Ships #585: bootstrap-token first-claim gate surfaced via init on public
exposes (#576, reuses the Render mechanism; loopback-gated disclosure),
/account connected-detection excludes first-party browser surfaces +
keeps a Connect-another-AI expander (#583), phantom default vault row
suppressed in well-known (#577), tailnet expose label fixed (#459).

Tag v0.6.4-rc.8 → npm dist-tag `rc`.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>