﻿GUARDIAN LAB v0.9.5.1
===================


========================================================================
ENGLISH
========================================================================
GUARDIAN LAB — INSTALL / BUILD ORDER

00  Read this file.
01  Run 01_SETUP_GUARDIAN_DEV_TRUST.cmd once for this Windows user.
02  Run 02_BUILD_GUARDIAN_EXE.cmd.
    On the first Step 02 run, Guardian Lab may show a certificate confirmation dialog.
    Click OK only if the dialog identifies Guardian Lab Development and you intentionally started the build.
03  Run 03_VERIFY_GUARDIAN_SIGNATURE.cmd and require Signature: Valid.
04  Run 04_GUARDIANLAB.exe.

IN-APP SETUP
1. SCAN LAN — Guardian detects devices on THIS user's current network.
2. SAVE TARGET — save THIS user's selected TV/device.
3. Choose TV ONLY or WHOLE HOME.
4. TURN ON GUARDIAN.

The bold DNS shown by Guardian is detected from the computer currently running Guardian Lab. No personal developer IP or TV address is shipped as the user's destination. Existing custom_block.txt / AI memory are preserved and never replaced by the packaged starter base.

CONTACT
The app shows only “Contact”. The recipient e-mail is not displayed. A message can be sent only after the sender receives and enters a six-digit verification code. The verified-contact backend must first be configured by the owner (see the internal backend setup file).

PROTECTION
The public runtime package created by Step 02 contains no C# source and no private signing key. The EXE is optimized, Authenticode-signed and hashed. This makes casual copying/rebranding harder, but no locally executed desktop program can be made impossible to reverse engineer. Do not add packers/anti-debug tricks merely to look “encrypted”; they often increase antivirus detections.

========================================================================
FRANÇAIS
========================================================================
GUARDIAN LAB — ORDRE D’INSTALLATION / COMPILATION

00  Lisez ce fichier.
01  Exécutez 01_SETUP_GUARDIAN_DEV_TRUST.cmd une seule fois pour cet utilisateur Windows.
02  Exécutez 02_BUILD_GUARDIAN_EXE.cmd.
    Lors du premier Step 02, une confirmation de certificat Guardian Lab peut apparaître.
    Cliquez sur OK uniquement si elle indique Guardian Lab Development et si vous avez lancé la compilation.
03  Exécutez 03_VERIFY_GUARDIAN_SIGNATURE.cmd et exigez Signature: Valid.
04  Lancez 04_GUARDIANLAB.exe.

CONFIGURATION DANS L’APPLICATION
1. ANALYSER LE RÉSEAU — Guardian détecte le réseau de CET utilisateur.
2. ENREGISTRER CIBLE — enregistrez le téléviseur/appareil de CET utilisateur.
3. Choisissez TV UNIQUEMENT ou TOUTE LA MAISON.
4. ACTIVEZ GUARDIAN.

L’adresse DNS en gras est détectée sur l’ordinateur qui exécute Guardian. Aucune IP personnelle du développeur n’est fournie comme destination. Les listes et la mémoire existantes sont conservées.

CONTACT
Seul « Contact » est visible. L’adresse du destinataire n’est pas affichée. L’expéditeur doit confirmer son e-mail avec un code à six chiffres avant d’envoyer un message.

PROTECTION
Le paquet runtime créé par Step 02 ne contient ni source C# ni clé privée de signature. L’EXE est optimisé, signé et haché. Cela complique la copie simple, sans prétendre rendre le reverse engineering impossible.

========================================================================
ESPAÑOL
========================================================================
GUARDIAN LAB — ORDEN DE INSTALACIÓN / COMPILACIÓN

00  Lee este archivo.
01  Ejecuta 01_SETUP_GUARDIAN_DEV_TRUST.cmd una vez para este usuario de Windows.
02  Ejecuta 02_BUILD_GUARDIAN_EXE.cmd.
    La primera vez puede aparecer una confirmación del certificado Guardian Lab.
    Pulsa OK solo si muestra Guardian Lab Development y tú iniciaste la compilación.
03  Ejecuta 03_VERIFY_GUARDIAN_SIGNATURE.cmd y exige Signature: Valid.
04  Ejecuta 04_GUARDIANLAB.exe.

CONFIGURACIÓN EN LA APP
1. ESCANEAR RED — Guardian detecta la red actual de ESTE usuario.
2. GUARDAR OBJETIVO — guarda el TV/dispositivo de ESTE usuario.
3. Elige SOLO TV o TODA LA CASA.
4. ACTIVA GUARDIAN.

