Hardened against a hostile server: server text can no longer drive your terminal, authorization server metadata must name its own issuer, a discovered host that does not resolve is refused, the library stops waiting on a silent server, and passmcp login answers only its callback for five minutes.
Stricter evidence: a check that passes without evidence is recorded as info, not pass, and a certificate that expired less than a day ago now fails instead of warning.
Safer defaults: --rps and --concurrency have maximums, --concurrency 0 turns the parallel burst off as documented, and the token store is checked on Windows too.
watch writes latency_ms on every pulse, so a 0 ms pulse is no longer missing the field. A tool that keyed on its absence needs updating.