When the IndeeHub container's own index.html already bundles
nostr-provider.js, the managed nginx patch no longer injects a sub_filter
provider and strips any existing one, staying idempotent either way; the
provider cache-bust marker moves to tab-signer-v5. The rental request API
now accepts an explicit boolean renewExpired choice, validates it, and
forwards it to the dashboard bridge, with a focused provider regression.
Reuse only unexpired JWTs for the verified selected native public key. Invalidate stale session credentials and in-flight responses on account switching or logout, notify app state before authentication, and accept identity bootstrap only from the expected signer origin.
Preserve saved profiles and private keys. Validation: 23 focused provider tests passed, including cached-key mismatch, expiry, late response, logout and repeated-selection regressions.
archipelago