v0.28.0

Fixed

• Network resilience — a flaky/black-holed RPC or dead model stream can no longer
  freeze the platform. On wasm, reqwest wraps fetch (no timeout; reqwest:: timeout is a no-op), so a TCP-connected-but-silent RPC yielded a future that
  never resolved — freezing pills/lists/faces, or hanging a turn past the
  cooperative stop check. Three layers: (1) src/app/net::with_timeout guards 6
  paint sites; (2) registry::rpc_value/eth_call_batch now have a 20s transport
  timeout (cfg-gated: native reqwest.timeout, wasm select-against-sleep_ms
  that drops the hung fetch) — covers the CLI + every consumer; (3) the Gemini +
  Anthropic stream loops have a 120s IDLE timeout (src/backends/stream_timeout,
  re-armed per chunk so a steady stream is never cut) that errors a stalled turn
  instead of hanging. Verified: E2E 14/14 with streaming intact.

Added

• Browser scheduling UI — a "schedule a job" panel (target/task/interval/budget/
  runs) + a jobs list with cancel, in the Usage/Account tabs. Scheduling was
  CLI-only; now a browser user can set up a tab-free recurring job, close the tab,
  and it runs (parallel to the invite UI).

Security

• gemini.ts credit-proxy hardening (the main $LH-metered path). Fixed a
  pre-auth chunked-body DoS (a Content-Length-less request bypassed the size
  guard, and the Anthropic path buffers the body before auth — an unauthenticated
  attacker could stream a multi-GB body into Edge memory; now stream-capped → 413)
  and caller-controlled query forwarding onto the platform-key Google URL (now
  allowlisted to alt=sse). Added a MAX_COST_PER_REQUEST_WEI per-call debit
  ceiling (the stateless bill-shock cap) + explicit address/timestamp guards. The
  gate/debit/auth/routing were audited + confirmed safe (fail-closed).

Changed

• Experience + quality pass (fresh-eyes audits across the conversion path).
  • Onboarding: skill.md/llms.txt/README now lead with the "you need $LH
    first" prerequisite (a fresh identity 402s on its first call — the top
    newcomer trap), killed the stale "free session" claim everywhere, and bumped
    the README version + key path (~/.localharness/keys/).
  • Apex landing: a value-prop hero for fresh visitors (was a bare name
    input on the highest-traffic page).
  • CLI failure UX: raw tx reverted: 0x… now decodes to actionable hints
    (the real ScheduleFacet/InviteFacet custom errors); fixed a //! leaking
    into help, the stale credits/topup messages.
  • Agent self-knowledge: described the registered clear_context/
    compact_context tools (the model was blind to them) + refreshed the
    RUNTIME_SUMMARY digest (actor model, discover+x402, scheduling,
    per-request metering); updated claude's stale on-chain persona.
  • Accessibility: aria-labels on ~13 inputs, keyboard-focusable +
    Enter/Space-activatable OPFS rows/breadcrumbs, aria-live on the blocking
    fund/api-key flows.