Production promotion — prod-20260824-080310

What's Changed

• chore: sync main's promotion merge commit back into dev (#1784) by @d-hinders in #1785
• fix(backend): converge revocation_status when a revoke mines after its wait expires (#1758) by @AntonioSaaranen in #1786
• fix(release): stop the bump sign-off instructing a manual npm publish (#1788) by @d-hinders in #1794
• docs(release): make the manual-publish fallback cover all five packages, and guard it (#1791) by @d-hinders in #1796
• fix(frontend): one focus-ring treatment that clears WCAG 3:1 (#1741, #1746) by @AntonioSaaranen in #1798
• test(frontend): measure horizontal overflow inside fixed-position overlays (#1773) by @AntonioSaaranen in #1799
• docs: qa-freshness proves coverage, not recency — and hotfix is not a bypass (#1787) by @d-hinders in #1802
• feat(backend): re-key an agent — revoke-before-issue, meter carry, credential rotation (#1698) by @AntonioSaaranen in #1762
• fix(frontend): make TopBar's reserved hamburger slot survive a phone (#1767) by @AntonioSaaranen in #1804
• docs(operations): stuck-revoke alarm runbook (#1793) by @AntonioSaaranen in #1806
• fix(backend): derive the ops-probe subprocess budget and make its timeout legible by @AntonioSaaranen in #1808
• docs(release): one truth for the published set, and a shard name you can write before the PR exists (#1795) (#1789) by @AntonioSaaranen in #1807
• feat(connect): remove the runtime picker — one setup command for every environment (#1720) by @d-hinders in #1812
• feat(release): the bump writes the manifest re-pin it already verifies (#1790) by @AntonioSaaranen in #1810
• fix(frontend): a per-worktree capture port, and a server that has to prove it is ours (#1800) by @AntonioSaaranen in #1822
• refactor(frontend): delete three unreachable connect surfaces and their private libs (#1813) by @d-hinders in #1823
• fix(frontend): destructive icon buttons focus in their own tone (#1792) by @AntonioSaaranen in #1821
• fix(frontend): give the visual gate a budget it cannot outgrow, and baselines it can actually refresh (#1805, #1760) by @AntonioSaaranen in #1811
• docs(casp): cover release plumbing — #1736's deferral analysed the wrong event (#1739) by @AntonioSaaranen in #1825
• docs(casp): cover the agent-authority surface — the CLI relays, routes/agents.ts decides (#1826) by @AntonioSaaranen in #1828
• fix(frontend): destructive controls focus in their own tone, solid fills included (#1817, #1809) by @AntonioSaaranen in #1829
• fix(frontend): destructive controls get a focus indicator at all (#1819) by @AntonioSaaranen in #1831
• fix(frontend): make TopBar's background actually compile, and guard the pattern rather than the instance (#1818) by @AntonioSaaranen in #1836
• docs: release PRs target dev, not main (#1815) by @AntonioSaaranen in #1838
• fix(docs): drop the coupling gate's same-day suppression (#1824) by @AntonioSaaranen in #1839
• fix(frontend): convert the 91 dead border-*/N classes to channel-backed aliases (#1709) by @d-hinders in #1834
• fix(frontend): give the e2e run a per-worktree port and a server it can identify (#1816) by @AntonioSaaranen in #1832
• docs: name scratchpad files for the task, not the file (#1801) by @AntonioSaaranen in #1842
• test(frontend): run the dialog overflow guard at a mobile viewport (#1797) by @AntonioSaaranen in #1841
• docs(security): record the re-key budget-meter carry as an invariant (#1702 carve-out) by @AntonioSaaranen in #1848
• feat(docs): fail a PR that drops an entry from a doc's last-verified chain (#1843) by @AntonioSaaranen in #1851
• fix(frontend): sweep the last 9 dead colour utilities and make the gate absolute (#1710) by @d-hinders in #1845
• fix(frontend): stop defaulting an unresolved chain to Base mainnet in Add funds (#1844) by @AntonioSaaranen in #1853
• fix(frontend): stop ReceiveFundsModal throwing on an unresolved chain, and hedge the network it names (#1852) by @AntonioSaaranen in #1855
• fix(frontend): stop the mobile transaction row stranding its arrow and collapsing its title (#1774, #1750) by @AntonioSaaranen in #1835
• fix(frontend): ConfiguredAllowanceRow renders no meter — it has nothing to measure (#1846) by @AntonioSaaranen in #1859
• docs(design-system): replace § 5's false arrow claim with a one-file allowlist and a runnable check (#1840) by @AntonioSaaranen in #1862
• test(frontend): scope-capture the app shell sidebar in the visual gate (#1820) by @AntonioSaaranen in #1861
• test(frontend): capture SendModal's review step — the last unphotographed TransactionMovement consumer (#1856) by @AntonioSaaranen in #1864
• fix(frontend): scope the compact row's fixed height to the breakpoint it was measured for (#1833) by @d-hinders in #1860
• fix(frontend): convert the ten gated raw arrows to lucide icons (#1857) by @AntonioSaaranen in #1865
• docs(design-system): document the tertiary Button variant, and replace two false claims and an unchecked catalog with published checks (#1830) by @AntonioSaaranen in #1866
• fix(docs-gate): stop the e2e carve-out protecting generated visual baselines (#1854) by @AntonioSaaranen in #1871
• fix(ci): make the baseline-push deadlock visible on the PR, and name the runs to approve (#1777) by @AntonioSaaranen in #1872
