v0.98.15

Fixed

• Numeric input coercion now uses the shared safe_int/safe_float helpers across hub config,
  channel history limits, mailbox cursors, claim TTLs, resource/capability bounds, semantic and
  memory query limits, dead-letter snapshots, and dashboard write-rate windows. Non-finite,
  overflowing, and malformed values now preserve the existing fallback or clamp semantics at each
  call site instead of escaping through local ad-hoc conversions.
• Delivery receipt requests, immediate verdicts, deferred mailbox-ack verdicts, and pending-window
  expiries are now journaled as audit-only receipt events. Unsettled immediate failures re-seed the
  pending receipt map on hub restart, and synapse event-query <db> "receipts <agent>" exposes the
  durable ledger even when the original sender is offline.
• synapse federation fetch now accepts --pin sha256:<hex> for wss:// peers that use
  private-CA or self-signed certificates. The fetch uses an unverified TLS context only in explicit
  pin mode, hashes the live peer certificate immediately after the handshake, and fails closed on a
  missing TLS certificate or pin mismatch.
• Multi-hub network pulls now negotiate the peer hub's advertised wire version from the welcome
  frame. Version-skewed peers are accepted, logged as operator-visible warnings, and recorded on
  MultiHubFollower at the lowest common effective wire version instead of being silently ignored.
• synapse dashboard --feeds-db now serves /operator-actions.json, a durable operator-action
  history feed reconstructed from operator_relay audit events with real sequence and timestamp
  anchors, relay direction, status, reason, break-glass tag, and peer/requester provenance.
• Forwarded multi-hub claims now distinguish owner timeouts from generic ownership refusals,
  expose forwarded/granted/denied/timeout counters on /metrics, and treat duplicate owner-side
  (task_id, claimant) retries as idempotent relays of the existing lease.
• synapse doctor now has opt-in federation checks for named peers: reachability through the
  multi-hub log request path, cursor lag via log_end_seq, measured welcome-frame clock skew, TLS
  certificate expiry warnings, and imported bundle expiry/revocation state from a federation store.