Performance Improvements

This release includes 15 updates.

New Features

fail-closed target egress helper, origin-egress metric, AST CI guard

Adds (, ): SSRF and request-time DNS validation, system proxy only (no proxy means refusal, never a direct origin-IP fetch), one pinned UA/header set per call, manual redirect loop re-validating every.

give T1 a bounded grace after an early T2 win in the tier race

In the T1/T2 tier race, T1 gets a 1 s head start before T2 (HTTP client) also starts.

route the storage_shared backup lane to Netcup (netcup:storage policy scheme, sender + verifier)

Owner decision : publish the protected user-uploads lane to the Netcup relay namespace instead of .

storage namespace + backup-storage-relay account in the Netcup backup relay

Owner decision moves the protected user-uploads backup lane off Cloudflare onto Netcup.

LLM inbound filter for support@ routing ticket / crm / ignore

Every email to support@ currently becomes a ticket (34 of 98 email tickets on 2026-10-10 were noise, 6 were CRM/sales).

Improvements

fix(ci): track restore-drill verifier pin a115befe in its contract test

(, merged via ) moved the immutable storage verifier pin in from to (object-data-policy V4).

fix(stealth): make advanced browser device classes coherent across identity, client hints and TLS

## Audit findings (why current behavior existed).

fix(worker): native Firefox identity on the T4 Firefox engine

## Audit (why it was this way).

fix(monitoring): alert on per-job thin-content false successes, not T4 selector misses

divided (per T4 browser *attempt*, includes retries and later-failed jobs, "miss" = generic article selectors absent in ~2s) by (per job, all tiers).

fix(monitoring): ensure jq on cloud provider from root cron setup; detect blind probe venv

- (run as root on every deploy by ) now ensures via apt-get.

General bug fixes and improvements

Plus 9 internal improvements for better reliability and performance.

Bug Fixes

prune-storage orders generations by caller-chosen filename stamp (review finding — )

in ranked storage generations by the client-chosen filename stamp, so a holder of the key could commit far-future generations and make delete every real generation in a lane (review finding from .

remove origin-IP content-type HEAD and smart-render probe, delete dead egress code

Stops the live origin-IP leak: the API sent unproxied requests to customer targets on extensionless scrape submissions ( HEAD) and a self-identifying GET for.

tier-learning attribution, evidence wiring, BYOP rotation counter (, )

Accounting, wiring and telemetry only — no escalation or tier-selection change.

T3 pool lease setup and tier rejection log context (, )

Members: , .

owner-lease fenced profile claim republish

The stale-claim reaper republished a processing profile claim once its heartbeat score was older than 120s, with no proof the original handler had stopped.

Plus 9 internal changes for stability and performance.