From 7ee5bbc64dbb03e967521227f2afffeb7c9dad1e Mon Sep 17 00:00:00 2001
From: Diego Rodrigues de Sa e Souza
 <8016841+diegosouzapw@users.noreply.github.com>
Date: Mon, 13 Jul 2026 18:18:54 -0300
Subject: [PATCH] =?UTF-8?q?fix(build):=20v3.8.48=20hotfix=20=E2=80=94=20np?=
 =?UTF-8?q?m=20tarball=20head-response-guard=20(#7065),=20electron=20win?=
 =?UTF-8?q?=20spawn,=20Sonar=20gate=20zeroed=20(#7055)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(build): spawn npx.cmd through a shell in the electron better-sqlite3 rebuild

Node's CVE-2024-27980 hardening makes spawnSync of .cmd/.bat shims fail with
status null unless shell:true — the v3.8.47 tag build died on the Windows job
with 'better-sqlite3 rebuild against electron 43.1.0 failed (exit null)'.
Extracted the spawn plan into electronRebuildPlan.mjs (pure, import-safe) with
a regression test; args are fixed literals, no untrusted input reaches the shell.

* fix(build): ship head-response-guard.cjs in the npm tarball (#7065)

The prepublish prune allowlist (pack-artifact-policy.ts) lacked
head-response-guard.cjs, so assembleStandalone copied it and the prune
deleted it — every boot of the published 3.8.47 crashed with
ERR_MODULE_NOT_FOUND (3rd occurrence of this class; tls-options/3.8.41).
Also added to PACK_ARTIFACT_REQUIRED_PATHS so check:pack-artifact fails
loudly, plus a closure test that derives every server-ws.mjs sibling
import and asserts both lists cover it.

* fix(ci): zero the Sonar quality-gate findings on new code

- ci.yml sonarqube job: download the coverage artifact into coverage/ so
  lcov.info lands where sonar.javascript.lcov.reportPaths points — the
  upload strips the common coverage/ prefix, so 'path: .' left new-code
  coverage at 0% on every scan
- kiro auto-import: await the async isCloudEnabled() gate (S6544 — a bare
  truthiness check on the Promise made syncToCloud run even with cloud
  sync disabled)
- stream.ts: real JSON fallback in the reasoning-split clone (S3923 — both
  ternary branches called structuredClone, the promised fallback was dead)
- codex executor: handle the async reader.cancel() rejection (S4822)
- deterministic localeCompare sorts (S2871 x2)
- classify-pr-changes.mjs: confine the argv list file to the workspace
  (jssecurity:S8707 path-traversal guard) + behavioral tests
- Dockerfile: rebuild better-sqlite3 with npm's bundled node-gyp instead
  of npx --yes (docker:S6505 — no on-demand registry install)

* chore(ci): make the Sonar quality gate informational (wait=false)

The org's SonarCloud FREE plan cannot associate a custom quality gate — only
the built-in Sonar way (80% new coverage) applies, which no full-cycle release
PR can realistically meet. The scan still uploads (dashboard, PR decoration);
the CI job just no longer fails on the gate. A tuned 'OmniRoute way' gate
(coverage >=60, duplication <=5) is already configured in the org for the day
the plan is upgraded — re-enable wait=true then.

* chore(release): v3.8.48 hotfix bump + changelog (npm 3.8.47 unbootable, #7065)

* test: align pack-artifact + dockerfile guards to the corrected contracts

pack-artifact-policy.test.ts encoded the pre-#7065 REQUIRED list (without
head-response-guard.cjs) and dockerfile-better-sqlite3-node-gyp-6700.test.ts
asserted the npx invocation the Sonar fix replaced with npm's bundled
node-gyp — both now assert the corrected behavior.
---
 .github/workflows/ci.yml                      |   6 +-
 CHANGELOG.md                                  | 133 ++++++++++--------
 Dockerfile                                    |   6 +-
 docs/i18n/ar/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/az/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/bg/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/bn/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/cs/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/da/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/de/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/es/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/fa/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/fi/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/fr/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/gu/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/he/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/hi/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/hu/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/id/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/in/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/it/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/ja/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/ko/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/mr/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/ms/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/nl/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/no/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/phi/CHANGELOG.md                    | 133 ++++++++++--------
 docs/i18n/pl/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/pt-BR/CHANGELOG.md                  | 133 ++++++++++--------
 docs/i18n/pt/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/ro/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/ru/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/sk/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/sv/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/sw/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/ta/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/te/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/th/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/tr/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/uk-UA/CHANGELOG.md                  | 133 ++++++++++--------
 docs/i18n/ur/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/vi/CHANGELOG.md                     | 133 ++++++++++--------
 docs/i18n/zh-CN/CHANGELOG.md                  | 133 ++++++++++--------
 docs/i18n/zh-TW/CHANGELOG.md                  | 133 ++++++++++--------
 docs/openapi.yaml                             |   2 +-
 electron/package.json                         |   2 +-
 open-sse/executors/codex.ts                   |   2 +-
 open-sse/package.json                         |   2 +-
 .../services/usage/antigravityWeeklyQuota.ts  |   2 +-
 open-sse/utils/stream.ts                      |   2 +-
 package-lock.json                             |   8 +-
 package.json                                  |   2 +-
 scripts/build/electronRebuildPlan.mjs         |  17 +++
 scripts/build/pack-artifact-policy.ts         |   6 +
 scripts/build/prepare-electron-standalone.mjs |   9 +-
 scripts/check/check-openapi-coverage.mjs      |   2 +-
 scripts/quality/classify-pr-changes.mjs       |  11 +-
 sonar-project.properties                      |  13 +-
 src/app/api/oauth/kiro/auto-import/route.ts   |   4 +-
 src/lib/db/adapters/driverFactory.ts          |   2 +-
 .../services/codexCatalogRevalidation.ts      |   4 +-
 ...rfile-better-sqlite3-node-gyp-6700.test.ts |   4 +-
 tests/unit/electron-rebuild-spawn-win.test.ts |  22 +++
 tests/unit/pack-artifact-policy.test.ts       |   1 +
 .../pack-artifact-server-ws-closure.test.ts   |  40 ++++++
 tests/unit/sonar-quality-gate-fixes.test.ts   |  61 ++++++++
 67 files changed, 3298 insertions(+), 2651 deletions(-)
 create mode 100644 scripts/build/electronRebuildPlan.mjs
 create mode 100644 tests/unit/electron-rebuild-spawn-win.test.ts
 create mode 100644 tests/unit/pack-artifact-server-ws-closure.test.ts
 create mode 100644 tests/unit/sonar-quality-gate-fixes.test.ts

