- Injection-safe XML <context> prompt envelope (entity-escaped) - Remote-workspace workspace.read references + note pointing at read_workspace - New MCP tool read_workspace (read another bot's workspace under your own permission) Compat: [update] breaks <0.1.27 configs.