- Added foundation file migrations during signed Gateway self-updates. - Gateway updates can now patch host .env and docker-compose.yml safely, with backups, compose validation, and rollback. - Added managed sandbox workspace mount support for existing installs and new installs. - Fixed AI sandbox workspace permissions so processes can create/read artifacts reliably. - Improved sandbox process lifecycle cleanup and kill handling. - Updated AI sandbox/tool guidance to reduce invalid artifact paths and stuck jobs. - Refined approval UI behavior for tool calls.