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2cdbc4dbd3..cb642d7863 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -834,10 +834,14 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0
+      # The upload strips the common `coverage/` prefix, so the artifact root holds
+      # lcov.info directly — download into coverage/ so it lands at coverage/lcov.info,
+      # where sonar.javascript.lcov.reportPaths expects it (path: . left the Sonar
+      # new-code coverage at 0% every scan).
       - uses: actions/download-artifact@v8
         with:
           name: coverage-report
-          path: .
+          path: coverage/
       - name: Explain SonarQube skip
         if: ${{ github.event_name != 'pull_request' || env.SONAR_TOKEN == '' || env.SONAR_HOST_URL == '' }}
         run: |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 51ab532369..090e756d91 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,19 @@
 
 ---
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -189,7 +202,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -259,70 +272,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/Dockerfile b/Dockerfile
index e57cef96da..adf3cf5e91 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -62,9 +62,13 @@ RUN test -f package-lock.json \
 # from that indirection. Invoking `node-gyp rebuild` directly inside the package
 # directory bypasses npm's script-running layer entirely and is deterministic
 # regardless of npm version or ignore-scripts allowlist behavior.
+# node-gyp comes from npm's own bundled copy (deterministic, already in the image)
+# instead of `npx --yes`, which would install an arbitrary registry version
+# on-demand and run its lifecycle scripts (Sonar docker:S6505).
 RUN --mount=type=cache,id=npm-cache,target=/root/.npm \
   npm ci --no-audit --no-fund --legacy-peer-deps --ignore-scripts \
-  && (cd node_modules/better-sqlite3 && npx --yes node-gyp rebuild) \
+  && (cd node_modules/better-sqlite3 \
+      && node /usr/local/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js rebuild) \
   && node -e "require('better-sqlite3')(':memory:').close()"
 
