NetExperts Support and Advanced Support 1.5.2 — 26 October 2026

Changed runtime paths:
- res/msi/CustomActions/CustomActions.cpp and StaffAccess.wxs: missing/unreadable
  prior state defaults Yes. A readable explicit No remains No. MSI choice is
  saved through the existing elevated service/user actions.
- libs/hbb_common/src/config.rs and flutter/lib/common.dart: staff access uses
  Yes unless the stored value is exactly N. UI No writes an explicit N.
- Linux staff_access.rs and linux_staff_access_setup.dart: unreadable setup
  state uses the recommended Yes choice; saved No remains available.
- src/client.rs: direct secure handshakes have a five-second default deadline
  (or the user's longer relay-delay setting, within the existing handshake
  timeout). TCP/UDP/IPv6/WebRTC failures retry the coordinated relay once.
  Failed direct transport resources close first. Relay identity verification
  and encryption negotiation remain mandatory and unchanged.
- flutter/lib/desktop/pages/server_page.dart: password-only incoming sessions
  say they are waiting for a password, instead of asking for unavailable approval.
- Cargo.toml/Cargo.lock, Flutter pubspec and generated version: 1.5.2+70.

The ordinary temporary/permanent password checks and staff credential verifier
are unchanged. No master credential is embedded in this source. Existing
Linux Inbound sizing and native DEB/RPM package lifecycle behavior are retained.

Regression tests cover uncertain/explicit staff options in Rust and Flutter,
plus live loopback TCP refusal/stall followed by authenticated relay traffic.
Windows installer verification invokes each built MSI's actual custom action
with missing, locked/unreadable and explicit Yes/No configuration fixtures.
Release acceptance results are recorded separately with binary hashes.