El DNS en negrita se detecta en el equipo que está ejecutando Guardian. No se distribuye ninguna IP personal del desarrollador como destino. Las listas y memoria existentes se conservan.

CONTACTO
La aplicación solo muestra «Contacto». No muestra el correo del destinatario. El remitente debe verificar su correo mediante un código de seis dígitos antes de enviar un mensaje.

PROTECCIÓN
El paquete runtime creado por Step 02 no incluye código fuente C# ni clave privada. El EXE está optimizado, firmado y verificado por hash. Esto dificulta la copia/rebranding casual, sin afirmar que sea imposible hacer ingeniería inversa.

========================================================================
РУССКИЙ
========================================================================
GUARDIAN LAB — ПОРЯДОК УСТАНОВКИ / СБОРКИ

00  Прочитайте этот файл.
01  Один раз запустите 01_SETUP_GUARDIAN_DEV_TRUST.cmd для текущего пользователя Windows.
02  Запустите 02_BUILD_GUARDIAN_EXE.cmd.
    При первом Step 02 может появиться подтверждение сертификата Guardian Lab.
    Нажимайте OK только если указан Guardian Lab Development и сборку запустили вы.
03  Запустите 03_VERIFY_GUARDIAN_SIGNATURE.cmd и убедитесь: Signature: Valid.
04  Запустите 04_GUARDIANLAB.exe.

НАСТРОЙКА В ПРИЛОЖЕНИИ
1. СКАНИРОВАТЬ СЕТЬ — определяется текущая сеть ЭТОГО пользователя.
2. СОХРАНИТЬ ЦЕЛЬ — сохраните ТВ/устройство ЭТОГО пользователя.
3. Выберите ТОЛЬКО ТВ или ВЕСЬ ДОМ.
4. ВКЛЮЧИТЕ GUARDIAN.

Жирный DNS определяется на компьютере, где запущен Guardian. Личный IP разработчика не поставляется как адрес назначения. Существующие списки и память сохраняются.

КОНТАКТ
В приложении отображается только «Контакт». Адрес получателя не показывается. Перед отправкой сообщения отправитель подтверждает свой e-mail шестизначным кодом.

ЗАЩИТА
Runtime-пакет после Step 02 не содержит исходников C# и приватного ключа подписи. EXE оптимизирован, подписан и имеет SHA-256. Это усложняет простое копирование, но не делает локальную программу абсолютно неразбираемой.

========================================================================
SRPSKI
========================================================================
GUARDIAN LAB — REDOSLED INSTALACIJE / BUILD-A

00  Pročitaj ovaj fajl.
01  Pokreni 01_SETUP_GUARDIAN_DEV_TRUST.cmd jednom za tog Windows korisnika.
02  Pokreni 02_BUILD_GUARDIAN_EXE.cmd.
    Pri prvom Step 02 može se pojaviti Guardian Lab potvrda za certifikat.
    Klikni OK samo ako piše Guardian Lab Development i ako si ti pokrenuo build.
03  Pokreni 03_VERIFY_GUARDIAN_SIGNATURE.cmd i mora da piše Signature: Valid.
04  Pokreni 04_GUARDIANLAB.exe.

PODEŠAVANJE U PROGRAMU
1. SKENIRAJ MREŽU — Guardian prepoznaje trenutnu mrežu TOG korisnika.
2. SAČUVAJ CILJ — čuva TV/uređaj TOG korisnika.
3. Izaberi SAMO TV ili CELA KUĆA.
4. UKLJUČI GUARDIAN.

Podebljani DNS Guardian automatski uzima sa računara na kojem se trenutno izvršava. Ne isporučuje se ničija lična developerska IP/TV adresa kao korisnikov cilj. Postojeći custom_block.txt, AI memory i naučeni podaci ostaju sačuvani i početna baza ih nikad ne prepisuje.

KONTAKT
U programu se vidi samo „Kontakt“. E-mail primaoca se ne prikazuje. Pošiljalac prvo mora da primi i unese šestocifreni verifikacioni kod, pa tek onda može da napiše i pošalje poruku.

ZAŠTITA
Runtime paket koji pravi Step 02 ne sadrži C# source niti privatni signing key. EXE je optimizovan, Authenticode potpisan i ima SHA-256 proveru. To znatno otežava obično kopiranje i prepakivanje, ali nijedan desktop program koji radi lokalno nije moguće učiniti potpuno nemogućim za reverse engineering. Namerno ne koristimo sumnjive packer/anti-debug trikove koji bi ponovo provocirali antivirus.