 # Build with Turbopack (stable in Next 16, the repo default). The v3.8.27-era
diff --git a/docs/i18n/ar/CHANGELOG.md b/docs/i18n/ar/CHANGELOG.md
index 106a1fce5d..f855817c21 100644
--- a/docs/i18n/ar/CHANGELOG.md
+++ b/docs/i18n/ar/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/az/CHANGELOG.md b/docs/i18n/az/CHANGELOG.md
index e97c468c32..850d934ee8 100644
--- a/docs/i18n/az/CHANGELOG.md
+++ b/docs/i18n/az/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/bg/CHANGELOG.md b/docs/i18n/bg/CHANGELOG.md
index e97c468c32..850d934ee8 100644
--- a/docs/i18n/bg/CHANGELOG.md
+++ b/docs/i18n/bg/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/bn/CHANGELOG.md b/docs/i18n/bn/CHANGELOG.md
index f52deaab68..971594fb3e 100644
--- a/docs/i18n/bn/CHANGELOG.md
+++ b/docs/i18n/bn/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/cs/CHANGELOG.md b/docs/i18n/cs/CHANGELOG.md
index 2593fd7099..8c0a63a8b0 100644
--- a/docs/i18n/cs/CHANGELOG.md
+++ b/docs/i18n/cs/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/da/CHANGELOG.md b/docs/i18n/da/CHANGELOG.md
index c469f84733..676f77bd65 100644
--- a/docs/i18n/da/CHANGELOG.md
+++ b/docs/i18n/da/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/de/CHANGELOG.md b/docs/i18n/de/CHANGELOG.md
index a6fe3eb1b1..cd0531b473 100644
--- a/docs/i18n/de/CHANGELOG.md
+++ b/docs/i18n/de/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/es/CHANGELOG.md b/docs/i18n/es/CHANGELOG.md
index 88b2a9dabf..d798798dae 100644
--- a/docs/i18n/es/CHANGELOG.md
+++ b/docs/i18n/es/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/fa/CHANGELOG.md b/docs/i18n/fa/CHANGELOG.md
index 110fb1a70d..7ae4dfa156 100644
--- a/docs/i18n/fa/CHANGELOG.md
+++ b/docs/i18n/fa/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/fi/CHANGELOG.md b/docs/i18n/fi/CHANGELOG.md
index 3c08a59814..2582c446b3 100644
--- a/docs/i18n/fi/CHANGELOG.md
+++ b/docs/i18n/fi/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/fr/CHANGELOG.md b/docs/i18n/fr/CHANGELOG.md
index 9334f0f87e..0d07715a5b 100644
--- a/docs/i18n/fr/CHANGELOG.md
+++ b/docs/i18n/fr/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/gu/CHANGELOG.md b/docs/i18n/gu/CHANGELOG.md
index c70a05932a..a48f448d54 100644
--- a/docs/i18n/gu/CHANGELOG.md
+++ b/docs/i18n/gu/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/he/CHANGELOG.md b/docs/i18n/he/CHANGELOG.md
index fde50a438a..7553ce420d 100644
--- a/docs/i18n/he/CHANGELOG.md
+++ b/docs/i18n/he/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/hi/CHANGELOG.md b/docs/i18n/hi/CHANGELOG.md
index 8264341102..93f996a33f 100644
--- a/docs/i18n/hi/CHANGELOG.md
+++ b/docs/i18n/hi/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/hu/CHANGELOG.md b/docs/i18n/hu/CHANGELOG.md
index 1458b79827..3d4ccba9ec 100644
--- a/docs/i18n/hu/CHANGELOG.md
+++ b/docs/i18n/hu/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/id/CHANGELOG.md b/docs/i18n/id/CHANGELOG.md
index bbd3e83e28..a6e1681047 100644
--- a/docs/i18n/id/CHANGELOG.md
+++ b/docs/i18n/id/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/in/CHANGELOG.md b/docs/i18n/in/CHANGELOG.md
index f7f1026990..d70b15d396 100644
--- a/docs/i18n/in/CHANGELOG.md
+++ b/docs/i18n/in/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/it/CHANGELOG.md b/docs/i18n/it/CHANGELOG.md
index c6bc1c3804..23afdbdd5a 100644
--- a/docs/i18n/it/CHANGELOG.md
+++ b/docs/i18n/it/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/ja/CHANGELOG.md b/docs/i18n/ja/CHANGELOG.md
index 2497e3dace..aeaff95477 100644
--- a/docs/i18n/ja/CHANGELOG.md
+++ b/docs/i18n/ja/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/ko/CHANGELOG.md b/docs/i18n/ko/CHANGELOG.md
index 25cfda34be..4146ca0b71 100644
--- a/docs/i18n/ko/CHANGELOG.md
+++ b/docs/i18n/ko/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/mr/CHANGELOG.md b/docs/i18n/mr/CHANGELOG.md
index a6f88c8ce4..5e4ea96d2f 100644
--- a/docs/i18n/mr/CHANGELOG.md
+++ b/docs/i18n/mr/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/ms/CHANGELOG.md b/docs/i18n/ms/CHANGELOG.md
index fb673f81f2..c44aaaf20a 100644
--- a/docs/i18n/ms/CHANGELOG.md
+++ b/docs/i18n/ms/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/nl/CHANGELOG.md b/docs/i18n/nl/CHANGELOG.md
index f3f811d413..70799c6bbd 100644
--- a/docs/i18n/nl/CHANGELOG.md
+++ b/docs/i18n/nl/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/no/CHANGELOG.md b/docs/i18n/no/CHANGELOG.md
index e8890ea671..5a50396e2a 100644
--- a/docs/i18n/no/CHANGELOG.md
+++ b/docs/i18n/no/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/phi/CHANGELOG.md b/docs/i18n/phi/CHANGELOG.md
index 4e4d1fd087..1fb507ccbf 100644
--- a/docs/i18n/phi/CHANGELOG.md
+++ b/docs/i18n/phi/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/pl/CHANGELOG.md b/docs/i18n/pl/CHANGELOG.md
index 83ac358eed..9f32de4fa4 100644
--- a/docs/i18n/pl/CHANGELOG.md
+++ b/docs/i18n/pl/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/pt-BR/CHANGELOG.md b/docs/i18n/pt-BR/CHANGELOG.md
index dc010e1f36..53a2cddafd 100644
--- a/docs/i18n/pt-BR/CHANGELOG.md
+++ b/docs/i18n/pt-BR/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/pt/CHANGELOG.md b/docs/i18n/pt/CHANGELOG.md
index e12f7be313..e432ca97b1 100644
--- a/docs/i18n/pt/CHANGELOG.md
+++ b/docs/i18n/pt/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/ro/CHANGELOG.md b/docs/i18n/ro/CHANGELOG.md
index 56fc5b20b9..4568fae186 100644
--- a/docs/i18n/ro/CHANGELOG.md
+++ b/docs/i18n/ro/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/ru/CHANGELOG.md b/docs/i18n/ru/CHANGELOG.md
index a5129e26fb..d5f2e548f9 100644
--- a/docs/i18n/ru/CHANGELOG.md
+++ b/docs/i18n/ru/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/sk/CHANGELOG.md b/docs/i18n/sk/CHANGELOG.md
index 79a47b5578..ec5b2f43a6 100644
--- a/docs/i18n/sk/CHANGELOG.md
+++ b/docs/i18n/sk/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/sv/CHANGELOG.md b/docs/i18n/sv/CHANGELOG.md
index b79564bcb5..eb5dcf7460 100644
--- a/docs/i18n/sv/CHANGELOG.md
+++ b/docs/i18n/sv/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/sw/CHANGELOG.md b/docs/i18n/sw/CHANGELOG.md
index 16c7ef5242..0fddf20f9f 100644
--- a/docs/i18n/sw/CHANGELOG.md
+++ b/docs/i18n/sw/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/ta/CHANGELOG.md b/docs/i18n/ta/CHANGELOG.md
index 417c62272b..99db23b0b0 100644
--- a/docs/i18n/ta/CHANGELOG.md
+++ b/docs/i18n/ta/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/te/CHANGELOG.md b/docs/i18n/te/CHANGELOG.md
index 9c49d296b5..1f9d75c1c9 100644
--- a/docs/i18n/te/CHANGELOG.md
+++ b/docs/i18n/te/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/th/CHANGELOG.md b/docs/i18n/th/CHANGELOG.md
index 8e5755b1ed..5d5ecf3af6 100644
--- a/docs/i18n/th/CHANGELOG.md
+++ b/docs/i18n/th/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/tr/CHANGELOG.md b/docs/i18n/tr/CHANGELOG.md
index 7dc6c505c1..b5d641fb6f 100644
--- a/docs/i18n/tr/CHANGELOG.md
+++ b/docs/i18n/tr/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/uk-UA/CHANGELOG.md b/docs/i18n/uk-UA/CHANGELOG.md
index d6bdc1d1e5..b1af97978b 100644
--- a/docs/i18n/uk-UA/CHANGELOG.md
+++ b/docs/i18n/uk-UA/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/ur/CHANGELOG.md b/docs/i18n/ur/CHANGELOG.md
index 8cfe0a109d..6f09b8af09 100644
--- a/docs/i18n/ur/CHANGELOG.md
+++ b/docs/i18n/ur/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/vi/CHANGELOG.md b/docs/i18n/vi/CHANGELOG.md
index 5ef240f54d..8a192ad1a1 100644
--- a/docs/i18n/vi/CHANGELOG.md
+++ b/docs/i18n/vi/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/zh-CN/CHANGELOG.md b/docs/i18n/zh-CN/CHANGELOG.md
index 17038fa999..96bc67e59c 100644
--- a/docs/i18n/zh-CN/CHANGELOG.md
+++ b/docs/i18n/zh-CN/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/i18n/zh-TW/CHANGELOG.md b/docs/i18n/zh-TW/CHANGELOG.md
index 71fffc6ee4..123cf82a14 100644
--- a/docs/i18n/zh-TW/CHANGELOG.md
+++ b/docs/i18n/zh-TW/CHANGELOG.md
@@ -6,6 +6,19 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.48] — 2026-07-13
+
+> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here.
+
+### 🐛 Bug Fixes
+
+- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040))
+- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build)
+- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes`
+- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor)
+
+---
+
 ## [3.8.47] — 2026-07-13
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
@@ -191,7 +204,7 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
 - **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
 - **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
-- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a _local cache_ already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
 - **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
 - **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
 - **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
@@ -261,70 +274,68 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral
 - **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
 - **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
 
