Version 4.6.5

[4.6.5] — 2026-06-10

Fixed

• Self-update stuck on 4.6.2–4.6.4 (readonly / unset CIPI_*) — lib/api.sh assigned CIPI_API_ROOT / CIPI_API_CONFIG as readonly without guards, so sourcing api.sh inside migrations could abort the loop; guards now match common.sh. self-update exported CIPI_LIB=… after the main binary had already marked CIPI_LIB / CIPI_CONFIG / CIPI_LOG readonly (CIPI_LIB: readonly variable at line 64) — it now uses export CIPI_LIB CIPI_CONFIG CIPI_LOG (by name) plus CIPI_API_ROOT default. cipi-cron-notify, cipi-auth-notify, and cipi-app-notify use the same guard pattern. Migration 4.6.5 idempotently repairs hybrid lib/*.sh on disk (skips plain CIPI_*= heredoc lines in app.sh; pure bash, mawk-safe).