v0.10.0

• Ask for confirmation when every provider's send quote fails, instead of printing 'skipping confirmation' and returning true — an outage is not consent, so the payment now asks anyway and says the fee is unknown
• Round a reservation's USD value up rather than to the nearest cent, closing the split-payment bypass where a 0.4999-cent send rounded to zero and never touched the global cap however many times it was repeated
• Require every allowlist category to be decided under --public-listen — listed, or ["*"] to say out loud that it is open — instead of accepting one non-empty category and starting a public daemon whose other endpoints were unrestricted under a fail-closed banner
• Replace POST /v1/afpay's opaque Input union with a resource model carrying a discovery face, AFDATA envelopes, redaction at the boundary and idempotency where money moves, with no route at all for anything marked local-only so a leaked bearer cannot raise its own spending limit
• Ship an OpenAPI document and a JSON schema for every request and result
• Drop gRPC and the encrypted RPC mode by making the federation client an HTTP client against those same routes, removing protoc as a build-time toolchain, eight direct dependencies and a hand-rolled AES-GCM layer keyed from a static secret; the README now says how to put WireGuard, an SSH tunnel or a TLS proxy in front
• Let each panel choose how it reaches a person: the two watch panels offer window, link and session, while ui send withholds link because that URL is a bearer capability for moving money — answering from another device goes through session plus afui session serve
• Reveal the link URL by name on the one event whose job is handing it over, with the rest of the event still redacted, and assert in a test that a link panel returns an http:// URL a person could paste
• Register templates under the logical name an override author writes, keeping the file path separately, so a frontend extending layout.html.j2 resolves again instead of failing with template not found
• Remove the unread TuiApp.frontend field, which had been failing this spore's own static gate under -D warnings and hiding six failing frontend tests
• Take the reserved icon route from AFUI now that the page goes through UiPage, removing the last template literal in production code
• Say in the skill that a limit holds the planned amount plus an estimated fee rather than the final charge, so the contract stops promising what the code does not do
• Give this spore its own CI workflow, run the pinned ShellCheck there, and verify the release job builds the tag it was asked for
• Upgrade Agent-First Data to 0.34.0 and Agent-First UI to 0.5.0