-
-
 ### 🙌 Contributors
 
 Thanks to everyone whose work landed in v3.8.47:
 
-| Contributor | PRs / Issues |
-| --- | --- |
-| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
-| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
-| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
-| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
-| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
-| [@artickc](https://github.com/artickc) | #6363, #6763 |
-| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
-| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
-| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
-| [@charleszolot](https://github.com/charleszolot) | #6571 |
-| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
-| [@chy1211](https://github.com/chy1211) | direct commit / report |
-| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
-| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
-| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
-| [@eidoog](https://github.com/eidoog) | direct commit / report |
-| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
-| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
-| [@growab](https://github.com/growab) | #6867 |
-| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
-| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
-| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
-| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
-| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
-| [@itiwant](https://github.com/itiwant) | direct commit / report |
-| [@janeza2](https://github.com/janeza2) | #6308 |
-| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
-| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
-| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
-| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
-| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
-| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
-| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
-| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
-| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
-| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
-| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
-| [@quanturbo](https://github.com/quanturbo) | #6780 |
-| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
-| [@rafpigna](https://github.com/rafpigna) | #6574 |
-| [@rucciva](https://github.com/rucciva) | #4125 |
-| [@rushsinging](https://github.com/rushsinging) | #6807 |
-| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
-| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
-| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
-| [@shabeer](https://github.com/shabeer) | direct commit / report |
-| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
-| [@strangersp](https://github.com/strangersp) | #6587 |
-| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
-| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
-| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
-| [@whale9820](https://github.com/whale9820) | direct commit / report |
-| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
-| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
-| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
-| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+| Contributor                                                    | PRs / Issues                                                                                                                                             |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [@AgentKiller45](https://github.com/AgentKiller45)             | #6863, #6866                                                                                                                                             |
+| [@alltomatos](https://github.com/alltomatos)                   | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821                                                                                                   |
+| [@andrewmunsell](https://github.com/andrewmunsell)             | #6774, #6779, #6795                                                                                                                                      |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu)       | #6828, #6829                                                                                                                                             |
+| [@anhdiepmmk](https://github.com/anhdiepmmk)                   | direct commit / report                                                                                                                                   |
+| [@artickc](https://github.com/artickc)                         | #6363, #6763                                                                                                                                             |
+| [@backryun](https://github.com/backryun)                       | #6280, #6675, #6862                                                                                                                                      |
+| [@blackwell-systems](https://github.com/blackwell-systems)     | #6838                                                                                                                                                    |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl)         | #6944                                                                                                                                                    |
+| [@charleszolot](https://github.com/charleszolot)               | #6571                                                                                                                                                    |
+| [@chirag127](https://github.com/chirag127)                     | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211)                         | direct commit / report                                                                                                                                   |
+| [@crochabe-cyber](https://github.com/crochabe-cyber)           | #4013                                                                                                                                                    |
+| [@deadcoder0904](https://github.com/deadcoder0904)             | #6665                                                                                                                                                    |
+| [@developerjillur](https://github.com/developerjillur)         | direct commit / report                                                                                                                                   |
+| [@eidoog](https://github.com/eidoog)                           | direct commit / report                                                                                                                                   |
+| [@enjoyer-hub](https://github.com/enjoyer-hub)                 | #6647                                                                                                                                                    |
+| [@gdevenyi](https://github.com/gdevenyi)                       | direct commit / report                                                                                                                                   |
+| [@growab](https://github.com/growab)                           | #6867                                                                                                                                                    |
+| [@hajilok](https://github.com/hajilok)                         | #6126, #6833                                                                                                                                             |
+| [@hamsa0x7](https://github.com/hamsa0x7)                       | #6317, #6318, #6338                                                                                                                                      |
+| [@herjarsa](https://github.com/herjarsa)                       | direct commit / report                                                                                                                                   |
+| [@iamraydoan](https://github.com/iamraydoan)                   | #6798                                                                                                                                                    |
+| [@ianriizky](https://github.com/ianriizky)                     | #6072, #6538                                                                                                                                             |
+| [@itiwant](https://github.com/itiwant)                         | direct commit / report                                                                                                                                   |
+| [@janeza2](https://github.com/janeza2)                         | #6308                                                                                                                                                    |
+| [@JxnLexn](https://github.com/JxnLexn)                         | #6776                                                                                                                                                    |
+| [@KooshaPari](https://github.com/KooshaPari)                   | #6611, #6632, #6856                                                                                                                                      |
+| [@like3213934360-lab](https://github.com/like3213934360-lab)   | direct commit / report                                                                                                                                   |
+| [@lucasjustinudin](https://github.com/lucasjustinudin)         | direct commit / report                                                                                                                                   |
+| [@lunkerchen](https://github.com/lunkerchen)                   | #6320                                                                                                                                                    |
+| [@MikeTuev](https://github.com/MikeTuev)                       | #6586, #6830                                                                                                                                             |
+| [@Moseyuh333](https://github.com/Moseyuh333)                   | #6294, #6728                                                                                                                                             |
+| [@nowhats-br](https://github.com/nowhats-br)                   | direct commit / report                                                                                                                                   |
+| [@oyi77](https://github.com/oyi77)                             | #6907, #6926, #6929, #6946                                                                                                                               |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792                                                                                                                                      |
+| [@pizzav-xyz](https://github.com/pizzav-xyz)                   | #6648                                                                                                                                                    |
+| [@quanturbo](https://github.com/quanturbo)                     | #6780                                                                                                                                                    |
+| [@rafaumeu](https://github.com/rafaumeu)                       | #6813                                                                                                                                                    |
+| [@rafpigna](https://github.com/rafpigna)                       | #6574                                                                                                                                                    |
+| [@rucciva](https://github.com/rucciva)                         | #4125                                                                                                                                                    |
+| [@rushsinging](https://github.com/rushsinging)                 | #6807                                                                                                                                                    |
+| [@ryanngit](https://github.com/ryanngit)                       | direct commit / report                                                                                                                                   |
+| [@samir-abis](https://github.com/samir-abis)                   | direct commit / report                                                                                                                                   |
+| [@SeaXen](https://github.com/SeaXen)                           | direct commit / report                                                                                                                                   |
+| [@shabeer](https://github.com/shabeer)                         | direct commit / report                                                                                                                                   |
+| [@Squawk7777](https://github.com/Squawk7777)                   | #6565                                                                                                                                                    |
+| [@strangersp](https://github.com/strangersp)                   | #6587                                                                                                                                                    |
+| [@Thinkscape](https://github.com/Thinkscape)                   | direct commit / report                                                                                                                                   |
+| [@ThongAccount](https://github.com/ThongAccount)               | #6625, #6649                                                                                                                                             |
+| [@tjengbudi](https://github.com/tjengbudi)                     | #4009                                                                                                                                                    |
+| [@whale9820](https://github.com/whale9820)                     | direct commit / report                                                                                                                                   |
+| [@Witroch4](https://github.com/Witroch4)                       | #6753, #6762, #6790                                                                                                                                      |
+| [@xz-dev](https://github.com/xz-dev)                           | #6323, #6330, #6702, #6714, #6727                                                                                                                        |
+| [@yinaoxiong](https://github.com/yinaoxiong)                   | #6805                                                                                                                                                    |
+| [@diegosouzapw](https://github.com/diegosouzapw)               | maintainer                                                                                                                                               |
 
