Flash-Engine 0.4.1

Bug-fix release from a review of seven reported issues (#147–#153), each verified against the code and covered by a build + targeted test.

Managed-only — the native core is unchanged, so the core contract (v12) and the FXServer artifact pin (31689) stay the same. A newer SDK on the 0.4.0 payload is fine. To get the runtime fixes, install flash-payload-0.4.1.zip (the host bundles the updated Flash.Sdk.dll); the native citizen-scripting-flash.dll is byte-identical to 0.4.0.

Security / reliability

• #147 Disconnect cleanup checked the wrong source prefix (net: vs the core's internal-net:) → it never ran on a real drop, and a client-forged net: drop could reset its own rate-limiter (flood-evasion). Now gated on internal-net: + parses the NetID after the last colon.
• #148 State.OnChange dispatch is thread-safe (lock + snapshot; the change trampoline can fire off-thread).
• #152 StateBag.Get guards the msgpack decode — a malformed client-replicated bag can no longer crash the reading resource.

Memory / lifecycle

• #149 Async.Delay(ms, token) disposes its CancellationTokenRegistration — a long-lived DropToken no longer roots the task/state machine.
• #150 Resource unload completes pending delay timers, so their state machines release instead of pinning the collectible ALC on hot-reload.

DX

• #151 The command router binds nullable primitive parameters (int?/bool?/…).
• #153 Args.To<T> coerces nullable primitives (Args.To<int?>(5L) → 5; a null input maps to null).

Full details in the CHANGELOG.