mlx_peak_compile_bytes(shape_px)`, `can_admit_session(snapshot, shape_px)`, `PrewarmDecision`, `evaluate_prewarm_decision(snapshot, shape_px)`, and `prewarm_decision_label(PrewarmDecision)` in `src/app/ofx_session_policy.hpp`. Admission uses the steady-state resident estimate with a 1.5x safety margin and discounts MLX cache by 50% as reclaimable; the JIT peak is modeled at three times steady-state. The decision enum emits stable log tokens (`prewarm`, `skip_insufficient_headroom`, `skip_system_pressure`, `skip_telemetry_unavailable`) pinned by a regression test so log parsers stay stable.
• `prepare_timeout_ms` field on `OfxRuntimePrepareSessionRequest`, serialized by `to_json` / `prepare_session_request_from_json` with backward-compatible parsing. The plugin sends 90% of its RPC prepare-timeout budget so the server has time to return an `InsufficientMemory` error (or a success) before the plugin-side transport gives up.

Changed

• `OfxSessionBroker::prepare_session` replaces the `safe_bridge_ceiling_px` / `StickyBridgeCeilingState` path with an admission-then-prewarm flow: capture memory snapshot, clear MLX cache when under pressure, call `can_admit_session`, build the engine only on admission, evaluate `evaluate_prewarm_decision`, and hand the JIT to a detached worker whose completion is published through a `std::shared_future<void>` stored in the `SessionEntry`. `render_frame` waits on that future (instrumented as a `prewarm_wait` stage) before invoking `process_frame`, so the user-selected bridge is used end-to-end and the first rendered frame does not re-JIT.
• `SessionEntry::engine` is now a `std::shared_ptr<Engine>` so the detached prewarm worker holds an independent lifetime reference and the broker's idle-session TTL cannot destroy the engine under a running compile.
• `prepare_session` respects the Prepare Timeout that the user already exposes in the OFX panel. When the compile exceeds the timeout the RPC returns promptly with the session marked as not-yet-ready; the worker continues to completion and the next `render_frame` parks on `prewarm_ready` instead of starting a new JIT.
• `ofx_runtime_client` forwards a reduced prepare timeout (90% of its RPC budget) through the new `prepare_timeout_ms` field for both first-time prepares and session recovery, so the client never observes a transport timeout before the server has a chance to respond.

Fixed

• **User-selected bridge is the bridge that runs.** Previously, `prepare_session` could remap a requested 1024 bridge to 768 (or 768 to 512, and so on) without notifying the user, and the runtime snapshot reported the remapped resolution while the plugin UI still showed the original value. Admission now either runs the requested shape or returns `InsufficientMemory`; the plugin surfaces the error through the host alert.
• **Prewarm target matches the render target.** Prewarm previously JITted against `effective_resolution` (the silently-downshifted value), so the first `render_frame` at `target_resolution` paid a second JIT. With the downshift removed, both paths use the same resolution and the first frame is not a compile boundary.
• **Prepare Timeout is honored on macOS.** A bridge whose compile exceeded the timeout no longer blocks the RPC; the worker detaches, the plugin gets a prompt response, and subsequent render calls park on the shared future rather than racing the engine.

Added

• **QoS escape over the `posix_spawn` taskgate.** `pthread_override_qos_class_start_np(pthread_self(), QOS_CLASS_USER_INITIATED, 0)` wraps `posix_spawn` in `src/plugins/ofx/ofx_runtime_client.cpp launch_server`, and `pthread_set_qos_class_self_np(QOS_CLASS_USER_INITIATED)` reasserts on the server's main thread in `src/cli/main.cpp`. The override is the documented libdispatch priority-inversion API and is the only Darwin path that raises the caller's effective QoS past the taskgate ceiling; `posix_spawnattr_set_qos_class_np` alone silently clamps to the parent's effective QoS.
• **MLX memory governor (`src/core/mlx_memory_governor.{hpp,cpp}`).** Idempotent init on first MLX session calls `set_wired_limit(0)` (the `mlx-lm#883` kernel-panic class only triggers for non-zero wired limits), `set_memory_limit(hw.memsize * 0.75)` (hard ceiling MLX refuses to cross), and `set_cache_limit(hw.memsize * 0.15)` (soft buffer-cache ceiling so MLX cannot retain GB of unused allocations and starve Resolve's working set on a 16 GB box). Exposes `Policy { Normal, PressureWarn, PressureCritical }` that halves and zeros the cache limit and calls `clear_cache()` on transition.
• **Dispatch memory-pressure monitor.** `src/app/ofx_runtime_service.cpp` now installs a RAII `DISPATCH_SOURCE_TYPE_MEMORYPRESSURE` source on a dedicated serial queue. On `WARN` the MLX cache cap drops to `baseline/4` and `clear_cache()` fires; on `CRITICAL` the cap drops to `0` and the cache is fully purged. This is the same signal `jetsam` and `memorystatus` use to decide when to terminate processes, so the governor reacts on the same edge the kernel would otherwise act on.
• **Host-memory-aware bridge downshift.** `src/app/ofx_session_broker.cpp prepare_session` samples `host_statistics64(HOST_VM_INFO64)` (`free_count`, `compressor_page_count`) and, when pressure is detected, caps the effective bridge resolution: critical -> 512, warn -> 768, moderate -> 1024, normal -> no cap. This pre-empts thrash at session preparation instead of relying on the dispatch signal to land mid-render.

