Changelog

• i18n: weight core locale set to paying markets (add de/ja/it/nl, drop hi/bn/ur)
• translate: re-sync bundle snapshot (inline audit completeness)
• translate: re-sync bundle snapshot (detect-confidence + storage snippet redaction + allowed_providers aliases)
• translate: re-sync bundle snapshot (offline-only auto-detect)
• translate: sync bundle snapshot + human error message + 202/engine contract

permalink ↗

• documents: scope DeleteByOwner to the in-context tenant (review fix)
• hooks/documents: add $app.documents.deleteByOwner host binding
• test: register translate_job_meta in the translate parity harness + resync snapshot
• test: sync translate parity snapshot to the audited bundle

permalink ↗

• site(widgets): collapse plugin table row actions into an overflow menu
• test: sync translate 0.4.14 snapshot + Delete/Archive parity tests

permalink ↗

• translate: pptx page-count, PDF layout overlay, multilingual + glossary widgets
• admin documents: in-drawer view/download + drawer polish + checkbox fix

permalink ↗

• admin: Update Center — core self-update + plugin updates in one screen
• testdata: re-sync translate snapshot (publishes original+result to _documents)

permalink ↗

• documents: $app.documents plugin binding + move Documents admin to Data

permalink ↗

• plugindock: map $app.notify → host.notify (appCapKey)

permalink ↗

• notifications: $app.notify plugin binding + site header bell

permalink ↗

• adminapi: admin-only data browser bypasses the collection access rule

permalink ↗

• site widgets: completion toast on row transition (Source.notify)
• testdata: re-sync translate.plugin.js snapshot (worker batching/cancel/usage)

permalink ↗

• site widgets: progress-bar + per-row action cells (download/cancel)

permalink ↗

• site: poll plugin data widgets so tables/lists/meters refresh live

permalink ↗

• site: poll plugin data widgets so tables/lists/meters refresh live
• admin: idle/session auto-logout — bounce admins on inactivity + expiry
• tooling: add cmd/dockcheck — offline plugindock gate for pre-publish checks

permalink ↗

• admin: idle/session auto-logout — bounce admins on inactivity + expiry
• tooling: add cmd/dockcheck — offline plugindock gate for pre-publish checks

permalink ↗

• firstparty gate docks the shipped dist artifact (billing4 audit)
• Harden plugindock per third docking audit (billing4)
• Add plugindock docking gate + platformsurface registry (billing4)

permalink ↗

• feat(docs+site-shell): markdown/text translation + file-type accept + surface server errors

permalink ↗

• feat(marketplace): central Update center — Update all + dependency-ordered + fix update detection

permalink ↗

• feat(site-shell): searchable combobox widget field (async optionsVerb) + fix file-input rendering

permalink ↗

• fix(self-update): no second browser tab on update; reload in place

permalink ↗

• feat(errors): branded 404 across admin, site, and server; retire /papi prefix

permalink ↗

• fix(admin): inset role checklist in user detail so checkboxes don't jam the column edge

permalink ↗

• refactor(admin,site): user detail + workspace tables onto shared kit components
• fix(release): always run catalog sync on deploy so core self-update gets per-platform artifacts

permalink ↗

• fix(admin): unify table-cell typography across all screens

permalink ↗

• patches removal: drop the inert ledger migrations + stale references
• remove the patch subsystem (redundant with self-update)
• self-update: audit the final committed/rolled_back outcome, not just the request

permalink ↗

• supervisor: no second browser tab on update/restart, and prune .prev on commit

permalink ↗

• config: default pb_data next to the binary, not the CWD

permalink ↗

• admin: progress bar on the Update screen

permalink ↗

• admin: Stop + Restart Railbase in the nav-user menu, gated to admins
• fix: "Stop Railbase" must stop the supervised tree, not restart the worker

permalink ↗

• self-update: regression test for the dry-run data-dir env fix
• self-update: escalate failures to railbase.app + i18n the Update screen
• self-update: supervisor-gated safe core update (dry-run + auto-rollback)
• admin: add "Stop Railbase" graceful-shutdown control

permalink ↗

• fix: allow flat plugins for all app users

permalink ↗

• feat(marketplace): align core ↔ railbase.app — retire /_pm/checkout & /_pm/portal, surface activation + version-pinned install
• pluginmgr: preserve release kind on version-pinned install (ADR-002)

permalink ↗

• feat(plugins)!: remove out-of-process (ADR-001) plugin runtime — data-resident kind:js only

