July 2026 — v1.2.1

Patch release capturing the four hotfixes that landed on main after the v1.2.0 tag on Jul 8. Three of them shipped to production as direct pushes with no pull request, so GitHub's generated notes cannot see them — they are written out in full here.

🐛 Fixes — Client PWA

• Recovery screen when the app can't start — a localized (en/es/pt) boot fallback with a Reload button now renders if the app shell fails to come up, instead of a blank page. (5f4cc5e07)
• Passkey sign-in enabled by default in production — isPasskeyServerEnabled no longer depends on an exact "true" string being configured; it defaults to on in production builds and still honours an explicit false. (5f4cc5e07)
• Installed app tabs preserved on service-worker activation — an update no longer disturbs the tabs you already have open. (6de6e7aa5)
• Post-deploy recovery hardened — the Vercel SPA rewrite now excludes /assets/, so a chunk deleted by a new deploy returns a real 404 instead of index.html; route-level chunk-load failures auto-reload once instead of surfacing React Router's "Unexpected Application Error". (5147edc78)

📚 Documentation

• fix(claude): rename agent:* to ai:* in the routine specs main serves by @Oba-One in #667

🧰 Maintenance & CI

• All GitHub Actions pinned to full-length commit SHAs, as the org policy requires. This had been failing every workflow on main since Jul 28 — including Build Docs (which skipped Deploy Docs, leaving the docs site stale) and the Release workflow itself.
• The supply-chain guardrails audit is now inlined rather than calling the org reusable workflow, which is still internally unpinned and so was refused under the same policy.
• Version unified at 1.2.1 across all 7 packages; the SECURITY.md supported-release line corrected from v1.0.0.
• Release July 2026 — v1.2.1 by @Oba-One in #677

Full Changelog: v1.2.0...v1.2.1