Changed

• MLX bridge evaluation now splits `eval()` and `wait()` stages and instruments CPU resize so per-stage latency is visible in the log instead of collapsed into a single `mlx_bridge_ms`.
• Release pipeline label shape for macOS is now `vX.Y.Z-mac.N`, matching the Windows track. The pipeline refuses any other form.
• `scripts/release_pipeline_macos.sh` and `scripts/publish_github_release.sh` carry the same notes-file, dirty-tree, and tag-immutability guardrails Windows shipped in `v0.7.6-win.1`.

Fixed

• **Scrubbing in DaVinci Resolve no longer stalls to 30-120s per frame from the QoS inheritance path.** Measured on Apple Silicon with `corridorkey_mlx_bridge_1024.mlxfn` at 1920x1080: steady-state per-frame latency is ~1.7s regardless of which Resolve thread pool triggered the spawn, down from 65-117s under `QOS_CLASS_BACKGROUND` inheritance.
• **Per-frame latency no longer degrades from 1.7s to ~100s on 16 GB Apple Silicon under concurrent load** (browser + Resolve + scrub). Root cause: MLX's default cache sizing (effectively unbounded on 16 GB) let the buffer cache crowd the Metal-recommended working set, which tripped the macOS VM compressor into a state where every Metal submit blocked on compressor work. The governor caps, dispatch-source downshift, and bridge downshift now keep the active-plus-cache footprint below the compressor trigger on production concurrent workloads.

Added

• PE import scan in `scripts/validate_ofx_win.ps1` fails the release if `CorridorKey.ofx`, `corridorkey.exe`, or `corridorkey_ofx_runtime_server.exe` imports a DLL that is neither in the bundle nor on the Windows system allowlist.
• `Publish-CorridorKeyGithubRelease` helper in `scripts/release_pipeline_windows.ps1` publishes with `--prerelease` or `--latest` based on the tag shape and refuses to re-publish an existing tag (tag immutability enforced at the pipeline).
• Platform detection helpers (`current_platform_code`, `prerelease_platform_code`) and per-platform prerelease filtering in `src/app/version_check.cpp`.

Changed

• Prerelease tag format is now platform-qualified: `vX.Y.Z-win.N` (also `-mac.N`, `-linux.N`). A suffix-only tag like `v0.7.5-22` is rejected by the pipeline. Each platform maintains an independent counter.
• `version_check.cpp` now implements full SemVer 2.0.0 prerelease precedence (numeric identifiers compared numerically) and filters prerelease candidates to the current platform, so a Windows client never gets offered a macOS prerelease or a naked stable tag that only carries non-Windows assets.
• Release assets are installers only: `.exe` on Windows, `.dmg` on macOS, `.deb` + `.rpm` on Linux. The Windows `.zip` portable and the Linux `.tar.gz` portable are no longer produced or published.
• Root CMake `VERSION` bumped `0.7.5` -> `0.7.6` to start the new tag scheme at `v0.7.6-win.1`.

Fixed

• OFX POST_BUILD in `src/plugins/ofx/CMakeLists.txt` now expands `$<TARGET_RUNTIME_DLLS:corridorkey_ofx>` so every transitive shared-library dependency (notably the CUDA NPP DLLs `nppc64_12`, `nppial64_12`, `nppidei64_12`, `nppig64_12`) is copied into `Contents/Win64/` alongside the plugin. This is the direct fix for the v0.7.5-21 regression where Resolve silently refused to load the plugin.
• The root cause of the v0.7.5 auto-update misfire (a user on `v0.7.5-22` being offered "update" back to `v0.7.5`) is closed by the new platform-qualified tags plus SemVer 2.0.0 numeric precedence; a mutable shared `v0.7.5` tag no longer exists.
• `Publish-CorridorKeyGithubRelease` now isolates the existence probe under `$ErrorActionPreference = 'Continue'` so `gh release view` returning non-zero on a missing release does not escalate to a terminating error.