2026.09.07.2 — security hardening

Disable ENS CCIP Read so resolver-controlled gateway URLs cannot cause backend HTTP requests. Onchain ENS forward and reverse lookups remain available; CCIP-only names fall back to a wallet address.

Operator scripts use encrypted Foundry keystores, private logs, strict address parsing and atomic JSON writes. Uncertain broadcasts are not retried automatically. See docs/OPERATOR_SCRIPTS.md before the next authorized onchain operator action. No real keys were migrated.

Guard pending commitments in the UI and treasury keeper, settle reveal/renew before new commits, replay events in chain order, and expose pending diagnostics. These guards do not fix the deployed contract: direct calls and races can bypass them; historical orphaned pending slots and reveal ordering remain limitations.

Validation: full application gate, ABI/renderer fixtures, Foundry, regression tests against local RPC/provider mocks, operator script tests and shell syntax checks. No Solidity or renderer changes, no contract deployment, no test mainnet transactions.

2026.09.07.1 — reliability and wallet errors

Read complete pinned-block face and ownership snapshots atomically, including bursts beyond the recent window. Show ownership age and allow refresh. Add a paginated mint feed and plain-language wallet and reveal errors.

Validation: 75 Bun tests, 30 Foundry tests, TypeScript, server bundle and dependency audit passed. Collection fixture output remains unchanged.

Deployed mainnet token and renderer contracts are unchanged.