• test(frontend): drive keyboard focus onto #1831's eleven indicators and capture them (#1863) by @AntonioSaaranen in #1875
• feat(frontend): the dashboard can replace an agent's signing key (#1701) by @AntonioSaaranen in #1881
• docs: tell the truth about same-day suppression, and restore frontend.md's lost #1447 (#1869, #1876) by @AntonioSaaranen in #1883
• docs: triage and repair seven unrestored last-verified chain breaks (#1882) by @AntonioSaaranen in #1884
• fix(frontend): shoot()'s clip guard measures the deepest scroller in the subtree, not the target it was handed (#1879) by @AntonioSaaranen in #1889
• fix(backend): the re-key revoke tells the account which signer will sign (#1870) by @AntonioSaaranen in #1891
• fix(frontend): the re-key point-of-no-return button moves below its own gate (#1887) by @AntonioSaaranen in #1894
• test(frontend): a durable, mutation-proven CI gate for the clip guard (#1886) by @AntonioSaaranen in #1895
• fix(ci): the money-path perimeter learns about re-key, and its copies agree in both directions (#1892) by @AntonioSaaranen in #1900
• fix(frontend): the re-key sends its signing scheme, and the type stops lying (#1890) by @AntonioSaaranen in #1902
• fix(docs): chain-sweep classifies a declared reset instead of reporting it forever (#1885) by @AntonioSaaranen in #1901
• fix(ci): retire the dead machine-payments glob and pin the fourth copy of the money-path list (#1897, #1899) by @AntonioSaaranen in #1906
• feat(passport): re-anchor on re-key, with standing unbroken (#1699) by @d-hinders in #1907
• test(frontend): render the four AgentCard states the fixture never served — #1831's eleven focus indicators, all eleven (#1873) by @AntonioSaaranen in #1908
• feat(connect): --rekey replaces an agent's signing key in place (#1700) by @d-hinders in #1912
• chore(ci): close the general fifth-copy detector with a measurement, not a threshold (#1904) by @AntonioSaaranen in #1913
• docs: agent key rotation, and the line between it and account recovery (#1702) by @d-hinders in #1914
• fix(agents): AgentCard action-row focus-ring clearance, and stop 'Restore to list' wrapping on Linux (#1909) by @AntonioSaaranen in #1918
• ci: name the ci_config_checks glob step for what it runs (#1874) by @AntonioSaaranen in #1919
• docs(security): cover the re-key client in delegation-rail-security-model.md (#1898) by @AntonioSaaranen in #1917
• fix(connect): --repair writes the named MCP pair; --doctor reports a parked re-key (#1910, #1911) by @AntonioSaaranen in #1920
• fix(rekey): plan the budget carry on the metering clock, not the issue clock (#1849) by @d-hinders in #1921
• fix(frontend): keep the previous screenshot run addressable instead of rm -rf'ing it (#1888) by @AntonioSaaranen in #1922
• fix(design-system): resolve § 5's false icon-size claim — add 12/24/28 to the scale, convert the 11 outliers, and gate it (#1858) by @AntonioSaaranen in #1925
• docs(security): cover the signer-management and owner-send clients in delegation-rail-security-model.md (#1916) by @AntonioSaaranen in #1928
• fix(connect): --doctor sees a directory holding only rekey-pending.json (#1915) by @AntonioSaaranen in #1929
• feat(agents): report and show which MCP pair an agent is wired as (#1878) by @d-hinders in #1926
• docs(security): cover lib/delegationPasskeySigner.ts in delegation-rail-security-model.md (#1927) by @AntonioSaaranen in #1932
• test(frontend): render AgentPanel empty states and AgentCard warning banners (#1924) by @AntonioSaaranen in #1931
• fix(design-system): converge the two remove-budget controls on the 14 px icon rung (#1923) by @AntonioSaaranen in #1934
• fix(frontend): absorb the White-on-brand CTA pattern into a primitive and guard its focus ring (#1867) by @AntonioSaaranen in #1938
• test(frontend): capture the Backup & recovery card's one-way and loadError states (#1725) by @AntonioSaaranen in #1941
• fix(frontend): drop the wallet label below sm so TopBar fits a 320px phone (#1803) by @AntonioSaaranen in #1942
• feat(frontend): catalogue ApprovalRequiredBanner's full tone ladder on /design-system (#1880) by @AntonioSaaranen in #1948
• fix(frontend): give ui/Modal's scrolling body a continuation cue (#1893) by @AntonioSaaranen in #1949
• refactor(frontend): one device-marker passkey selector, shared by both signing paths (#1933) by @AntonioSaaranen in #1951
• fix(frontend): restore the four dead --v2-shadow-* elevation tokens (#1945) by @AntonioSaaranen in #1950
• fix(screenshot): say why a capture produced nothing (#1936, #1939, #1943) by @AntonioSaaranen in #1953
• fix(frontend): hide the decorative marketing CTA arrows from the accessibility tree (#1940) by @AntonioSaaranen in #1957
• feat(catalog): domain-ownership proof — HMAC-bound expiring token + shared SSRF guard (#1712) by @AntonioSaaranen in #1958
• fix(frontend): move the contacts dialog's actions into ui/Modal's footer (#1946) by @AntonioSaaranen in #1960
• chore(release): bump all published packages to 0.1.30-alpha.0 by @d-hinders in #1962
• Fix re-key authority copy before production promotion by @d-hinders in #1964
• chore(release): promote dev to production (0.1.30-alpha.0) by @d-hinders in #1963

Full Changelog: prod-20260822-083432...prod-20260824-080310