 ---
 
diff --git a/docs/openapi.yaml b/docs/openapi.yaml
index bd35e4ab03..36d2f06f7a 100644
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OmniRoute API
-  version: 3.8.47
+  version: 3.8.48
   description: |
     OmniRoute is a local-first AI API proxy router. It provides an OpenAI-compatible
     endpoint that routes requests to multiple AI providers with load balancing,
diff --git a/electron/package.json b/electron/package.json
index 01810dd50a..ed52ea15db 100644
--- a/electron/package.json
+++ b/electron/package.json
@@ -1,6 +1,6 @@
 {
   "name": "omniroute-desktop",
-  "version": "3.8.47",
+  "version": "3.8.48",
   "description": "OmniRoute Desktop Application",
   "main": "main.js",
   "author": {
diff --git a/open-sse/executors/codex.ts b/open-sse/executors/codex.ts
index d5a81b5e69..dd91bb64bb 100644
--- a/open-sse/executors/codex.ts
+++ b/open-sse/executors/codex.ts
@@ -694,7 +694,7 @@ export async function peekCodexSseTransientError(
     },
     cancel(reason) {
       try {
-        upstreamReader.cancel(reason);
+        upstreamReader.cancel(reason).catch(() => {});
       } catch {
         // noop — upstream socket may already be closing.
       }
diff --git a/open-sse/package.json b/open-sse/package.json
index 9fca2fe34d..fd014cab85 100644
--- a/open-sse/package.json
+++ b/open-sse/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@omniroute/open-sse",
-  "version": "3.8.47",
+  "version": "3.8.48",
   "description": "Express SSE sidecar for OmniRoute — handles streaming, protocol translation, and provider orchestration",
   "type": "module",
   "main": "index.js",
diff --git a/open-sse/services/usage/antigravityWeeklyQuota.ts b/open-sse/services/usage/antigravityWeeklyQuota.ts
index d0a2dcceaa..e7d94374ba 100644
--- a/open-sse/services/usage/antigravityWeeklyQuota.ts
+++ b/open-sse/services/usage/antigravityWeeklyQuota.ts
@@ -66,7 +66,7 @@ export async function fetchAntigravityUserQuotaSummaryCached(
   }
 
   const inflight = _weeklyQuotaInflight.get(cacheKey);
-  if (inflight) return inflight;
+  if (inflight !== undefined) return inflight;
 
