diff --git a/CHANGELOG.md b/CHANGELOG.md
index 099d1cd1..f4f19941 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,7 @@ All notable changes to this project will be documented in this file.
 
 ### Changed
 
+- **Community interface presets**: Runtime no longer fetches directory.rns.recipes. Presets come from bundled `community_interfaces.json` (refreshed at build time via `scripts/build_community_interfaces_json.py`) or an optional `public/community_interfaces.json` override.
 - **Slow-interface path and link waits**: Cold path requests use `path_response_window` in `meshchatx/src/backend/path_utils.py`. It takes `Reticulum.get_first_hop_timeout` (not `Transport.first_hop_timeout`, which is the local socket timeout on a shared rnsd client) and an airtime floor from the slowest online interface, clamped to `RNS.Reticulum.MINIMUM_BITRATE` (5 bps). New links wait on `link.establishment_timeout` plus 5 seconds. Nomad pages, RNS Link API, RNCP, FileSync, LXMF outbound path prep, LXST dial, map fetches, remote management, bug-report send, path-probe defaults, and Relay Chat hub identity recall use those helpers. A 15 second window cannot finish a 234-byte path exchange at 125 bits per second.
 - **Dependencies**: LXMF 1.1.1. Unanswered path requests during propagation peer sync now apply sync backoff instead of retrying immediately. Requires RNS 1.4.2 (already pinned).
 - **App sidebar**: Network Visualiser is under Explore with Nomad Network and Map, not in More.
@@ -56,6 +57,11 @@ All notable changes to this project will be documented in this file.
 - **WebSocket Origin and read gating**: `/ws` and `/ws/telephone/audio` reject a browser Origin that does not match the request authority (missing Origin still allowed for non-browser clients; `X-Forwarded-Host` only behind a trusted proxy). When password auth is enabled, every WS type except `ping` requires a session, including former read types such as `keyboard_shortcuts.get`.
 - **FileSync sync-root picker**: Identity-storage `ssl` (TLS key material) is a reserved top and cannot be chosen as a sync directory.
 - **Plugin integrity at invoke**: `invoke` and `dispatch_hook` re-hash the install tree and refuse tampered backends. Python plugin loads delete `__pycache__` next to the entry file so bytecode excluded from the hash cannot replace source.
+- **Peer HTML sanitizers**: One XSS payload list (`javascript:`, `data:`, `<base>`, SVG, `onerror`, CSS `url()`, nested markdown) runs against MarkdownRenderer, Nomad HTML, MicronParser, and the KML sanitizer. Formatted pages still render. Scriptable nodes fail the oracle.
+- **v-html**: ESLint errors on `v-html` unless the nearby disable comment names a sanitizer (`renderMarkdown`, `renderMessageHtml`, `sanitizeNomadHtml*`, `convertMicronToHtml`, and the other existing sites).
+- **LAN bind**: Browser UI shows a persistent banner when bound off loopback with authentication off. Electron and Android hide it. The process does not exit.
+- **Mesh payload caps**: Announce `app_data` above 2048 bytes is omitted from storage (destination and aspect still upsert). Nomad page bodies above 512 KiB fail with `page_too_large` and a toast. Map zip `file_too_large` and RRC 350-byte line caps keep matching oracles.
+- **Outbound HTTP**: New backend `httpx`/`urllib`/`aiohttp` clients must go through `ensure_outbound_http_allowed` or `http_url_guard`. Existing translator, tiles, firmware, community directory, and repository fetches are unchanged.
 - **Translator (Landlock)**: On Linux, allow read/execute for user-local pipx CLIs (`~/.local/bin`, `~/.local/share/pipx`) and read-write for Argos Translate data under `~/.local/share/argos-translate`, so argospm language lists and local Argos translation work with the filesystem sandbox enabled.
 - **Tests**: Landlock integration probes for subprocess spawn, translator Argos language listing, user-local CLI execution, and home write denial outside RW roots (tests/backend/test_landlock_integration_surfaces.py).
 - **Windows desktop**: AppContainer sandboxing is opt-in (set `MESHCHAT_APPCONTAINER=1`) instead of on by default, to avoid extra launcher processes and heavy startup until the path is stable.
diff --git a/meshchatx.rsm b/meshchatx.rsm
index 050d8e3a..5ab4e8c0 100644
Binary files a/meshchatx.rsm and b/meshchatx.rsm differ