App-level token bucket on rend accepts (30/60s, burst 10), panic-safe TUI restore, sqlite WAL + integrity_check fail-closed. Encrypted owbak1 identity backup/restore. README and threat model cover profile, XMR sidecar, backup, mixed-version frames.
/wipe overwrites the message log and VACUUMs; identity and friends stay. /wipe-all deletes the data dir after confirm so the next open is a new person. Neither runs without a typed confirm screen.