v1.87.2

## Highlights

This release brings the proxy/Bedrock and force-update fixes from `main` into the supported channel, and lands the ATP autoBuyer consent surface that started in [#141](https://github.com/EvoMap/evolver-private-dev/issues/141) and finished with the default-on tuning in [#145](https://github.com/EvoMap/evolver-private-dev/issues/145).

If you upgraded straight from 1.87.0 (skipping 1.87.1), this release also includes everything 1.87.1 shipped — the `recallVerifier` default flip ([#136](https://github.com/EvoMap/evolver/issues/136)) and the `setup-hooks` `_memoryFiltering.js` fix ([#547](https://github.com/EvoMap/evolver/issues/547)).

## Added

- **ATP autoBuyer consent surface ([#141](https://github.com/EvoMap/evolver-private-dev/issues/141)).** New `evolver atp <enable|disable|status>` subcommands, ack file at `<memory>/atp-autobuy-ack.json`, env override `EVOLVER_ATP_AUTOBUY=on|off`. Resolution order: env > ack > default. Atomic `setConsent` writes, strict ack validation, CLI warning when env override would silently shadow the ack, and `URL.origin` sanitization on the daemon WARN so basic-auth creds in the hub URL are never logged.

## Changed

- **ATP autoBuyer default ON for new installs ([#145](https://github.com/EvoMap/evolver-private-dev/issues/145)).** No env override + no ack → autoBuyer starts under the daily / per-order caps (50/day, 10/order; cold-start half-cap for 5 min). TTY first-run prompt and `evolver atp disable` are the opt-out paths; an explicit ack=disable continues to win over the default. Daemon/hook/CI cold-start emits a one-time WARN with the hub origin, active caps, and the disable command — never silent.

- **`recallVerifier` default off ([#136](https://github.com/EvoMap/evolver/issues/136)).** Already shipped in 1.87.1; included here for the main-line changelog. Opt back in with `EVOLVE_RECALL_VERIFY=1`.

## Fixed

- **Proxy router: canonicalize Bedrock model IDs + skip alias-only 5xx retry ([#135](https://github.com/EvoMap/evolver-private-dev/issues/135)) and defense-in-depth canonicalize at proxy boundary ([#139](https://github.com/EvoMap/evolver-private-dev/issues/139)).** Model alias drift between Anthropic-shaped requests and Bedrock model IDs is resolved at both layers; a 5xx originating from an unresolvable alias is no longer retried as a different alias of the same family.

- **`forceUpdate` preserves `.env`, `.env.local`, `USER.md`, and `.evolver/` ([#142](https://github.com/EvoMap/evolver-private-dev/issues/142)).** Force-update no longer wipes operator configuration or workspace identity files when overlaying a new release.

- **`evolver setup-hooks` ships `_memoryFiltering.js` ([#547](https://github.com/EvoMap/evolver/issues/547), [#140](https://github.com/EvoMap/evolver-private-dev/issues/140), [#143](https://github.com/EvoMap/evolver-private-dev/issues/143)).** Already shipped in 1.87.1; a regression suite now scans every `require('./_*')` in the source adapter scripts to assert install + uninstall cover the helpers.

  Thanks to **@rendigua** for the Windows reproduction on the official 1.87.0 install path, and to **@mvanhorn** for [#550](https://github.com/EvoMap/evolver/pull/550) — an independent fix with the same diagnosis on the same day.

## Install

```bash
npm i -g @evomap/evolver@latest
# or pinned:
npm i -g @evomap/evolver@1.87.2
```

## Notes

This is a stable patch on top of 1.87.1. Standalone binaries for darwin-arm64 / darwin-x64 / linux-x64 / linux-arm64 / windows-x64 are attached to this release.