---
title: "Windows Update · aadhar.sh"
description: "What has shipped to this site lately, in a Windows Update reskin. Read-only."
path: "/updates"
section: "status"
kind: "page"
source: "https://aadhar.sh/updates"
---

> Site index: https://aadhar.sh/llms.txt
> This is the Markdown twin of a page on aadhar.sh. The HTML at the source
> URL below is the original, and is hand-written and unminified on purpose.

# Windows Update

**aadhar.sh is up to date.**

running build aadhar-v195-cota-wec. updates install themselves at deploy time, so you never click "restart now."

## Recently installed

- cota-wec
  
  Photo albums. The first one is Lone Star Le Mans: 93 frames from WEC at Circuit of the Americas, each downloadable as the archival JPEG and, where the camera wrote one, the 10-bit HEIF. Albums stay out of the homepage draw.
- markdown-lens
  
  The Other Web gained a tenth tab that replays the Accept header seven named agent clients actually send, and reports which representation each one got back. A conformance checklist and a reach number answer different questions: three of those clients send a header where Markdown and HTML arrive tied, so a site can pass every check on the public list and still hand them markup meant for a browser. This site was one of them, which the new tab found on its first run against its own pages, so a tie now goes to whichever type the client listed first.
- webmcp-first-party
  
  The site hands an agent its own tools now, and anything that writes stops to ask you first. Cloudflare was injecting a bridge that did the registering, and two measurements retired it. It never ran on the homepage at all, because that page is served as a compressed delta against bytes your browser already holds and the edge cannot rewrite one, so the busiest page here advertised nothing while every other page advertised 25 tools. And the browser keeps only one of the five annotations the protocol defines for a tool, so nothing could tell an agent which of these tools write data. The replacement carries that in the description an agent reads, gates a writing tool behind a dialog that names it and shows you the arguments, and logs every call to a tray in the taskbar. The Other Web also gained six tools that drive the window you are watching rather than answering privately, so an agent and a person can work one instrument.
- efuses
  
  The twelfth Learning With Errors explainer covers eFuses and anti-rollback at /lwe/fuse. Secure boot verifies that an image was signed by the vendor, and the vulnerable build from last year carries that same signature, so a stateless check has no grounds to refuse it. Rollback protection adds the missing state, and a counter blown into silicon is the one copy an attacker holding full write access to storage cannot lower. The owner pays for that too, because a version counter compares two numbers and cannot see who is asking. Two demos carry the argument: paired verifiers that disagree about exactly one of three images, and a fuse bank whose floor only climbs, with a button that offers to put the fuses back and explains why no such operation exists.
- lean-second-machine
  
  The Lean explainer now covers the other half of formal verification: the machine that never writes a proof, walks the program symbolically and hands the constraints to an SMT solver, and reads bytecode because a source-level model can drift from what actually executes. Also why the practice found its first routine home on chains, what a loop full of machine-generated invariants still cannot fix, and the FRI soundness formalization read for the gaps it published rather than the result it claims.
- nlweb
  
  The site answers natural language at /ask now, and The Other Web can read that door on any origin. NLWeb specifies a question endpoint and a schema.org answer per result; this serves it over the same corpus the search box reads, refuses by name the two modes that would need a language model rather than faking them, and grades what other origins return field by field
- csp-hashes
  
  Content-Security-Policy now names every inline script by hash
- lens-grading
  
  The Other Web grades sitemaps and levels honestly now. It used to look for a sitemap at one fixed address and trust whatever answered, so a real sitemap kept one directory over read as missing while a stray HTML page read as found. A site could also earn the top rung from a single machine door that was answering 410 Gone: four of the six it called agent-native had earned it exactly that way.
- pq-retire
  
  The now-playing list has its album art back, and The Other Web stopped timing out. Both were spending most of a request on a post-quantum signature that nothing on the internet verifies, so it is retired, and the covers now fill in on a schedule instead of racing a limit they could never beat
- dictionary-roll
  
  Repeat visits get their compression deltas back. Every release ships as a diff against the copy your browser already holds, and that set had gone stale on 2026-07-30, so a returning visitor was pulling 13.7 KB of shell where the diff is 1.3 KB. A nightly job rolls it now and opens its own pull request
- lighter-shell
  
  The XP shell got lighter: the Run palette, tray balloons and infotips bring their own styles the first time you open them rather than on every page, each section tab icon is a real file the page names in its own head instead of one a script swaps in after load, and the blank Run and Search windows are prebuilt instead of rendered per visit
- vigenere-cracker
  
  The Vigenere explainer breaks a cipher you wrote yourself: type a message and a key, hand the ciphertext alone to a solver, and watch it recover your key in four steps, or tell you honestly that your message was too short to crack
- infotips
  
  Every tooltip on the site is an XP infotip now, and the ones with something to say say it: a taskbar button names how many pages it holds, the tray reads out the colo serving you, the clock spells out the date
- lens-reader
  
  The Other Web shows what a reader-mode extractor throws away
- lens-decode
  
  The Other Web reads this site as text instead of raw brotli, and every scan parses the whole document rather than the first 8 KB
- dyno
  
  The performance trend becomes Dyno and moves into the garage, /perf redirects to it, and the lens docs stop reading a refused Browser Run call as a verdict on the engine
- perf-trend
  
  Every pull request gets a wire-size diff against its merge base, a nightly job records what the site weighs, and /perf charts the drift a threshold check cannot see
- lens-interaction
  
  Lens reads a page after the wall comes down, four more pages get unfurl cards, and the canonical site stops answering on every other hostname

No reboot, no nagging. Each item is a real deploy from the site's checkpoint log; see how delivery works in [Security Center](https://aadhar.sh/security), or roll the whole system back through every past build in [System Restore](https://aadhar.sh/restore).

Source: https://aadhar.sh/updates