docs: record 1.7.38 audit fixes

AGENTS.md

@@ -659,7 +659,11 @@ session with **no other memory of this project**. So:
     calls are suppressed so partial JSON never renders. Pollinations' `mistral`
     slug is dead (404); only `openai` (gpt-oss-20b) is live. `findCoaches` +
     `getCommunityStats` cover **all** Lab roles (kinds 35001–35014).
-    **Bubble visibility (2026-10-04):** the floating Sasquatch FAB no longer
+    **Form-page visibility (2026-10-29):** the assistant is deliberately hidden on
+  `/become/*`, `/create*`, `/edit*`, `/supporters` and `/onboarding` — the
+  floating bubble covered form inputs/chips (especially on mobile). It remains
+  available everywhere else.
+  **Bubble visibility (2026-10-04):** the floating Sasquatch FAB no longer
     pulses forever — the `animate-ping` halo shows **only when an unread tip
     exists**, is `motion-reduce:hidden`, and is suppressed on **full-bleed routes**
     (`isFullBleed` passed from `Layout`). The bubble keeps its **full size/glow**
@@ -2222,9 +2226,9 @@ session with **no other memory of this project**. So:
 - **Lazy routes**: every route uses `lazyWithRetry` (`src/lib/lazyWithRetry.ts`) —
   retries, then one full reload per session, so a chunk-load failure self-heals
   instead of showing the error boundary.
-- **Baselines** (verified 2026-09-27): `npm test` → **0 errors, 0 warnings**,
-  **101 tests**, build ok. The gate also type-checks the CVM server
-  (`tsc -p cvm-server/tsconfig.json`). `package.json` version **1.5.4**.
+- **Baselines** (verified 2026-10-29): `npm test` → **0 errors, 0 warnings**,
+  **150 tests**, build ok. The gate also type-checks the CVM server
+  (`tsc -p cvm-server/tsconfig.json`). `package.json` version **1.7.38**.
   - ✅ Lint is **clean**: `no-explicit-any` = 0 · `react-hooks/exhaustive-deps` = 0
     · `no-unused-vars` = 0 · `react-refresh` = 0. Non-component exports were
     **split into their own modules** (`contexts/language.ts`, `lib/sortOptions.ts`,
@@ -2679,6 +2683,11 @@ Rules:
       `{requests:[]}`/`{welcomes:[]}`/`{messages:[]}`/`{keyPackages:[]}` instead
       of a Zod “expected object, received undefined” error. APK sha256
       `6cacedc0…`, versionCode 10737. Web forced live at `b94ac3d`.
+    - **1.7.38 (2026-10-29):** audit pass — follower query limit 100→500;
+      Clothing Designers added to `/stats` + Supporters impact; Sasquatch FAB
+      hidden on `/become`, create/edit and `/supporters` forms; protobufjs
+      override 7.6.5 (only remaining production advisory is write-only xlsx).
+      APK sha256 `c5975f8b…`, versionCode 10738. Web forced live at `41f420a`.
 
 ### Relay archive (dataset backup)
 - **Transfer content between keys (`scripts/transfer-content.mjs`, 2026-10-04):**