Prepare the 4.2.1 release (#63)

Bump the version to 4.2.1 in Winnow.ps1 (.VERSION and WINNOW_VERSION) and the
Initialize-Environment fallback, date the CHANGELOG 4.2.1 section, add the
HISTORY entry, and rebuild the standalone. Patch release: reliable user-hive
unload (GC before reg unload) and qword/hex(2)/hex(7) support in the PowerShell
registry writer, plus the Sandbox-only mutating tests for Scope B and the
watchdog.

Author: BiosSystem

CHANGELOG.md

@@ -4,7 +4,7 @@ Document all notable Winnow changes in this file. Releases before 4.0.0 were pub
 
 Follow [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [4.2.1] - 2026-09-18
 
 ### Fixed
 

HISTORY.md

@@ -1,3 +1,16 @@
+## [v4.2.1] - 2026-09-18
+### Artifacts
+- **Release Package**: Winnow-v4.2.1.zip
+- **Standalone**: Winnow-Standalone.ps1
+- Both built and published by the release workflow on tag push. Checksums are on the release page.
+### Fixed
+- Unload the target user's registry hive reliably: force a GC to release the .NET RegistryKey handles the apply/verify/restore work opened into the mounted hive, and retry, so `reg unload` no longer fails and leaves the hive mounted (could lock the profile) on `-Sysprep`/`-User` runs.
+- The PowerShell registry writer now applies `qword`, `hex(2)` (REG_EXPAND_SZ), and `hex(7)` (REG_MULTI_SZ) values instead of throwing; the parser and verifier already handled all three, so the writer was the only part out of step.
+### Added
+- Sandbox-only mutating integration tests for Scope B module registry rollback and the update watchdog (real install, ACL lockdown, integrity, policy re-assertion, tamper detection).
+### Known limitation
+- The mutating end-to-end paths are unit-tested and read-path-verified but have not yet been run in Windows Sandbox.
+
 ## [v4.2.0] - 2026-09-17
 ### Artifacts
 - **Release Package**: Winnow-v4.2.0.zip

Scripts/Helpers/Initialize-Environment.ps1

@@ -6,7 +6,7 @@ $script:Version = if (Get-Variable -Name WINNOW_VERSION -Scope Global -ErrorActi
 } elseif ($WINNOW_VERSION) {
     $WINNOW_VERSION
 } else {
-    "4.2.0"
+    "4.2.1"
 }
 $script:AppVersion = $script:Version
 $rootDir = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent

Winnow-Standalone.ps1

@@ -6,7 +6,7 @@
     purge AI/Copilot integrations, and reclaim your Windows experience.
     Created by Bios-System | https://github.com/BiosSystem/Winnow
 .VERSION
-    4.2.0
+    4.2.1
 #>
 [CmdletBinding(SupportsShouldProcess)]
 param (
@@ -155,7 +155,7 @@ if ($PSVersionTable.PSEdition -eq 'Core') {
     exit 1
 }
 
-Set-Variable -Name 'WINNOW_VERSION' -Value '4.2.0' -Option Constant
+Set-Variable -Name 'WINNOW_VERSION' -Value '4.2.1' -Option Constant
 
 # Call Helper Scripts
 . (Join-Path $PSScriptRoot 'Scripts\Helpers\Ensure-Admin.ps1') -OriginalCommandPath $PSCommandPath -OriginalBoundParameters $PSBoundParameters -OriginalUnboundArguments $MyInvocation.UnboundArguments