@mmmbuto/nexuscrew 0.8.20 → 0.8.21

package/README.md

@@ -236,6 +236,16 @@ to private, while a failed deactivation remains private and is reconciled after
 same-name peer or a late allocation collision returns an actionable conflict instead of silently
 creating a duplicate record or consuming the invitation.
 
+The Share control reports desired publication separately from verified tunnel reachability. If a
+detached process survives an upgrade with stale `-R` arguments, **Reconnect and reconcile** applies
+the current checkbox state without changing consent and replaces only the verified NexusCrew
+supervisor when its saved command differs. The checkbox itself remains usable while disconnected.
+
+OpenSSH key restrictions still apply after global `AllowTcpForwarding` is enabled. A shared client
+needs its accepted hub key to allow the exact negotiated reverse listener, for example
+`permitlisten="127.0.0.1:44002"`; the actionable tunnel diagnostic prints the actual required port.
+NexusCrew never edits `authorized_keys`, so this policy remains an explicit hub-operator action.
+
 Node groups can be renamed and reordered independently in each browser from both desktop and
 mobile lists. These aliases and positions are presentation-only: they never change the technical
 node name, route, credentials, Share state or deck identity. Display precedence is browser alias,
@@ -382,8 +392,9 @@ See [CHANGELOG.md](CHANGELOG.md) for released changes.
 
 ## Status
 
-The current stable release is **v0.8.20**. npm `latest`, the GitHub tag and the release use the
-same audited package artifact.
+The current npm stable release is **v0.8.21**. This maintenance release is also deployed to the
+local runtime. The GitHub tag and release remain on **v0.8.20**; no GitHub commit, push, tag or
+release is part of the v0.8.21 npm/local rollout.
 
 ## License