What shipped

VoicePricing and changelog Markdown pages now show their complete values. The pricing and changelog Markdown pages show the current voice-minute rate, billing currency and product name. The preview guide also clarifies workspace access and restoring supported Apps after widget access expires. Release records now include the verified catalog-maintenance protection deployment.

ArtifactsCatalog maintenance previously could reread a newer credential while retaining an older scanned endpoint. It now resolves only a still-current full snapshot under the connector lock and dispatches the returned bound target/credential pair. Committed owner changes fail closed before decryption/network. Generic administration, existing credential resolver/setter, per-user OAuth anonymous cataloging and ssrf/transport guards remain unchanged. No lock spans remote HTTP; credentials already issued before a later edit are not retroactively cancelled. Validated with13 actual private PostgreSQL/official PostgREST14.18 cases and47 checked Deno adapter/orchestrator/catalog/admin cases. Tests use synthetic credentials/mock targets and actual two-client locks, including the real same-only authority are preserved. The initial fixture ts2322 is retained separately; only the literal type annotation changed before the passing run. New critical ai/connector-refresh-target-2956 keeps these proofs in qualification. Normal protected release must apply project migration20261028065000 and publish matching Edge runtime/source provenance through the release captain. Safe live acceptance.

MCPDeployment provenance now records the verified Edge function releases for account-tool authorization and connector refresh, preserving the actual release history.

MCPValidated with the exact official PostgREST 14.18 native binary against a disposable Unix-socket PostgreSQL cluster. Release requires normal project migration20261028051500 and protected app closure; the captain owns any matching Edge ledger/source closure. Verify one bounded synthetic-absent-selector HTTP 409 with the exact unchanged stale message after apply. No production connector, OAuth consent, grant, credential or provider policy changes for proof. The original2947 issue remains open until actual HTTP acceptance succeeds. Existing looping request containment belongs to the captain and is recorded separately.

MCPAutomatic MCP catalog refresh now refuses a stale scan if an owner changed, disabled or deleted the connection while the probe was running. A maintenance-only conditional writer preserves the current endpoint, credentials, selected private tools and confirmation rules, and cannot recreate deleted connections. Confirmed writes retain the corrected publication-settlement behavior.

InboxConnector refresh now records successful publication after a confirmed save instead of trying to settle the old OAuth tool classification and reporting a false failure. Missing or mismatched write receipts refuse publication; real publication failures retain their pending evidence. Settlement preserves operator changes and the existing concurrency guard.

ConsolePrivate tools already selected on an OAuth-per-customer connector use the customer's own OAuth grant. Legacy identified classifications use the existing delegated resolver and consent card instead of falling through to a shared app credential. Console and MCP writes normalize the same selected keys; public tools, confirmation, scopes, resource and unassigned tools retain their policy. New writes and publication reject inconsistent OAuth-per-customer classifications. The not valid database guard leaves existing rows untouched; any subsequent update to an inconsistent legacy row must normalize its existing tool selection first. Existing provider opt-in and publication readiness remain required. No workspace provider, connector configuration, grant or OAuth consent is changed by this release.

PlatformReleases can reuse valid prebuilds after an SDK update without repeating the local build. Obsolete generated SDK dist pins retire only after the current output validates; retained public pins and all freshness and size checks remain intact.

ChatCustomer support widgets carry the server-owned conversation when opening a full window or Picture in Picture. A conversation still waiting for its runtime cannot open the wrong thread. First-party chat keeps its canonical conversation URL, and the existing server ownership checks remain in force.

InboxRecord the customer handoff Edge deployment. The deployment record now names the matching Edge runtime used by customer chat handoffs, so its source revision can be audited alongside the app release. Preview interactive views can be restored after their original source receipt expires when the current visitor, chat, scan and readonly resource still match. Restoration fetches only the resource and supplies a fresh short-lived callback proof; it never repeats the original tool. Unsafe or expired history shows an explicit unavailable view.

ChatPublic assistant turns now report a temporary configuration failure when the live model registry remains unavailable, rather than falling through to a development mock answer. Registry refresh retries once against current data and retains existing freshness and access checks.

InboxContinue verified customer chats in a full window. Identified visitors can open their conversation on the workspace’s verified chat domain, or its included subdomain. A fresh provider check and short-lived, one-use handoff preserve the verified customer and the conversation without copying a login credential into the URL. Signing out of the original session also ends its continued sessions; open private views stop on the private revocation notice and recheck when reconnecting or returning to the tab. Website page actions remain in the original signed-in website tab. The full-window Site tools view explains this boundary; connected remote tools keep their own authorization. An older embedding SDK that cannot supply a fresh handoff proof reports a recoverable refusal.

