* fix(security): keep private diagnostics out of API responses * docs: reference response-safety PR * fix(security): preserve constant recovery guidance * fix(security): keep recovery and logs data-independent * fix(security): close remaining response sinks * test(security): keep SOCKS diagnostics private * fix: keep Tailscale exceptions local * fix: keep Tailscale CLI output private