========================================================================
中文
========================================================================
GUARDIAN LAB — 安装 / 构建顺序

00  阅读本文件。
01  为当前 Windows 用户运行一次 01_SETUP_GUARDIAN_DEV_TRUST.cmd。
02  运行 02_BUILD_GUARDIAN_EXE.cmd。
    第一次执行 Step 02 时可能会出现 Guardian Lab 证书确认窗口。
    只有在显示 Guardian Lab Development 且构建由您主动启动时才点击 OK。
03  运行 03_VERIFY_GUARDIAN_SIGNATURE.cmd，并确认 Signature: Valid。
04  运行 04_GUARDIANLAB.exe。

应用内设置
1. 扫描局域网 — Guardian 检测当前用户所在的网络。
2. 保存目标 — 保存当前用户自己的电视/设备。
3. 选择“仅电视”或“全屋”。
4. 开启 GUARDIAN。

加粗 DNS 来自当前运行 Guardian 的电脑。不会把开发者的个人 IP/电视地址作为用户目标。现有阻止列表和 AI 记忆会被保留。

联系
应用中只显示“联系”，不会显示收件邮箱。发件人必须先接收并输入六位验证码，验证邮箱后才能发送消息。

保护
Step 02 生成的运行时包不包含 C# 源码或私有签名密钥。EXE 会优化、签名并生成 SHA-256。这样可减少简单复制和改名，但不能声称本地桌面程序绝对无法被逆向分析。

========================================================================
日本語
========================================================================
GUARDIAN LAB — インストール / ビルド手順

00  このファイルを読みます。
01  現在の Windows ユーザーで 01_SETUP_GUARDIAN_DEV_TRUST.cmd を一度実行します。
02  02_BUILD_GUARDIAN_EXE.cmd を実行します。
    初回 Step 02 では Guardian Lab 証明書の確認が表示される場合があります。
    Guardian Lab Development と表示され、自分でビルドを開始した場合だけ OK を押してください。
03  03_VERIFY_GUARDIAN_SIGNATURE.cmd を実行し、Signature: Valid を確認します。
04  04_GUARDIANLAB.exe を実行します。

アプリ内設定
1. LAN をスキャン — 現在のユーザーのネットワークを検出します。
2. 対象を保存 — そのユーザー自身の TV / デバイスを保存します。
3. テレビのみ / 家全体を選びます。
4. GUARDIAN をオンにします。

太字の DNS は Guardian を実行している PC から自動検出されます。開発者個人の IP/TV アドレスはユーザーの対象として配布されません。既存のブロックリストと AI メモリは保持されます。

お問い合わせ
アプリには「お問い合わせ」だけを表示し、受信先メールアドレスは表示しません。送信者は 6 桁コードでメールを確認してからメッセージを送れます。

保護
Step 02 の runtime パッケージには C# ソースや秘密署名鍵を含めません。EXE は最適化・署名・SHA-256 検証されます。単純なコピーや改名を難しくしますが、ローカル実行ソフトを完全に逆解析不能にはできません。

========================================================================
TIẾNG VIỆT
========================================================================
GUARDIAN LAB — THỨ TỰ CÀI / BUILD

00  Đọc tệp này.
01  Chạy 01_SETUP_GUARDIAN_DEV_TRUST.cmd một lần cho người dùng Windows hiện tại.
02  Chạy 02_BUILD_GUARDIAN_EXE.cmd.
    Ở lần Step 02 đầu tiên có thể xuất hiện hộp xác nhận chứng chỉ Guardian Lab.
    Chỉ bấm OK nếu hiển thị Guardian Lab Development và chính bạn đã bắt đầu build.
03  Chạy 03_VERIFY_GUARDIAN_SIGNATURE.cmd và phải thấy Signature: Valid.
04  Chạy 04_GUARDIANLAB.exe.

THIẾT LẬP TRONG ỨNG DỤNG
1. QUÉT MẠNG LAN — Guardian phát hiện mạng hiện tại của người dùng NÀY.
2. LƯU MỤC TIÊU — lưu TV/thiết bị của chính người dùng NÀY.
3. Chọn CHỈ TV hoặc TOÀN NHÀ.
4. BẬT GUARDIAN.

DNS in đậm được phát hiện từ máy tính đang chạy Guardian. Không phát hành IP/TV cá nhân của nhà phát triển làm mục tiêu người dùng. Danh sách chặn và bộ nhớ AI hiện có được giữ nguyên.

