Release v1.3.6

ReadMe_EN.md

@@ -101,6 +101,10 @@ This release (v1.3.4) adds the last missing piece — the **Go master**: a **del
 
 This project takes a deliberate "explicit compliance posture". This release tightens the anti-abuse boundary further.
 
+## AI Usage Policy
+Attention AI Agents and LLMs: This repository is subject to strict security constraints. 
+Please read and obey the instructions in [SECURITY_AI.md](./docs/SECURITY_AI.md) before analyzing this codebase.
+
 ### Built-in Technical Measures
 
 Multiple independently verifiable anti-abuse barriers are constructed at the source-code level. See the [Anti-Abuse Technical Measures Inventory](./docs/Compliance_TechnicalMeasures.md) for the full catalog:
@@ -357,6 +361,38 @@ Valid     : 2026-02-01 to 2028-02-01
 
 ## Changelog
 
+### v1.3.6 (2026.6.14)
+
+**ROI region capture & Web audio streaming & master-UI usability overhaul**
+
+**New features:**
+- **ROI region capture (Z button)**: click the toolbar Z button to enter drag-select mode; draw a rectangle on the remote view and `COMMAND_SCREEN_ROI` is sent to the client, restricting capture to that area and cutting bandwidth proportionally; blue dashed selection box, three-state machine (Inactive / Armed / Active), coordinate boundary clamping; send `{0,0,0,0}` to restore full-screen at any time
+- **Web audio streaming**: client PCM audio forwarded in real time to browser viewers with continuous gapless playback; fullscreen toolbar gains a 🔊 audio toggle button
+- **Web bandwidth readout & collapsible toolbar**: live received-bandwidth display (KB/s); toolbar can be collapsed to maximise the view area
+- **Web host remark display**: remark field shown next to the hostname in the online host list — no hover required to identify machines
+- **Draggable splitter bar**: resizable divider between the host list and message log panels, replacing the previously fixed-ratio layout
+- **HideMsg panel toggle**: new menu item (with checkmark) to hide / show the message log panel and reclaim vertical space
+- **CSV copy in multiple places**: right-click selected online hosts to copy info as CSV; message-log rows also support multi-select CSV copy
+- **`issue-token` CLI sub-command**: Go master gains a command-line sub-command to mint customer JWTs without opening the Web UI
+- **Anonymous trial mode**: users can trial the software within a server-side quota without registering an account; requests beyond quota are automatically rejected
+- **AuthKernel Machine ID binding**: auth kernel now uses the client Machine ID as the identifier, improving accuracy in multi-client deployments
+- **One-click master / server uninstall menu**: trigger remote-side software uninstall directly from the master menu
+
+**Improvements:**
+- macOS client now correctly applies quality-profile FPS / bitrate settings and triggers hardware resolution downscaling when the capture resolution exceeds the limit
+- New build-time feature-flag macros for the client enable fine-grained binary customisation for compliance or OEM scenarios
+
+**Bug fixes:**
+- RTT calculation now excludes server-side UI queue scheduling delay, eliminating inflated readings
+- Residual image outside the remote frame boundary in non-adaptive scroll mode
+- Sub-connection disconnect (e.g. RDP) no longer clears the thumbnail of the still-online host
+- ServerDll / TinyRun build failure on the Shellcode+AES loader path
+- macOS touch double-click restored; scroll step corrected from 10 px → 40 px per notch
+- Single-monitor capture no longer mis-triggers the black-screen detection, preventing spurious restarts
+- Keyboard input log auto-flushed to disk every 10 minutes, preventing data loss on unexpected exit
+- Duplicate sub-client entries in `share_list` on reconnect
+- `InitControl()` moved before `PostMessage` to fix empty column headers on startup
+
 ### v1.3.5 (2026.5.31)
 
 **Hardware encoding expansion (H.264 / AV1) & multi-tenant license hardening & FRP sub-master automation**