diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index faefb1b..f7e5f87 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -17,7 +17,7 @@ Before changing code, read the protocol docs in this order:
 
 ## Prerequisites
 
-- Rust 1.94.0 and Linux with TUN support
+- Rust 1.94.1 and Linux with TUN support
 - Use the pinned toolchain from [rust-toolchain.toml](rust-toolchain.toml) for deterministic builds
 - For the default BLE-enabled build on Debian/Ubuntu:
   `sudo apt install bluez libdbus-1-dev pkg-config`
@@ -74,6 +74,7 @@ See [testing/README.md](testing/README.md) for the available integration and cha
 - Keep commits focused — one logical change per commit.
 - Add tests for new functionality.
 - Reference relevant design docs if the change touches protocol behavior.
+- Pull requests are merged via squash-merge.
 - Update docs in the same change when you modify:
   - protocol or routing behavior
   - wire formats
diff --git a/README.md b/README.md
index 941d7b0..e071968 100644
--- a/README.md
+++ b/README.md
@@ -66,9 +66,17 @@ same way it would on a local network.
   Protocol.
 - **ECN congestion signaling.** Hop-by-hop CE-flag relay with RFC
   3168 IPv6 marking and transport kernel-drop detection.
-- **Operator visibility.** `fipsctl` CLI for control and inspection,
-  `fipstop` TUI for live status, and a JSON-line control socket on
-  each binary for direct programmatic access.
+- **Mesh-interface security baseline.** Optional default-deny
+  nftables policy for `fips0` shipped as a packaged conffile
+  (`/etc/fips/fips.nft`) with an operator drop-in directory
+  (`/etc/fips/fips.d/`) and a disabled-by-default
+  `fips-firewall.service`. The baseline polices only the mesh
+  interface, leaving Docker, Tor, and the host firewall untouched.
+- **Operator visibility.** `fipsctl` CLI for control and inspection
+  with time-series stats history queryable for any metric,
+  `fipstop` TUI for live status with inline sparkline dashboards,
+  and a JSON-line control socket on each binary for direct
+  programmatic access.
 - **Reproducible builds** with toolchain pinning and
   `SOURCE_DATE_EPOCH`.
 
@@ -103,7 +111,7 @@ tutorial progression starting at
 cargo build --release
 ```
 
-Requires Rust 1.85+ (edition 2024). Linux, macOS, and Windows are
+Requires Rust 1.94.1+ (edition 2024). Linux, macOS, and Windows are
 supported; transport availability varies by platform.
 
 | Transport | Linux | macOS | Windows | OpenWrt |
diff --git a/examples/sidecar-nostr-relay/Dockerfile b/examples/sidecar-nostr-relay/Dockerfile
index 5700d02..0e58126 100644
--- a/examples/sidecar-nostr-relay/Dockerfile
+++ b/examples/sidecar-nostr-relay/Dockerfile
@@ -10,7 +10,7 @@ WORKDIR /build
 COPY Cargo.toml Cargo.lock rust-toolchain.toml build.rs ./
 COPY src ./src
 
-RUN cargo build --release --no-default-features --features tui && \
+RUN cargo build --release && \
     cp target/release/fips target/release/fipsctl target/release/fipstop /usr/local/bin/
 
 # ── Runtime stage ──