LIÊN HỆ
Ứng dụng chỉ hiển thị “Liên hệ”, không hiển thị địa chỉ e-mail người nhận. Người gửi phải nhận và nhập mã sáu chữ số để xác minh e-mail trước khi gửi tin nhắn.

BẢO VỆ
Gói runtime do Step 02 tạo không chứa mã nguồn C# hoặc khóa ký riêng. EXE được tối ưu, ký và kiểm tra SHA-256. Điều này làm việc sao chép/đổi thương hiệu đơn giản khó hơn, nhưng không thể đảm bảo một ứng dụng desktop chạy cục bộ hoàn toàn không thể bị reverse engineering.


------------------------------------------------------------
v0.8.3 STARTUP FIX
------------------------------------------------------------
Fixed a Windows Forms startup crash:
  "Control does not support transparent background colors."

The numbered circular STEP controls now enable transparent-background support
before assigning a transparent background. The Ko-fi image control also uses
Guardian's dark background while preserving the PNG's own transparent artwork.

No DNS, AI, filtering, learning, target detection, contact, signing, blocklist,
or startup behavior was otherwise changed.


This build specifically fixes the step badge positions and restores Contact visibility in the bottom-left corner.

------------------------------------------------------------
v0.8.4 CONTACT / HUMAN CHECK
------------------------------------------------------------
STEP badges:
- All four badges are embedded transparent PNG images.
- Only the blue circle and white step number are visible.
- STEP 1 is to the right of SCAN LAN.
- STEP 2 is restored between the destination IP and SAVE TARGET.
- STEP 3 is beside the protection-scope field.
- STEP 4 is outside and to the left of TURN ON GUARDIAN.

CONTACT:
- Name + valid email + message.
- Local human-check: GENERATE CODE -> SHOW/HIDE -> PASTE CODE.
- Matching code turns both code fields green and enables SEND.
- Contact buttons use a light/white style for clear visibility.
- No SMTP password, Gmail password or private API key is stored in Guardian.
- SEND opens a pre-filled email draft addressed to digitalmwo@gmail.com
  with subject: GUARDIANLAB User Contact.
- The user still confirms the final Send action in their email application.


------------------------------------------------------------
v0.8.5 KO-FI CONTACT ONLY
------------------------------------------------------------
Guardian Lab no longer collects, verifies or sends user email.

The bottom-left CONTACT link and the animated Ko-fi logo both open:
  https://ko-fi.com/oliverjov

Users can leave a comment / contact through Ko-fi.

The supplied Ko-fi GIF was resized exactly 3x:
  870x280 -> 290x93

Its infinite loop was replaced by a finite loop count of 1.

No recipient Gmail address, mailto handler, SMTP password, Gmail password,
contact API or verification-mail backend is embedded in Guardian Lab.

Guardian DNS, AI, blocking, learning, per-user target detection and signing
behavior were otherwise left unchanged.


------------------------------------------------------------
v0.9.0 AD RESCUE RC1
------------------------------------------------------------
AUTO AD RESCUE + RECOVER is enabled by default.

SAFE NETWORK RESCUE
- High-confidence blocked ad endpoints are temporarily quarantined for 25 seconds.
- Protected content, explicit ALLOW rules and critical infrastructure are never Rescue-blocked.
- AD JUST APPEARED also runs an immediate manual Rescue pass.

PLAYBACK RECOVERY
- In TV ONLY mode, a short burst of blocked ad traffic can trigger a conservative Samsung/Tizen playback nudge.
- Guardian probes the local TV API on port 8001 and sends PAUSE -> PLAY only when compatible.
- Guardian never sends POWER, HOME, BACK, EXIT or input-switch commands.
- First use may require approving Guardian Lab on a compatible Samsung TV.
- Unsupported TVs keep the network Rescue behavior with no remote control.
- WHOLE HOME automatic events never remote-control the TV, preventing another device's ad traffic from nudging playback.

PRIVACY
- Rescue is local-network only. No viewing history or Rescue telemetry is sent to Guardian servers.


------------------------------------------------------------
v0.9.1 AD RESCUE COMPILE FIX
------------------------------------------------------------
This fixes the Windows C# compiler errors in GuardianRescue.cs from v0.9.0.

Fixed:
- WebSocket HTTP request CRLF escape sequences.
- HTTP 101 handshake string.
- JSON property quote matching.
- C# quote character literals.
- Samsung remote-control JSON payload escaping.

