2026.09.07.2 — security hardening

Disable ENS CCIP Read so resolver-controlled gateway URLs cannot cause backend HTTP requests. Onchain ENS forward and reverse lookups remain available; CCIP-only names fall back to a wallet address.

Operator scripts use encrypted Foundry keystores, private logs, strict address parsing and atomic JSON writes. Uncertain broadcasts are not retried automatically. See docs/OPERATOR_SCRIPTS.md before the next authorized onchain operator action. No real keys were migrated.

Cache proven missing coins and share a bounded manual RPC refresh budget across coins and holdings. Requests with a newer receipt block receive 503 when absence is not yet proven, rather than a false 404.

Validation: full application gate, ABI/renderer fixtures, Foundry, regression tests against local RPC/provider mocks, operator script tests and shell syntax checks. No Solidity or renderer changes, no contract deployment, no test mainnet transactions.

2026.09.07.1 — safe wallet recovery and complete coin data

Read every newly minted coin and commit pinned-block RPC snapshots atomically. Display ownership freshness, refresh after confirmed actions, resolve series-aware links and cache metadata without changing rendered bytes. Wallet failures explain recovery; wrong-network resume and uncertain sends preserve pending state without automatic duplicate minting. Keep the announcement cursor stable after burns. Fix mobile horizontal overflow, including mainnet addresses on the how-it-works page.

Validation: 81 Bun tests, 117 Foundry tests, TypeScript, server bundle and dependency audit passed. Collection fixture output remains unchanged.

Deployed mainnet token and renderer contracts are unchanged. Immutable metadata links, on-chain rendering cost and VRF callback-order dependence remain documented constraints; see Mainnet limitations.