diff --git a/CHANGELOG.md b/CHANGELOG.md
index f463bd1ad..efa959829 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,53 @@
 # Changelog
 
+## [1.46.3] — 2026-10-29
+
+### Fixed
+
+- **Codex picks from what the account is offered.** OpenAI retires Codex
+  models for ChatGPT sign-in in steps, and every retirement left Codex
+  refusing every request until a release changed the built-in list. Each
+  sign-in now reads its account's model list, the way the Codex CLI does,
+  and chooses from it in HealthLog's order of preference. Whether a model
+  reads images comes from the same list. If the list can't be read, the
+  built-in order applies, and `CODEX_MODEL` and
+  `CODEX_MODEL_FALLBACK_CHAIN` keep their meaning. The working model is
+  remembered per sign-in instead of in one slot for the whole server, so
+  two accounts on different plans, or the shared central connection, no
+  longer overwrite each other, and a sign-in reconnected to another
+  account starts fresh. (#1287)
+- **A gateway that refuses the reasoning field is asked without it for a
+  day.** The lesson held for an hour, and every expiry cost one refused
+  request, a few a day on a gateway that runs the briefings unattended.
+  Lessons read from a single reply keep the hour. (#1279)
+
+### Added
+
+- **Lab values on the timeline.** The values menu lists the lab markers
+  the record has, and a chosen marker draws its readings as their own
+  points, never averaged, with the reference range behind them. A reading
+  outside the range is drawn as a triangle and named in words. A tap shows
+  the day, the value, the range and the report it came from. Readings in a
+  unit that cannot be converted are left out and the timeline says how
+  many. Up to 24 markers at once; the choice is remembered like the other
+  value lines. (#1299)
+- **Restoring the backup of an erased account.** An upload whose account
+  no longer exists used to be refused with nowhere to go. Admin, Backups
+  now offers to restore it into a new account created for it, or into an
+  existing account that holds no records beyond what sign-up and setup
+  leave, confirmed by typing its username. Admin accounts are not offered.
+  Nothing names the erased account afterwards. A new account has no
+  password until an admin sets one with Reset password. Restoring the same
+  file into a second account is refused with an explanation instead of a
+  generic failure. The runbook in `docs/ops/backup-restore.md` has the
+  details.
+
+### Thanks
+
+@haritowa for taking the Codex retirements apart in #1287 and proposing
+the live list. @mills1975 for the timeline idea in #1299. @Tio61 for three
+days of request counts that showed what the hour still cost (#1279).
+
 ## [1.46.2] — 2026-10-29
 
 ### Fixed
diff --git a/docs/api/openapi.yaml b/docs/api/openapi.yaml
index 0dbcde4a0..e6973a27c 100644
--- a/docs/api/openapi.yaml
+++ b/docs/api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: HealthLog API
-  version: 1.46.2
+  version: 1.46.3
   description: >-
     Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest.
 
diff --git a/package.json b/package.json
index 7f7342dda..c2c7c1d55 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "1.46.2",
+  "version": "1.46.3",
   "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://healthlog.dev",
diff --git a/public/sw.js b/public/sw.js
index 38103b79a..2c501ed78 100644
--- a/public/sw.js
+++ b/public/sw.js
@@ -36,7 +36,7 @@ try {
 // v1.4.38.4 → v1.4.42. Do not hand-edit; bump `package.json` and rebuild.
 const CACHE_VERSION =
   (typeof self !== "undefined" && self.__APP_VERSION__) ||
-  /* @sw-version-fallback */ "v1.46.2";
+  /* @sw-version-fallback */ "v1.46.3";
 const STATIC_CACHE = `healthlog-static-${CACHE_VERSION}`;
 const PAGE_CACHE = `healthlog-pages-${CACHE_VERSION}`;
 // v1.18.6 — read-only data cache for a curated allowlist of safe GET `/api/*`