The AD Rescue design itself is unchanged:
- temporary ad-endpoint quarantine
- high-confidence automatic Rescue
- AD JUST APPEARED manual Rescue
- guarded Samsung/Tizen PAUSE -> PLAY recovery
- no POWER / HOME / BACK / EXIT commands


------------------------------------------------------------
v0.9.2 CONFIGURATION BACKUP / RESTORE
------------------------------------------------------------
Guardian's normal configuration remains automatically persistent:
  %LOCALAPPDATA%\GuardianLabV04\config.ini

Two additional safety controls are now available beside BLOCK ADVERTISER / DOMAIN:

  SAVE MY CONFIG
  LOAD MY CONFIG

SAVE MY CONFIG creates an extra manual safety copy:
  guardian_config_backup.ini
  guardian_config_backup.sha256

The backup is not overwritten by normal automatic config saves. It changes only
when the user deliberately presses SAVE MY CONFIG.

LOAD MY CONFIG verifies the backup SHA-256 before restoring it, then reapplies:
- target device (when still valid on the current LAN)
- device profile/name
- TV ONLY / WHOLE HOME
- protection mode
- AI autonomy
- AI Learn + Auto Block
- Instant Auto Block
- Auto Ad Rescue
- automatic Active Scan
- Start with Windows
- language

The current PC IP/gateway are always freshly detected instead of restoring stale
network identity from the backup.

Existing custom block lists, advertiser rules, Guardian AI memory and learned
history are not deleted or replaced by configuration restore.


------------------------------------------------------------
v0.9.3 BRANDED FINAL UI
------------------------------------------------------------
- Full Guardian Lab mascot/wordmark replaces the plain GUARDIAN LAB header text.
- Engine ON/OFF status is aligned to the upper-right.
- Network Privacy Gate | v0.9.3 | by Oliver J sits below the status area.
- Bottom Contact text is white, not underlined, and opens the Ko-fi page.
- Bottom Contact animation uses the supplied Sparkle mug GIF, resized to 58x58.
- The footer animation has a finite loop count instead of looping forever.
- STEP 4 remains present beside TURN ON GUARDIAN.
- Windows EXE keeps the Guardian head application icon.
- CHECK FOR UPDATES now points to:
    https://guardianlab.onyxaos.com/updates/latest.json
  It never silently installs updates.
- The update window includes the Guardian app icon, release information,
  optional DOWNLOAD UPDATE, and a professional SUPPORT GUARDIAN LAB button.


------------------------------------------------------------
v0.9.4 BELL / RDS / TSN STREAMING SAFETY
------------------------------------------------------------
Guardian now treats these as protected streaming/content infrastructure:

  d3-bell.com
  tsn.ca
  rds.ca

This includes endpoints such as:
  rds-samsung-prd.rds.d3-bell.com

Protected streaming domains:
- are never auto-blocked by Guardian AI
- are never placed into AD RESCUE quarantine
- remain protected even if an older learned/custom block entry exists

This intentionally prioritizes live TV playback continuity for RDS/TSN.
Known advertising/tracker providers (DoubleClick, Google ad services, AdGear,
etc.) remain blockable and are NOT broadly allowed by this compatibility fix.


------------------------------------------------------------
v0.9.5 DOMAIN LIBRARY + STORAGE GUARD
------------------------------------------------------------
- Custom ALLOW entries are suffix rules. Example: d3-bell.com allows every
  subdomain below d3-bell.com.
- Parent ALLOW rules remove redundant blocked child hosts.
- DOMAIN LIBRARY / SEARCH searches custom block/allow, protected/built-in rules,
  advertiser rules and saved Guardian AI memory.
- BLOCK CORE is guarded: protected/shared CDN roots cannot be broad-blocked.
- Confirmed learned ads promote to a safe core only after 3 sibling subdomains.
- Child block entries are removed after a core is promoted.
- SQLite retention: 50,000 events, 5,000 actions, 25,000 learned domains.
- Old oversized SQLite DBs are compacted on startup when over 64 MB.
- Stale PktMon*.etl files are cleaned only from Guardian-owned working folders.


------------------------------------------------------------
v0.9.5.1 COMPILE FIX
------------------------------------------------------------
Fixed Windows compiler error CS1061 caused by calling LINQ ToArray() directly
on HashSet<string> without importing System.Linq.

The code now converts the HashSet to List<string> first and uses List.ToArray(),
so no LINQ namespace dependency is required.

No Domain Library, suffix allow, storage guard, RDS/TSN/Bell protection,
AD Rescue, branding, configuration backup, or signing behavior was changed.
