• new keys default to hashwx, a gpu-resistant proof of work split into 4 sub-challenges (1,000,000 hashes by default). existing keys keep their protocol
• hashwx keys need @cap.js/widget 0.1.58 or newer. with the asset server, set WIDGET_VERSION to 0.1.58+ and WASM_VERSION to 0.0.8+
• the asset server serves /assets/hashwx.wasm, use it with window.CAP_CUSTOM_HASHWX_URL
• rsw is deprecated but stays selectable per key
• public share links for a key's stats
• key config is cached for 5 s, cutting redis round trips per challenge (based on #314 by @Devansh-awat)
• instrumentation no longer blocks safari without navigator.webdriver, or firefox/safari users on a taller second monitor, and blocking mode fails closed on incomplete probes
• the 403 body no longer names the check that blocked the request
• static assets send nosniff and cache headers
• hardened share link and api key endpoints