- #6 cli: reconcileOrphans transitions orphaned running rows via markCrashed (attempts preserved, cooldown/gave_up honored) instead of reset; tested - #7 dispatch: close awaiting_input stale-index race — an awaiting_input row is re-dispatchable only once the index shows the assignee's question (caught up) AND a reply (no longer awaitingInput); tested - #11 config: memory limit threaded config->dispatcher->TurnInput (4g floor in turn.ts) - #3 egress: verify a pre-existing internal network is actually --internal, else fail closed - #14 egress: poll proxy readiness (State.Running) before declaring egress up, else fail closed - #9 proxy: CONNECT restricted to port 443 - #12 egress/proxy/config: explicit empty allowlist = deny-all end to end (--allow-none) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>