   const promise = (async () => {
     try {
diff --git a/open-sse/utils/stream.ts b/open-sse/utils/stream.ts
index 581f1f6342..7ec442163e 100644
--- a/open-sse/utils/stream.ts
+++ b/open-sse/utils/stream.ts
@@ -1710,7 +1710,7 @@ export function createSSEStream(options: StreamOptions = {}) {
                     const reasoningChunk =
                       typeof structuredClone === "function"
                         ? structuredClone(parsed)
-                        : structuredClone(parsed);
+                        : JSON.parse(JSON.stringify(parsed));
                     const rDelta = reasoningChunk.choices[0].delta;
                     delete rDelta.content;
                     reasoningChunk.choices[0].finish_reason = null;
diff --git a/package-lock.json b/package-lock.json
index 7e32dc68d1..ba6fe54b8b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "omniroute",
-  "version": "3.8.47",
+  "version": "3.8.48",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omniroute",
-      "version": "3.8.47",
+      "version": "3.8.48",
       "hasInstallScript": true,
       "license": "MIT",
       "workspaces": [
@@ -103,7 +103,7 @@
         "@testing-library/jest-dom": "^6.9.1",
         "@testing-library/react": "^16.3.2",
         "@types/better-sqlite3": "^7.6.13",
-        "@types/bun": "*",
+        "@types/bun": "latest",
         "@types/node": "^26.1.0",
         "@types/react": "^19.2.15",
         "@types/react-dom": "^19.2.3",
@@ -28486,7 +28486,7 @@
     },
     "open-sse": {
       "name": "@omniroute/open-sse",
-      "version": "3.8.47",
+      "version": "3.8.48",
       "dependencies": {
         "@toon-format/toon": "^2.3.0",
         "safe-regex": "^2.1.1"
diff --git a/package.json b/package.json
index 9b1b5aeb23..d90aa5b11e 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "omniroute",
-  "version": "3.8.47",
+  "version": "3.8.48",
   "description": "Unified AI router with 160+ providers, RTK+Caveman compression, auto fallback, MCP/A2A, desktop, PWA, and OpenAI-compatible APIs.",
   "type": "module",
   "bin": {
diff --git a/scripts/build/electronRebuildPlan.mjs b/scripts/build/electronRebuildPlan.mjs
new file mode 100644
index 0000000000..ca913b13d0
--- /dev/null
+++ b/scripts/build/electronRebuildPlan.mjs
@@ -0,0 +1,17 @@
+/**
+ * Spawn plan for the better-sqlite3 Electron-ABI rebuild (pure — import-safe for tests).
+ *
+ * On Windows, `npx.cmd` MUST be spawned through a shell: since Node's
+ * CVE-2024-27980 hardening, spawning `.cmd`/`.bat` shims without `shell: true`
+ * fails outright (spawnSync returns `status: null`), which broke the v3.8.47
+ * tag build ("better-sqlite3 rebuild against electron 43.1.0 failed (exit null)").
+ * The args are a fixed literal list — no untrusted input reaches the shell.
+ */
+export function buildRebuildSpawnPlan(platform) {
+  const win = platform === "win32";
+  return {
+    command: win ? "npx.cmd" : "npx",
+    args: ["--yes", "node-gyp", "rebuild"],
+    shell: win,
+  };
+}
diff --git a/scripts/build/pack-artifact-policy.ts b/scripts/build/pack-artifact-policy.ts
index 6b0cb27a7e..88329052a1 100644
--- a/scripts/build/pack-artifact-policy.ts
+++ b/scripts/build/pack-artifact-policy.ts
@@ -35,6 +35,10 @@ export const APP_STAGING_ALLOWED_EXACT_PATHS: string[] = [
   ".env.example",
   "BUILD_SHA",
   "docs/openapi.yaml",
+  // #7065: imported by dist/server-ws.mjs; assembleStandalone copies it but without
+  // this bare entry the prepublish prune deleted it → every `omniroute` boot of the
+  // published 3.8.47 crashed with ERR_MODULE_NOT_FOUND (same class as tls-options/3.8.41).
+  "head-response-guard.cjs",
   "http-method-guard.cjs",
   "open-sse/mcp-server/server.js",
   // LLMLingua ONNX worker — esbuild'd standalone .js spawned via worker_threads
@@ -152,6 +156,8 @@ export const PACK_ARTIFACT_REQUIRED_PATHS: string[] = [
   // #5452: regression guard — make check:pack-artifact fail loudly if the TLS
   // opt-in sidecar (imported by dist/server-ws.mjs) ever vanishes from the tarball.
   "dist/tls-options.mjs",
+  // #7065: regression guard for the HEAD response guard (dist/server-ws.mjs import).
+  "dist/head-response-guard.cjs",
   "dist/webdav-handler.mjs",
   "bin/cli/program.mjs",
   "bin/mcp-server.mjs",
diff --git a/scripts/build/prepare-electron-standalone.mjs b/scripts/build/prepare-electron-standalone.mjs
index 951e73799d..f48e1556a8 100644
--- a/scripts/build/prepare-electron-standalone.mjs
+++ b/scripts/build/prepare-electron-standalone.mjs
@@ -5,6 +5,7 @@ import { basename, dirname, join, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "node:child_process";
 import { assembleStandalone } from "./assembleStandalone.mjs";
+import { buildRebuildSpawnPlan } from "./electronRebuildPlan.mjs";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -122,12 +123,16 @@ function rebuildBetterSqlite3ForElectron(standaloneNodeModules) {
   rmSync(join(destMod, "build"), { recursive: true, force: true });
 
   console.log(`[electron] rebuilding better-sqlite3 against electron ${electronVersion} ABI…`);
+  const plan = buildRebuildSpawnPlan(process.platform);
   const result = spawnSync(
-    process.platform === "win32" ? "npx.cmd" : "npx",
-    ["--yes", "node-gyp", "rebuild"],
+    plan.command,
+    plan.args,
     {
       cwd: destMod,
       stdio: "inherit",
+      // .cmd shims must go through a shell on Windows (CVE-2024-27980 hardening
+      // makes a shell-less spawn fail with status null); args are fixed literals.
+      shell: plan.shell,
       // Compile against the Electron headers (not Node's) so the .node lands in
       // build/Release with the Electron NODE_MODULE_VERSION. No shell interpolation.
       env: {
diff --git a/scripts/check/check-openapi-coverage.mjs b/scripts/check/check-openapi-coverage.mjs
index 0a53f00159..7ce72007b2 100644
--- a/scripts/check/check-openapi-coverage.mjs
+++ b/scripts/check/check-openapi-coverage.mjs
@@ -32,7 +32,7 @@ if (!fs.existsSync(OPENAPI_PATH)) {
   process.exit(1);
 }
 
-const implementedPaths = collectApiRouteUrlPaths(ROOT).sort();
+const implementedPaths = collectApiRouteUrlPaths(ROOT).sort((a, b) => a.localeCompare(b));
 const raw = yaml.load(fs.readFileSync(OPENAPI_PATH, "utf-8"));
 const documentedPaths = new Set(Object.keys(raw.paths || {}));
 
diff --git a/scripts/quality/classify-pr-changes.mjs b/scripts/quality/classify-pr-changes.mjs
index 619d5511a1..d1cff98f0f 100644
--- a/scripts/quality/classify-pr-changes.mjs
+++ b/scripts/quality/classify-pr-changes.mjs
@@ -91,8 +91,17 @@ function main() {
   const listPath = process.argv[2];
   let files;
   if (listPath && listPath !== "-") {
+    // Both CI callers pass a workspace-relative file (changed-files.txt); confine
+    // the argument to the working directory so a stray/hostile path can never
+    // read outside the checkout (path-traversal guard).
+    const resolved = path.resolve(process.cwd(), listPath);
+    const rel = path.relative(process.cwd(), resolved);
+    if (rel.startsWith("..") || path.isAbsolute(rel)) {
+      console.error(`[classify-pr-changes] list path escapes the workspace: ${listPath}`);
+      process.exit(1);
+    }
     files = fs
-      .readFileSync(listPath, "utf8")
+      .readFileSync(resolved, "utf8")
       .split(/\r?\n/)
       .map((s) => s.trim())
       .filter(Boolean);
diff --git a/sonar-project.properties b/sonar-project.properties
index 78a3470d41..4194c660c3 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -23,10 +23,15 @@ sonar.javascript.lcov.reportPaths=coverage/lcov.info
 #      settings (Conditions → New Code: Bugs=0, Vulnerabilities=0,
 #      Security Hotspots Reviewed=100%, Code Smells=0 or bounded).
 #
-# sonar.qualitygate.wait=true  causes the scanner to poll until the gate
-# result is available and fail the CI step when the gate is RED.
-# Without it the step always exits 0 even when the gate fails.
-sonar.qualitygate.wait=true
+# sonar.qualitygate.wait: when true the scanner polls the gate result and fails
+# the CI step when the gate is RED. Set to false (informational mode,
+# owner-decided 2026-07-13): the org is on the SonarCloud FREE plan, which
+# cannot associate a custom gate — only the built-in "Sonar way" (80% new
+# coverage) applies, and that threshold is unrealistic for full-cycle release
+# PRs. A tuned gate ("OmniRoute way": coverage ≥60 aligned with the repo's
+# floor, duplication ≤5) already exists in the org, ready to be associated if
+# the plan is ever upgraded — flip this back to true at the same time.
+sonar.qualitygate.wait=false
 