permalink ↗

• feat(plugins): ADR-003 capability registry, crypto binding, and queryIndex tenant-safety hardening
• fix(marketplace): stop the license poll on a 409 (don't hang on 'fetching license…')
• fix(admin): move collection padlocks to a fixed left column (no jitter)
• feat(admin): schema-lock — freeze admin-managed collections + padlocks across the Data UI
• fix(i18n): regenerate embedded admin floor for the new SPA keys
• feat(admin): group plugin collections + pin marketplace/system in Data sidebar
• feat(admin): model-aware pricing/seats UI, scheduler+jobs+tenancy screens, plugin-UI manifest SoT, drawer fix
• test(link): near_limit + top-up-resumes coverage (L1)
• test(link): enforcement parity for the data-resident link bundle

permalink ↗

• feat(i18n): edit both SPA-floor and Vault-override layers per key in Translations editor
• fix(rbac): map seat-limit to 409 on the RBAC-request approval path (P4)
• fix(marketplace): seat-license ALL data-resident plugins (finish B3 — 14 more)
• fix(seats): enforce plugin seat licensing on the admin role-assign path too
• chore(marketplace): drop the orphaned 'company' plugin entry (folded into core)
• test(license): join bind→$app.license→quota end-to-end; share the claims adapter (B8)
• fix(seats): flat company-wide plans skip the per-user seat turnstile (B2)
• fix(marketplace): seat-license gl/ap/ar/fa (close split-brain revenue leak)
• i18n: tenant terminology, i18n tab, 10-locale floor across all scopes

permalink ↗

• i18n: translate tenant/workspace + RBAC-request keys into 9 locales

permalink ↗

• feat(tenants): consolidate company→tenant, workspace UI, RBAC requests, migration
• fix(ship): build release notes from the commit log, never an empty body

permalink ↗

• test(hooks): prove $app.dao().queryIndex tenant-narrows through the goja binding; refresh migrated finance fixtures
• fix(core): always stamp tenant_id on .Tenant() so the tenant index stays complete
• test(hooks): prove translate tenant-index fast path; sync parity snapshot

permalink ↗

Highlights

$app.license(slug) — verified entitlement for data-resident plugins

Plugins can now read their customer's real licensed plan and quota (pricing_kind / plan / quota) through a read-only host binding, available on both the request runtime and the background-job / event runtime. Claims are decoded only after the license signature verifies and are persisted next to the seat limit; an operator seat override can't clobber a flat plan's claims, and a mid-cycle plan change is picked up on the next license heartbeat.

New meter site-shell widget

Plugins can ship a usage meter (used / quota progress bars) in their bundle's declarative widget descriptor — powering, e.g., Translate's monthly-quota display.

Together these enable value-metric plugin pricing end to end: per-seat for role-based tools, and flat company / service plans with a fair-use quota for shared utilities — the core reads the signed entitlement and the plugin enforces it.

Compatibility

Additive and backward-compatible: existing licenses keep working (the new claims are optional) and plugins that don't read $app.license are unaffected.

permalink ↗

• test: pin mutation-survivor guards (audit/rbac/tenant)
• fix(core): resolve e.auth for data-resident plugin verbs
• fix(ui): Select trigger keeps the selected label after the menu closes
• plugin-manager: report core version + aggregate usage on the license heartbeat

permalink ↗

• Stripe Tax address + plugin-runtime: JS HTTP hook, bundle/UI wiring

permalink ↗

Per-role plugin seat licensing, plus a fix for dev mail delivery.

Highlights

• Per-role plugin seats — plugins whose roles are priced differently now enforce a separate seat pool per billable role instead of one shared count, so seats bought for one role can't be spent on a pricier one. The operator console shows per-role usage and prompts you to assign seats on a freshly installed plugin.

Fixes

• Dev mail delivery: a local SMTP catcher (MailHog / Mailpit on :1025) is auto-detected again on any non-production start — welcome / password-reset mail no longer silently falls back to the console driver after the first run.

permalink ↗

App-user password reset with full 10-language i18n, plus internal cleanup and release-tooling hardening.

Highlights

• Password reset for app users — the site sign-in now has a complete forgot-password / reset-password flow, localized across all 10 supported languages.

Fixes & internals

• Removed dead Go code and unused internal packages flagged by staticcheck U1000, and cleaned up the var _ = import keep-alive shims that were masking them (no behavior change).
• Hardened the one-command release pipeline (ship.sh).

permalink ↗

Admin dashboard count fix, CLI ready-banner URL fix, and a one-command release pipeline.

