Secure ENV 0.8.5 — controlled code-cell compatibility

Changes

• Support the single exact synchronous value-attribute reflection produced by controlled explicit ASCII-digit code cells, including indexed/ordered cells without legacy group names or maxlength.
• Preserve service-frame and canary guards in the same isolated document while allowing them to recognize only the original writing guard's authenticated reflection receipt. Receipts remain inside retained browser guards and are consumed once per original element.
• Keep original node, form, origin, selector, history, frame-owner, census, profile and transport checks. Other-field changes, multiple/reverted mutations, replay and iframe replacement remain refused. No site-specific allowlist or blanket DOM-mutation bypass.

Verification

• 20 focused portable Chromium checks passed in two bounded runs, including the registered protected HTTPS path and direct frame-authority refusal scenarios.
• The captured public GigaID component was exercised through discovery and fill, including the service-iframe topology that reproduced the second failure.
• The final wheel passed discovery and HTTPS/configured-operation smoke checks outside the source checkout.
• Independent security/compatibility delta reviews passed.

Limits

A successful live GigaID login after the final fix has NOT been confirmed: subsequent fresh-code requests returned HTTP 403 before a new code form opened. Synthetic/component checks do not establish successful site authentication. The broader legacy input-reconciliation suite hit file timeouts; a focused legacy positive case passed. This is not a claim that the full test suite passed.

Assets

The wheel, complete Git source archive and SHA256SUMS are attached. Source commit: 4d30f5a904566e929bd30bd31b68a3244a8cb676. Existing profiles, credentials and settings do not require migration.