 # New-code baseline: compare against the tip of the release branch so that
 # every PR against release/* is judged as "new code vs release baseline".
diff --git a/src/app/api/oauth/kiro/auto-import/route.ts b/src/app/api/oauth/kiro/auto-import/route.ts
index 3c3937cc59..c3df55477e 100755
--- a/src/app/api/oauth/kiro/auto-import/route.ts
+++ b/src/app/api/oauth/kiro/auto-import/route.ts
@@ -499,7 +499,7 @@ async function saveAndRespond(
           ...record,
         } as any);
       }
-      if (isCloudEnabled()) {
+      if (await isCloudEnabled()) {
         const machineId = await getConsistentMachineId();
         await syncToCloud(machineId).catch(() => {});
       }
@@ -616,7 +616,7 @@ async function saveAndRespond(
       } as any);
     }
 
-    if (isCloudEnabled()) {
+    if (await isCloudEnabled()) {
       const machineId = await getConsistentMachineId();
       await syncToCloud(machineId).catch(() => {});
     }
diff --git a/src/lib/db/adapters/driverFactory.ts b/src/lib/db/adapters/driverFactory.ts
index 574abfc0f4..2d95bc7306 100644
--- a/src/lib/db/adapters/driverFactory.ts
+++ b/src/lib/db/adapters/driverFactory.ts
@@ -96,7 +96,7 @@ export async function preInitSqlJs(filePath: string): Promise<SqliteAdapter> {
   // at boot, multiplying peak memory pressure by the number of racing callers.
   const pending = getSqlJsPendingCache();
   const inflight = pending.get(filePath);
-  if (inflight) return inflight;
+  if (inflight !== undefined) return inflight;
 
   const initPromise = (async () => {
     const { createSqlJsAdapter } = await import("./sqljsAdapter");
diff --git a/src/shared/services/codexCatalogRevalidation.ts b/src/shared/services/codexCatalogRevalidation.ts
index a65b7ad658..e17d94ff30 100644
--- a/src/shared/services/codexCatalogRevalidation.ts
+++ b/src/shared/services/codexCatalogRevalidation.ts
@@ -146,7 +146,7 @@ export async function scrubCodexPersistedCatalogs(): Promise<CodexCatalogScrubRe
     connections: connections.length,
     connectionsChanged,
     modelsRemoved: removedIds.size,
-    removedIds: Array.from(removedIds).sort(),
+    removedIds: Array.from(removedIds).sort((a, b) => a.localeCompare(b)),
   };
 }
 
@@ -299,7 +299,7 @@ export function createCodexCatalogRevalidationCoordinator(
   let queuedInit: CodexCatalogRevalidationRequest | null = null;
 
   return (options) => {
-    if (activeRun) {
+    if (activeRun !== null) {
       if (options.reason === "init" && activeReason !== "init") {
         queuedInit = options;
       }
diff --git a/tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts b/tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts
index 36d0441362..17e9952a46 100644
--- a/tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts
+++ b/tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts
@@ -44,7 +44,7 @@ test("#6700 builder stage compiles better-sqlite3 via a direct node-gyp rebuild,
 
   assert.match(
     stage,
-    /cd node_modules\/better-sqlite3\s*&&\s*npx\s+(--yes\s+)?node-gyp rebuild/,
+    /cd node_modules\/better-sqlite3\s*(\\\s*)?&&\s*(npx\s+(--yes\s+)?node-gyp|node \/usr\/local\/lib\/node_modules\/npm\/node_modules\/node-gyp\/bin\/node-gyp\.js) rebuild/,
     "builder stage must compile better-sqlite3 by invoking node-gyp directly inside its " +
       "package directory (bypasses npm's rebuild-script indirection)"
   );
@@ -64,7 +64,7 @@ test("#6700 the better-sqlite3 rebuild happens after `npm ci --ignore-scripts` a
   const stage = lines.slice(start, end).filter((l) => !l.trim().startsWith("#"));
 
