0.75.3

Released 2026-11-12. A car from another computer authorizes only the deploy targets its own boss granted; two small corrections follow the review of 0.75.2.

Changes

• A car from another computer cannot authorize its own deploy. A car slip forwarded with origin=remote:<device> is written by that device’s main, so its auth is a peer’s words, not the boss’s. The integrator prompt now says such a car’s auth covers only the strict targets its device’s boss granted, quoted, and for any other target the integrator asks the boss through the tower (why=blocked) (review R151-F006, boss decision 2026-11-12).

Fixes

• Correction to the 0.75.2 note on open/base asks. 0.75.2 said nothing is read from disk to learn whether a pane was opened by the page. The list of such panes is in the server’s memory only, but the asking pi finds the server through its record (server.json), as every control request does. A process of the same user that writes that record and answers the socket can therefore say yes for any pane. It grants no trust: the question waits for a person instead of being answered “not trusted” (review R0752-F001).
• A command that wrote more than its output limit is no longer reported as a timeout. The error now carries ERR_CHILD_PROCESS_STDIO_MAXBUFFER with killed: false and no signal, as execFile gives it, so logs and keep-reasons no longer say “no answer in time” for it; the program is still ended (review R0752-F002).