- start.sh now restores .env to owner-only permissions (0600) on every start. Previously a fresh write could leave the file readable by other local users until the next manual fix.
- Docs and source no longer describe the app as read-only with one write path: module docstrings, UI strings and section headers now match the real write surface.