   const ignoreScriptsIdx = stage.findIndex((l) => /npm ci\b.*--ignore-scripts/.test(l));
-  const rebuildIdx = stage.findIndex((l) => /node-gyp rebuild/.test(l));
+  const rebuildIdx = stage.findIndex((l) => /node-gyp(\.js)? rebuild/.test(l));
   const smokeLoadIdx = stage.findIndex((l) =>
     /node -e ".*require\('better-sqlite3'\)\(':memory:'\)\.close\(\)"/.test(l)
   );
diff --git a/tests/unit/electron-rebuild-spawn-win.test.ts b/tests/unit/electron-rebuild-spawn-win.test.ts
new file mode 100644
index 0000000000..bf0f9ff1db
--- /dev/null
+++ b/tests/unit/electron-rebuild-spawn-win.test.ts
@@ -0,0 +1,22 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { buildRebuildSpawnPlan } from "../../scripts/build/electronRebuildPlan.mjs";
+
+// Regression: v3.8.47 tag build — spawnSync("npx.cmd", ...) WITHOUT shell:true fails with
+// status null on Windows runners (Node's CVE-2024-27980 hardening blocks spawning .cmd/.bat
+// without a shell), killing the better-sqlite3 Electron-ABI rebuild:
+// "[electron] better-sqlite3 rebuild against electron 43.1.0 failed (exit null)".
+
+test("win32 rebuild plan spawns through a shell (cmd shims need it since CVE-2024-27980)", () => {
+  const plan = buildRebuildSpawnPlan("win32");
+  assert.equal(plan.command, "npx.cmd");
+  assert.equal(plan.shell, true);
+  assert.deepEqual(plan.args, ["--yes", "node-gyp", "rebuild"]);
+});
+
+test("posix rebuild plan spawns npx directly, no shell", () => {
+  const plan = buildRebuildSpawnPlan("linux");
+  assert.equal(plan.command, "npx");
+  assert.equal(plan.shell, false);
+  assert.deepEqual(plan.args, ["--yes", "node-gyp", "rebuild"]);
+});
diff --git a/tests/unit/pack-artifact-policy.test.ts b/tests/unit/pack-artifact-policy.test.ts
index 098ac4483e..a5f78e2235 100644
--- a/tests/unit/pack-artifact-policy.test.ts
+++ b/tests/unit/pack-artifact-policy.test.ts
@@ -108,6 +108,7 @@ test("findMissingArtifactPaths flags missing root runtime files in the tarball",
     "bin/cli/program.mjs",
     "bin/mcp-server.mjs",
     "bin/nodeRuntimeSupport.mjs",
+    "dist/head-response-guard.cjs",
     "dist/http-method-guard.cjs",
     "dist/open-sse/services/compression/engines/rtk/filters/generic-output.json",
     "dist/open-sse/services/compression/rules/en/filler.json",
diff --git a/tests/unit/pack-artifact-server-ws-closure.test.ts b/tests/unit/pack-artifact-server-ws-closure.test.ts
new file mode 100644
index 0000000000..000bb759dc
--- /dev/null
+++ b/tests/unit/pack-artifact-server-ws-closure.test.ts
@@ -0,0 +1,40 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+  APP_STAGING_ALLOWED_EXACT_PATHS,
+  PACK_ARTIFACT_REQUIRED_PATHS,
+} from "../../scripts/build/pack-artifact-policy.ts";
+
+// #7065 (3rd occurrence of this class — tls-options/3.8.41, head-response-guard/3.8.47):
+// dist/server-ws.mjs imports sibling files that assembleStandalone copies into dist/,
+// but the prepublish prune deletes anything not in APP_STAGING_ALLOWED_EXACT_PATHS and
+// check:pack-artifact only fails for entries in PACK_ARTIFACT_REQUIRED_PATHS. Any local
+// import missing from EITHER list ships a tarball that crashes on boot. This test derives
+// the closure from the source of truth (the wrapper's own imports) so the class is closed.
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+const WRAPPER = path.join(ROOT, "scripts", "dev", "standalone-server-ws.mjs");
+
+function localImports(): string[] {
+  const src = fs.readFileSync(WRAPPER, "utf8");
+  return [...src.matchAll(/from\s+"\.\/([^"]+)"/g)].map((m) => m[1]);
+}
+
+test("every server-ws.mjs local import survives the prepublish prune (allowlist)", () => {
+  const missing = localImports().filter((f) => !APP_STAGING_ALLOWED_EXACT_PATHS.includes(f));
+  assert.deepEqual(missing, [], `add to APP_STAGING_ALLOWED_EXACT_PATHS: ${missing.join(", ")}`);
+});
+
+test("every server-ws.mjs local import is enforced by check:pack-artifact (required)", () => {
+  const missing = localImports().filter(
+    (f) => !PACK_ARTIFACT_REQUIRED_PATHS.includes(`dist/${f}`)
+  );
+  assert.deepEqual(missing, [], `add dist/<file> to PACK_ARTIFACT_REQUIRED_PATHS: ${missing.join(", ")}`);
+});
+
+test("sanity: the wrapper actually has local imports (regex not silently broken)", () => {
+  assert.ok(localImports().length >= 5, `parsed only ${localImports().length} imports`);
+});
diff --git a/tests/unit/sonar-quality-gate-fixes.test.ts b/tests/unit/sonar-quality-gate-fixes.test.ts
new file mode 100644
index 0000000000..1f39367501
--- /dev/null
+++ b/tests/unit/sonar-quality-gate-fixes.test.ts
@@ -0,0 +1,61 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+// Regression guards for the Sonar quality-gate fixes (release PR #6569 findings).
+// Two classes of real defect are locked down here:
+//  1. jssecurity:S8707 — classify-pr-changes.mjs read any path handed on argv;
+//     the CLI now confines the list file to the working directory.
+//  2. typescript:S6544 — `isCloudEnabled()` is async; a bare `if (isCloudEnabled())`
+//     is always truthy, so cloud sync ran even with cloud disabled.
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+const CLASSIFY = path.join(ROOT, "scripts", "quality", "classify-pr-changes.mjs");
+
+test("classify-pr-changes rejects a list path that escapes the workspace", () => {
+  const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "classify-guard-"));
+  try {
+    const outside = path.join(os.tmpdir(), "classify-outside.txt");
+    fs.writeFileSync(outside, "src/lib/db/core.ts\n");
+    const res = spawnSync(process.execPath, [CLASSIFY, outside], {
+      cwd,
+      encoding: "utf8",
+    });
+    assert.equal(res.status, 1, `expected exit 1, got ${res.status}\n${res.stdout}${res.stderr}`);
+    assert.match(res.stderr, /escapes the workspace/);
+    fs.rmSync(outside, { force: true });
+  } finally {
+    fs.rmSync(cwd, { recursive: true, force: true });
+  }
+});
+
+test("classify-pr-changes still accepts a workspace-relative list file", () => {
+  const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "classify-ok-"));
+  try {
+    fs.writeFileSync(path.join(cwd, "changed-files.txt"), "docs/README.md\n");
+    const res = spawnSync(process.execPath, [CLASSIFY, "changed-files.txt"], {
+      cwd,
+      encoding: "utf8",
+    });
+    assert.equal(res.status, 0, `expected exit 0, got ${res.status}\n${res.stderr}`);
+    assert.match(res.stdout, /docs=true/);
+    assert.match(res.stdout, /code=false/);
+  } finally {
+    fs.rmSync(cwd, { recursive: true, force: true });
+  }
+});
+
+test("kiro auto-import awaits the async isCloudEnabled() gate (S6544)", () => {
+  const src = fs.readFileSync(
+    path.join(ROOT, "src", "app", "api", "oauth", "kiro", "auto-import", "route.ts"),
+    "utf8"
+  );
+  // `isCloudEnabled()` returns a Promise — a bare truthiness check is always true,
+  // which made syncToCloud() run even when cloud sync is disabled.
+  assert.doesNotMatch(src, /if\s*\(\s*isCloudEnabled\(\)/, "bare `if (isCloudEnabled())` found");
+  assert.match(src, /if\s*\(\s*await isCloudEnabled\(\)/);
+});