- crates/kv-ipc: native-messaging framing and the local IPC socket/pipe (moved from kestrove-desktop), plus Listener::bind_in/connect_in and, on macOS, the App Group socket for the kestrove-nmh bundled in Kestrove.app (Contents/Resources/kestrove-app-group). - crates/kv-nmh: the native-messaging host, with an embedded Info.plist on macOS so it can run sandboxed (KV_NMH_BUNDLE_ID). - kv-ffi feature browser-bridge: broker, pairing channel and word list (moved from kestrove-desktop) and BrowserBridge for Swift. build-apple.sh enables it and builds a universal kestrove-nmh. - RUSTSEC-2026-0381/0382: rustls-webpki 0.103.16, webpki-roots 1.0.10 (distrusted emSign roots). Co-Authored-By: Claude Opus 5.5 <[email protected]>