v0.10.0-rc.6

Native signing status: Windows: unsigned transition artifact. SmartScreen publisher identity is not established. macOS: unsigned transition artifact. Developer ID and notarization are not established. Checksums and GitHub build provenance remain required. Do not bypass SmartScreen or Gatekeeper.

Fixed

• quotabot logout now stays disconnected for Claude, Codex, Grok, and
  Antigravity even when their host applications remain signed in. A safe
  provider-wide marker blocks host and quotabot credentials for every account
  without changing host state, and only a successful explicit quotabot login
  clears it. Any exact marker-path entry fails closed, and marker mutation
  never follows a link.
• First-run readiness now keeps the best account for each provider and never
  calls stale, drifted, suspect, or expired quota live. The source installers
  apply the same conservative readiness rule, and macOS/Linux setup once again
  receives and renders the CLI snapshot it was meant to summarize.
• MCP Streamable HTTP startup now rejects repeated or conflicting bearer-token
  sources instead of silently choosing one by argument precedence.
• Reset countdowns below one hour now use useful minute labels instead of 0h.
• Explicit CLI-only source setup no longer downloads or installs the desktop
  app, or opens an interactive dashboard. Automatic desktop-toolchain failures
  can still use the verified portable desktop fallback during a normal full
  setup.
• MCP provider and account selectors now use one bounded exact-identity
  validator across quota, routing, model, availability, and reservation tools.
  Blank, control-bearing, and oversized identities fail before quota
  collection, cache reads, or lease access instead of silently widening or
  truncating a request.
• Lease idempotency keys now require an exact 8 to 120 character ASCII key at
  every MCP, local HTTP, in-memory, and file-backed boundary. Distinct long
  keys can no longer alias after truncation.
• Cache-only decide_now responses now derive snapshot timestamps and ages
  from the providers remaining after profile, account, and exclusion filters,
  so their provenance describes the actual routing evidence.
• Named desktop profiles now retain their exact current provider and account
  selections when every known option is selected, hidden accounts can be
  restored after a sibling account leaves, and ambiguous multi-account
  analytics no longer reuse legacy provider-only history.
• Portable desktop fallback installs now consume the selected release on every
  run and use the same rollback-protected activation as source-built payloads,
  so exact updates and rollbacks cannot silently reopen an older app.
• Windows, macOS, and Linux uninstall now stop only processes launched from
  quotabot install roots, remove guarded CLI and desktop generation stores,
  preserve config unless purge is requested, and fail visibly if payloads
  remain. The Windows install smoke also rejects any nonzero doctor exit
  before parsing its JSON.
• CLI value options and singleton local HTTP /suggest query parameters now
  reject repeated values before quota collection. HTTP snake-case and
  kebab-case aliases are treated as the same option, so conflicting aliases
  cannot silently select the last value. Repeatable exclude and
  cost_penalty collections retain all distinct values, while duplicate cost
  keys are rejected after provider normalization.
• A valid manual quota with the exact same provider and specific account as one
  built-in subscription is now retained as explicit supplemental provenance on
  the built-in row instead of creating a competing route, analytics identity,
  or desktop card. Measured windows, status, availability, routing, and
  analytics remain authoritative; ambiguous, local-runtime, placeholder, and
  non-exact identities stay separate for verification and account selection.
• Desktop reset reminders now arrive 15 minutes before reset, reconcile stale
  or privacy-obsolete owned requests without touching unrelated notifications,
  serialize disablement with in-flight scheduling, and use a bounded durable
  ledger to prevent the same reset from being delivered twice.
• "Skip for now" in first-run setup now defers the walkthrough only for the
  current process instead of permanently marking setup complete.

Documentation

• Ordered the remaining 0.10.x work so field-discovered correctness,
  quality-of-life refinement, and native validation finish before platform
  signing activation, and added the complete Windows and macOS publisher
  enrollment and rehearsal checklist without changing the project's Apache 2.0
  license.
• Aligned the README, roadmap, documentation index, setup, usage, architecture,
  data-source, provider cross-check, schema, product-strategy, and desktop
  distribution guidance with the rc.6 behavior and release order.