Fixes

• Admin dashboard collection count now excludes system collections.
• CLI ready-banner / browser URL is correct for explicit host:port binds.

Internals

• Added scripts/ship.sh — one-command core release + deploy + prune + download.

permalink ↗

CLI: auto-offer a free port

When railbase serve's HTTP port is already in use, an interactive terminal now offers to start on the next free port (e.g. :8095 → :8096) instead of only printing the lsof/kill recovery hint. Press Enter (or y) and Railbase boots on the new port.

Non-interactive runs (CI, systemd, piped stdin) keep the original fail-fast behaviour, so automation never silently lands on an unexpected port.

Builds on v0.5.25 (plugin RBAC unification + admin UI conformance + i18n).

permalink ↗

Plugin RBAC unification

• Plugin seat-licensing collapsed onto the built-in internal/rbac — one authorization system (the separate _user_plugin_roles store is retired).
• No bypass: system_admin / tenant:owner now hold every catalogued action explicitly, so every decision is a real grant check.
• Plugins declare their own roles in the bundle manifest (rbac.roles[]); the core registers each as a first-class role on install with its permissions + billable flag.
• Manifest mount/auth is authoritative — a non-configurable app-user plugin can't be forced public by an operator override.
• Permissions editable for all roles; Roles drawer rebuilt on the kit composites.

Admin UI conformance

• New eslint rules (drawer-editable-only, no-raw-control, use-email-input) promoted to error; ~30 admin screens migrated onto the shared UI kit (eslint ratchet at baseline 0).

i18n

• Admin + plugin marketplace translated into the 8 remaining locales (ar, bn, es, fr, hi, pt, ur, zh) on the unified Vault-backed catalog, with a deterministic translator + terminology brand-book.

Gate: go build/vet + go test -race ./... green; admin tsc + eslint (baseline 0) + vitest 201 + admin/site builds green.

permalink ↗

Unify the three drifting i18n stores (server embed, admin SPA, site SPA) into ONE Vault-backed _i18n catalog, served via /api/i18n with a ?scope= filter (server | admin | site) and edited live from the admin Translations tab.

• Single source of truth: a _i18n Vault system collection (row per locale+scope, JSON-string column).
• Scope-filtered bundle endpoint + version marker; the no-scope path stays SDK-compatible.
• Admin Translations editor repointed disk → Vault: full key universe per scope, live refresh on PUT, bulk import endpoint.
• Admin SPA fetches its scope from the catalog at runtime with the SHIPPED bundles as an offline floor (catalog overrides per-key) + a 60s version poll for live edits.
• Embedded en/ru remain the server-side floor.

i18n-only release on the v0.5.23 base (server + admin scopes). 10 admin UI languages ship bundled and are now operator-editable.

permalink ↗

Plugin-runtime concurrency: close the v0.5.22 gaps.

• Reachable VM pool. RAILBASE_VM_POOL_SIZE now wires the Compile-once verb VM pool that shipped (dormant) in v0.5.22. Unset/0 = off (default, single-VM as before); auto = GOMAXPROCS; N = fixed pool. Operators enable it when blocking host calls (network $app.http.fetch, OCR) make the single-VM serialization a head-of-line bottleneck — the symptom seen as minute-long stalls under network load.
• Runtime stats endpoint. GET /api/_admin/plugin-runtime/stats (admin-gated) exposes the goja dispatch counters: verb-lock wait/hold + worst single hold (head-of-line high-water), in-flight gauge, 503 rejections, per-kind host-call latency, eventbus drops.
• translate /document is async-by-default. It enqueues the same background worker as POST /jobs and returns 202 + a job id instead of running extract → translate → render inline under the goja VM. (Pairs with translate v0.2.6.)

Pinned vendor keys + data-resident plugin key unchanged from v0.5.7+. SHA-256 in checksums.txt.

permalink ↗

Plugin runtime concurrency hardening — data-resident plugin verb dispatch is now bounded and parallelisable, so one slow plugin can no longer freeze the whole runtime:

• Bounded host calls — $app.http.fetch / $app.docs.* / $app.ocr run on the verb's deadline context, so the timeout actually cancels a blocking upstream (previously it held the VM lock up to the call's own 30s ceiling).
• Per-plugin limits — author-declared manifest.runtime route timeout + max-concurrency (operator-overridable, hard-clamped); over-cap requests are rejected 503 before taking the lock.
• Dispatch tracing — Runtime.Stats: lock wait/hold + high-water mark, in-flight gauge, per-kind host-call latency, dropped events; WARN on a slow verb or consume reaction.
• Compile-once — plugin sources compile to a *goja.Program; per-job / per-event VMs no longer re-parse.
• Verb VM pool (opt-in, VMPoolSize, default off) — concurrent verbs run on dedicated VMs in parallel: ~9× verb throughput in the blocking-handler benchmark.