MCPWebsite previews now wait for their actual knowledge source before describing a background crawl. MCP-served previews attribute public knowledge tools and homepage information, while confirmed ordinary page scans retain their existing explanation. The translation publisher also recognizes explicit string English floors in generated manifests, so these source-backed keys can follow the normal 14-locale publication path. Validation covers unknown scans with stale deep data, MCP and ordinary copy, both preview disclosures, generated key manifests, strict manifest shapes and existing translation gates. Live copy and actual 14-slice readback remain separate acceptance steps.

DocsDocumentation previews can read an exact, search-backed guide in small line ranges when the site's current public documentation filesystem explicitly supports that read operation. Truncated or unrecognized output remains incomplete; providers without the declared capability retain their existing document reader. Validation: real catalog/access/resolver/executor/receipt composition, policy and source revocation, strict path/range negatives, original cat compatibility, and observed provider output boundaries. Final protected qualification follows the source-origin repair dependency.

MCPKeep public preview tools bound to the requested website. An unknown site's public MCP could be discovered successfully while its redirected homepage URL replaced the saved source URL. The runtime correctly refused the mismatch, leaving the preview without tools. MCP scans now retain the validated requested URL as authority; the redirected identity page is metadata. Exact origins, including www/protocol/port, remain separate even when their lookup and rate-limit keys are grouped. Incompatible cached records are missed and rediscovered normally; no stored record is patched to manufacture a fresh source. MCP-only progress belongs to its current scan. Historical host crawl/index metrics and late events no longer appear as current work, and obsolete asynchronous recounts cannot overwrite a new source. Optional preparation that did not run reads “Not needed” without counts or timing. The new neutral status key requires the normal14-locale catalog publication. Validation covers redirected identity pages, exact-origin cache/hint/stale-source negatives, runtime proof hostname and generation, zero deep enqueue, buffered/late old metrics, deferred recount source changes and rendered neutral status. The unknown-public widget/resource/category callback and unchanged historical crawl count are verified after protected deployment.

ChatCanonical homepage assistant delivery. Returning visitors receive the homepage assistant that shares the current account and opens the canonical chat window, even when an older embed loader is cached. A stale page refresh is bounded and offers an explicit retry if delivery remains unavailable.

VoiceRead the documentation found by public MCP search. A successful public documentation search can now ground a later read when its result starts with matching Title, Link, Page and Content metadata. The runtime signs only the canonical same-origin URL/path, bound to the preview session, scan and generation; text inside Content provides no authority. A fresh eligible readonly documentation-filesystem tool can read that exact path with one literal cat command. File-extension projection requires an explicit path mapping in that tool's current contract. Shell syntax, flags, unseen paths, nested structured or JSON failure wrappers, altered receipts and other sessions remain refused. Current anonymous/public policy is checked again before dispatch. Validation covers the production dynamic resolver, executor, receipt and subsequent resolver/read, along with policy changes, replay, forgery and malformed command negatives. Natural public search/read acceptance follows the protected release; automatic remote selection was separately observed in build1545.

App StoreThe website assistant now uses the same signed-in account and conversation store as the full chat. Opening it in a full window keeps a real chat link; account changes clear stale chat state before further actions. Customer chat windows prefer their verified custom domain and fall back to their workspace address.

MCPThe required merge preflight now catches undeclared file retirements before expensive qualification, using the normal train’s exact-path commit declarations. Anonymous MCP preview reads. A tool that declares itself consequential is excluded from anonymous readonly previews even when it also claims to be readonly. Ordinary public readonly tools remain eligible, and existing authentication, destructive-action and write exclusions remain in force. Validation covers contradictory metadata with absent, anonymous and authenticated security declarations, plus unaffected readonly tools.

DocsPublic preview knowledge reads. After a site's readonly documentation search returns a structured link, the assistant can read that exact document URL or its same-origin path and query in the same conversation. Successful page and preview-browser reads now carry short-lived server-signed evidence bound to the runtime session and source. Prose, failed results, foreign origins, altered receipts and other sessions do not grant evidence; current policy and approval gates still apply before every execution. Validation: actual page resolver → executor → frame result → same-turn re-resolution → read dispatch, plus policy-change and receipt forgery/replay negatives. The actual public preview roster is now observable without arguments or response data. Fresh same-origin remote knowledge capabilities take precedence over matching preview-browser tools; a failed knowledge candidate is temporarily removed only for the same session/source and its browser fallback returns. Host-page account/navigation and unrelated tools remain available. Natural live selection and widget acceptance are verified after the protected release.