- Fixed dev server crash caused by renaming image files; hot‑reload now works without errors.
- Hardened `addAttribute` to drop attribute names containing characters invalid per the HTML spec.
- Validated request origin against `allowedDomains` before fetching prerendered error pages, with a localhost fallback for mismatches.