Also ships the prior signup / email-verify fixes. Backward-compatible — no config changes required. goja is unchanged; ADR-002/003 invariants intact.

Verify downloads: shasum -a 256 railbase_* against checksums.txt (also at https://railbase.app/dl/checksums.txt).

permalink ↗

Plugin manifest + universal install/configure/uninstall wizard (ADR-003).

• Plugins ship a manifest (UI mount/auth, settings, data policy, events, verb RBAC).
• Operators can override a plugin's mount, sign-in requirement, and settings, and map verb permissions to roles — via a new Configure dialog in the in-app marketplace.
• Settings groups (shareable across plugins, schema-compat-checked) resolved through $app.settings(group), with per-tenant overrides.
• Core-enforced verb→permission RBAC for data-resident plugin verbs.
• Uninstall now offers keep-data (dormant) vs delete-data (purge).
• Site shell honours per-plugin public vs app-user access.
• Removed the legacy railbase plugin setup CLI codegen wizard (superseded by install-time UI).
• Fixed an eventbus teardown race surfaced under -race.

permalink ↗

• Site: account creation never grants an implicit session — signup now always requires email verification + an explicit sign-in.
• Marketplace: seat-license enforcement now stops data-resident (kind:js) plugins, not just OOP subprocesses (enforceJSLicense).
• Embeds vault v0.1.0 (audit-wave fixes + Cloud/HSM KMS providers).

permalink ↗

Internal refactor — no user-facing behaviour change.

• Unified UI kit. The admin and site SPAs now share one source of truth — the shadcn-on-Preact kit lives in a single ui/ workspace package instead of being duplicated (the site previously carried a byte-identical copy that drifted from admin). Same admin panel, same site shell, same /api/_ui registry bytes for downstream apps.
• One hoisted node_modules (npm workspace) → a single preact instance; the public site's utility CSS stays lean.

Verified: full go test ./..., make build, admin 185 unit tests, both SPAs render with zero console errors, /api/_ui + railbase ui init intact. Binaries pin the railbase.app vendor trust root — verify against checksums.txt.

permalink ↗

Site frontend + auth improvements.

• Signed-in site sidebar — a persistent left nav (Home + each installed plugin's page + account/sign-out) wraps the site shell; new plugin installs appear with no rebuild.
• Hardened signup form — password strength meter + generator + confirm field, validated against the shared policy (≥8 + upper + digit + symbol).
• Optional email-verification gate (operator setting, default off) — when enabled, signup withholds the session and emails a confirm link; unverified sign-ins are blocked with a one-click resend. Toggle in admin → Auth methods.
• Global 401 recovery — a stale token now clears + signs out cleanly instead of looping (fixes the /translate 401 loop).

All binaries pin the railbase.app vendor trust root. Verify downloads against checksums.txt.

permalink ↗

Admin UX: the Plugin Marketplace moves out of Settings into the main sidebar, directly above System (a first-class operator surface). Builds on v0.5.16 (data-resident plugins show as installed; bare railbase auto-serves an initialized site).

permalink ↗

Marketplace + launcher fixes.

• marketplace: data-resident (kind:js) plugins now show as installed in the in-core Plugin Marketplace (the installed-list previously only knew OOP/backend plugins).
• cli: a bare railbase on an already-initialized site (existing data dir/vault) now starts the backend directly instead of re-showing the first-run menu; fresh installs still get the guided menu; non-TTY unchanged.
• admin: internal eslint cleanup (theme tokens; no behavior change).

permalink ↗

Bug-fix release.

• Fix use-after-free on borrowed vault cursor keys — aligns railbase with vault's zero-copy cursor borrow contract (Iterate/Range hand back page-aliased bytes). Origin upsert wrote under a dangling key; cron upsert could delete the wrong row (duplicate name / lost id).
• Security & admin hardening (audit 160626) — admin invite + disable lifecycle, per-request admin-status guard, RBAC write-gates (fail-closed in prod) + transactional role swap, tenant invite for brand-new users, expanded auth/session/recordtoken test coverage.

