project credentials stay inside the project they name, across timeline, search, snapshot, transcript and pulse. a worktree migration source is checked before anything moves, checkpoint namespaces are injective, and thread ingress that is not a uuid is refused. web push rejects redirects and private dns answers, revalidates stored endpoints and bounds its requests, with BOITE_PUSH_ALLOWED_HOSTS to narrow it further (#222)
an agent closes the worker it opened. thread_close takes the id thread_spawn answered with, its own workers only, and refuses one still running or waiting on a dialog (436feb8)
a spawned agent gets its opening prompt. the briefing was queued after the launch returned, but mounting the terminal is what reads that queue, so in a project with worktrees off the agent opened bare and the caller was told the hand-off worked (52116f3)
the release page carries an android apk. mobile/ is built on every ci run, and a release that leaves it untouched reuses the previous apk rather than rebuilding it. signing needs the keystore secrets, and this release ships the unsigned apk (#221)
a relaunched fastpick thread finds its key again. --key and -p sat in the secret flag list, so a respawn replayed fastpick --key *** and died; rows already written drop the poisoned pair at relaunch (#220)
an editor pane goes with its last buffer instead of staying as a rectangle offering to pick a file, and a browser pane an agent opened closes fifteen seconds after the turn, only while off screen (#214)
kebacc is found under the name it took in its 1.0.0, its 2.x pool output is read as text rather than failing, and an account row whose numbers were never read stops passing for a pool header (#213)