v2.1.13

Fixed

• Redirect recovery actions appear only after four seconds on the same page. Starting a new fill stops pending navigation before unlocking, preserves hidden-field layout and restores focus.
• Unidentified renderer modules fall back to the document directory with an explicit warning instead of borrowing another script's origin. data-bbf-base accepts a missing trailing slash.
• Audit diagnostics check regular-file shape, write permission bits and the PHP guard before CLI/web ownership comparison, flag root-owned logs and accept symlinked deployment ancestors without accepting linked audit targets.
• CLI diagnostics clean fixtures on SIGTERM/SIGINT where pcntl is available, scan matching fixture names independently of form-directory count, report unreclaimable stale fixtures, and explain redirect/SPA fallback probe failures.
• Nested email sections render in one token pass without evaluating respondent text. Confirmation and notification subjects support authoritative system variables. Interior phone BOM is rejected consistently by client and server.
• Upgrade children preserve literal ${...} INI values. Suggested apply/rollback commands quote POSIX arguments and use a dependency-free encoded PowerShell launcher on Windows to preserve percent/dollar paths and native argument quoting.
• Already-published tags are checked before build attestation and release mutation.