Verify a download: shasum -a 256 -c checksums.txt

permalink ↗

Use all CPU cores on full-collection scans

Full-collection reads — the REST record-list handler and the storage.Find/Count helpers — now decode CBOR document bodies in parallel across all available cores, while applying predicates sequentially so results stay in key order. On an 8-core machine a 20k-document scan is ~3.4× faster; small collections and single-core hosts are unchanged (no regression).

• New optional RAILBASE_MAXPROCS / --maxprocs to pin the OS-thread cap (default 0 = auto). Go 1.25+ already detects the CPU count and honours a container's cgroup quota, so auto is correct almost everywhere — this only lets you deliberately pin it.
• Startup now logs detected logical cores + effective GOMAXPROCS.

No config or on-disk format changes — drop-in upgrade from v0.5.13.

Verify a download: shasum -a 256 -c checksums.txt.

permalink ↗

Every transactional email path is now guaranteed to send, proven via MailHog (12 flows green end-to-end), and unified onto a single DRY enqueue path (`jobs.EnqueueEmail`).

Gaps closed (created a token/record but never emailed):

• App-user invite — now sends the `invite` template per invitee.
• 2FA recovery codes — `2fa_recovery` was never sent; now emailed at TOTP enroll-start + regenerate, on both admin and app-user surfaces.
• Tenant member invite — new `tenant_invite` template + send.

Bug fixed: admin forgot-password refused with "mailer is not configured" whenever the mailer was env-configured or dev auto-detected (it trusted only the `mailer.configured_at` flag). It now gates on the live mailer's actual delivery capability.

Unification: auth flows (password reset / verification / email-change / OTP) moved from in-handler sends to the async, retry-backed queue — no more 500s on a transient SMTP hiccup. Welcome / admin-broadcast / new-device payloads now share one wire contract.

Full audit + matrix: docs/MAILER-AUDIT.md. 85 Go packages pass.

Verify downloads against `checksums.txt`.

permalink ↗

• CLI: persona-first launcher — bare railbase leads with Start Railbase (serve) as the Enter-default; New project (init) is the explicit developer fork. The serve ready-banner now points operators at the Marketplace (no code needed).
• Mailer: works out of the box in dev — auto-detects a local SMTP catcher (MailHog/Mailpit).

Verify your download: shasum -a 256 railbase_* against checksums.txt (also at https://railbase.app/dl/checksums.txt). One-line install (macOS/Linux): curl -fsSL https://railbase.app/install | sh.

permalink ↗

Bug-fix / hardening release. No new features; safe in-place upgrade from v0.5.10.

Admin panel

• Invite & password-reset links now use the server's real host instead of a hardcoded localhost — fixes "can't invite users" on deployed sites.
• Records data grid shows the real row count and working pagination (was stuck at "0 record(s)" with dead paging).
• Record save errors surface the server's real reason instead of a generic "Save failed."
• Notifications work on the Vault store again (an index key exceeded Vault's 64-byte document-id cap → notifications were silently dead).
• Tenants list/restore, digest-preview, and files-list decode fixes (CBOR/JSON mismatches).
• Webhook HMAC secret is no longer returned on list (display-once enforced).
• RBAC role-set updates no longer leave a stale role on rollback; cron missing-schedule returns 404.
• Admin user-management for the built-in _users collection (invite + list) fixed.

Security

• CSP frame-src allows the vendor origin so in-app marketplace install works.

Quality

• Backed by a new 4-layer admin test suite (Go L1 + vitest L2 + Playwright L3 + auth-matrix L4), now gating CI.

SHA-256 checksums in checksums.txt (also at https://railbase.app/dl/checksums.txt).

permalink ↗

Core v0.5.10 — guided CLI launcher.

Running the bare railbase binary at a terminal (no subcommand) now opens a small menu — New project / Run the server / Build / All commands — instead of printing all ~28 subcommands. Picking an action runs it (New project → the interactive scaffold wizard; Run → serve; Build → build); "All commands" shows the full CLI, which stays reachable by name as before.

Strict no-op for non-interactive use: scripts, CI, container entrypoints, railbase <cmd>, --help and --version are unchanged (bare + non-TTY still prints help).

Same data-resident plugin model + pinned plugin key as v0.5.9; binaries unsigned (signing deferred).

permalink ↗

Core v0.5.9 — site-shell login fixes + interactive railbase init.

