- feat: --allow-sandboxing for running unprivileged Docker, Podman and Flatpak/bwrap inside containers
- feat(journald): inspect per-unit journal logs from the init service list; journal logs screen moved onto the shared components and opens at the tail without a visible jump
- feat(net): accept split-tunnel VPN routing tables as a pinned upstream
- mount: hw-access mode now exposes the raw devtmpfs; device blocklist and the unfiltered-dev privileged toggle removed, staged /dev binds and --allow-vts documented
- fix(security): refuse bind mounting the host root into a container; folder picker greys out confirm at host root
- fix: remove the Deadlock Shield entirely (runtime, app toggle and docs); drop the privileged mode security warning banner
- fix: CLI now defaults to --net=nat
- fix: peer guard no longer denies every client on kernels without PID namespaces; no more SIGPIPE death when the daemon rejects before the request is sent
- fix(app): init service list keeps its state across child screens, card reflow animates when a container leaves the list, container user cache evicted on uninstall
- app: environment variables edited as a plain text file, Artix distro icon, post_extract_fixes.sh brought in line with the rootfs builder