diff --git a/CONTEXT.md b/CONTEXT.md
index b424cb2..8c0c832 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -7,7 +7,7 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-02-16 (session 18)
+Last updated: 2026-02-16 (session 19)
 
 ---
 
@@ -22,7 +22,7 @@ Last updated: 2026-02-16 (session 18)
 ## Current project state
 
 ### felhom-controller (this repo)
-- **Version:** v0.6.0
+- **Version:** v0.6.1
 - **Phase 1:** ✅ COMPLETE — Stack Manager + Deploy Flow
 - **Phase 2:** ✅ COMPLETE — Monitoring & Health (scheduler, CPU/temp, healthchecks.io pings)
 - **Phase 3:** ✅ COMPLETE — Backups (DB dumps, restic integration, manual trigger, **dedicated backup page**)
@@ -31,7 +31,19 @@ Last updated: 2026-02-16 (session 18)
 - **Running on:** demo-felhom (N100 mini PC) at 192.168.0.162:8080
 - **All Phase 1-4 features working:** deploy, start/stop/restart/update, logs, health-aware states, auth, monitoring, backups, backup detail page, system monitoring page
 
-### What was just completed (2026-02-16 session 18)
+### What was just completed (2026-02-16 session 19)
+- **v0.6.1 — Code Review Bugfixes (7 fixes):**
+  - **Fix 1:** `http.NotFound(w, nil)` → pass actual `*http.Request` in `deployHandler` and `appDetailHandler`
+  - **Fix 2:** Dashboard running/stopped counts now computed from the filtered `deployedStacks` set (was counting ALL stacks including non-deployed)
+  - **Fix 3:** Session cookie `Secure` flag now dynamic based on `r.TLS != nil || X-Forwarded-Proto == "https"`. `SameSite` changed from `Strict` to `Lax` (Strict breaks Cloudflare Tunnel redirects)
+  - **Fix 4:** Removed misleading `subtle.ConstantTimeCompare` from `isValidSession()` (map lookup already leaks timing; comparing token to itself is meaningless). Removed unused `token` field from `session` struct. Removed `crypto/subtle` import.
+  - **Fix 5:** Replaced `time.Tick()` (goroutine leak) with proper `time.NewTicker` + `done` channel in `cleanupSessions()`. Added `Close()` method to Server. Added `done chan struct{}` to Server struct.
+  - **Fix 6:** Added `http.MaxBytesReader(w, req.Body, 1<<20)` (1MB limit) to `deployStack`, `updateOptionalConfig`, `deleteStack` API handlers via `limitBody()` helper.
+  - **Fix 7:** Cached `time.LoadLocation("Europe/Budapest")` once at top of `templateFuncMap()`, removed 5 per-function `LoadLocation` calls (timeAgo, fmtTime, fmtTimeShort, nextRunLabel, nextPruneLabel).
+  - **Post-fix verification:** All 4 grep checks pass (0 results for NotFound(w,nil), ConstantTimeCompare, time.Tick(, Secure:.*true). `go vet ./...` clean.
+  - **Controller version:** v0.6.1 — deployed and verified on demo-felhom.eu
+
+### What was previously completed (2026-02-16 session 18)
 - **v0.6.0 — Healthcheck Implementation + Central Push + Hub Dashboard:**
   - **Part 1 — Healthcheck enhancements (controller-side):**
     - Added `heartbeat` ping — lightweight "I'm alive" signal every 5 min (no logic, just ping)