Site shell (served at /)

• App-user login now targets the correct built-in auth collection _users and offers self-serve signup, so a freshly downloaded core is usable from the / site without the admin hand-creating a user first.
• Login uses the UI-kit PasswordInput (show/hide) instead of a bare input.

CLI

• railbase init is now interactive (the npm create vite model): run it with no flags at a terminal to choose the project name + template (backend only / + Vite·Preact frontend / full-stack). <name> --template flags still work for CI / non-interactive runs.

Data-resident plugin model unchanged (same pinned plugin key) — plugins install from the marketplace as before. Binaries are unsigned (Authenticode/Azure signing still deferred).

permalink ↗

Data-resident plugins gain a UI and cross-plugin symbiosis — a downloaded core now serves a site at / and renders an installed plugin's pages with no rebuild.

• Site shell at /: the core embeds + serves a Preact/Tailwind site (login is settings-driven from the enabled auth methods; a launcher lists installed plugins). An embedder's own ServeStaticFS("/") still wins.
• Plugin UI on install: a plugin ships a widget descriptor; the core serves it (license-gated) at GET /api/plugins/{slug}/ui and the shell renders it at / — table/list/form/upload widgets bound to the plugin's own verbs (auth + tenant enforced server-side). Install refuses a colliding/reserved mount; nothing is codegen'd into customer files.
• Cross-plugin symbiosis: $app.onEvent(topic, fn) (consume, per-event VM) + $app.emit(topic, payload, tenant) — a data-resident plugin can react to and drive domain events.

Binaries pin the vendor key set + lock the marketplace to railbase.app. Verify downloads against checksums.txt.

permalink ↗

Data-resident plugins: the core now installs plugins as encrypted, license-gated JS bundles in its own Vault and runs them in the goja runtime — no 33 MB out-of-process binary, no extra port, no subprocess.

• Marketplace install path branches on kind:"js" AFTER verifying sha256 + Ed25519 + the min_core gate, then lands the bundle via installPlugin and remounts routes live (no restart).
• uninstall removes the catalog row but KEEPS plugin data.
• Plugin code is AES-256-GCM encrypted at rest (release pins the key); a dormant/unpaid plugin's code is never decrypted.
• translate is the first plugin to ship this way (its standalone binary is retired); the in-process Register path stays for embedders.

Binaries pin the vendor key set + lock the marketplace to railbase.app. Verify downloads against checksums.txt.

permalink ↗

Core fixes shipped since v0.5.5 (all field-found, all with regression tests):

• realtime: strict-mode SSE no longer erases plugin domain-event payloads to {"action":"","record":{}} — non-RecordEvent topics pass through natively. Unblocks live frontends for chat/link/ptp/inventory events.
• plugin-manager: the OOP realtime uplink now routes through the realtime broker, so an out-of-process plugin's domain events reach browser SSE exactly like an in-process build (ADR-001 deployment invariance). Required by railbase-link.
• serve: --vault-path / RAILBASE_VAULT_PATH is honored (previously the server always opened /railbase.vault while the CLI honored the flag — the two could silently operate on different files).
• boot: runtime-created users auth collections survive restarts (the legacy demote no longer eats operator-created collections); hydration is logged; create/update read-back-verify persisted specs.

permalink ↗

Quality hardening release — closes the 2026-06-11 audit findings across the core and the embedded vault engine (v0.0.5).

Vault engine (embedded):

• Compaction is now fully isolated: concurrent commits can no longer be lost during Compact(), live readers are drained before the file swap, and the copy walks the tree via cursor (immune to stale sibling links).
• Real crash-safety proof: the test suite now kills a writer process with SIGKILL mid-commit and verifies zero acknowledged-commit loss plus torn-meta recovery.
• B+tree delete/merge path hardened (errors propagated, byte-balanced splits) with a 3000-key merge-storm test.

Core:

• Realtime is a strict read projection: secret columns (password_hash, token keys) are redacted from every event; per-subscriber authorization preserved for deletes; fan-out no longer serialized.
• Finance plugin verbs require authentication; money is an overflow-checked integer-cents primitive end to end.
• Payments require an idempotency key — HTTP retries can no longer double-post journal entries.
• Tenant-scoped record loads guarded across all plugins (no cross-tenant reads by ID).
• Exports honor active filters; admin endpoints fully migrated off the legacy SQL shim.
• Legacy /papi proxy retired — the canonical /api/<slug>/* surface (ADR-001) is the only verb route.

SHA-256 manifest: checksums.txt (verify with shasum -a 256 / certutil -hashfile <file> SHA256).

permalink ↗