v1.1.1

No contract changes.

Fixed

• Signed Claude thinking after the engine's own edits (SPEC §9.3). Claude Fable 5.1,
  Opus 5.5, Sonnet 5.5 and Haiku 5.5 bind each thinking block to the exact prefix before it;
  on accounts created on or after 2026-08-31 a replayed block after a change is a 400.
  Trimming (§5.1) and a user message without created_at that lost its current-time line
  (§9.4) are such changes. On those steps the engine now sends
  block_binding: { prefix_mismatch_behavior: "drop_block" }: the provider drops the stale
  blocks and the run goes on. Drops are journaled as thinking_blocks_dropped.
• Claude context window: 1M. The built-in profile assumed 200k for every claude-*, so
  the engine trimmed Claude histories five times too early. Now 1M, 200k only for Claude 3,
  Opus / Sonnet 4.0, Opus 4.1 and the 4.5 models.

Security

• Dependencies with known advisories updated: hono 4.13, @hono/node-server 1.19.17,
  undici 7.30.1, fast-uri 3.1.9 (transitive). npm audit reports none.
• Zod 4. Zod 3 accumulates an issue for every failing array element without a cap
  (GHSA-mrhx-c7xc-m3w5), so a large invalid body could exhaust memory before the request
  is refused. Error codes and paths in 400 bad_request are unchanged; the human-readable
  part of the message now comes from Zod 4 (Invalid input: expected string, received number instead of Expected string, received number).