@plumbus/core 0.8.0-beta.2 → 0.8.0-beta.5

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # @plumbus/core changelog
 
+## 0.8.0-beta.5 — 2026-09-20
+
+### Fixed
+
+- Polling flow workers acquire one lease at a time, bound each cycle by the configured batch limit, and prevent overlapping polls from reclaiming waiting work.
+- Static capability and HTTP queued-job access checks precede input parsing, preventing unauthorized schema disclosures. Input-aware hooks still receive parsed input.
+- `migrate apply` exits unsuccessfully on migration, preflight, database-selection, creation, and connection errors while preserving connection cleanup and JSON diagnostics.
+
+## 0.8.0-beta.4 — 2026-09-17
+
+Repository tag `v0.8.0-beta.3` already pointed at the format-only commit and no `0.8.0-beta.3` package was published, so this increment is `beta.4`.
+
+### Added
+
+- **Approval request cancellation.** `ApprovalService.cancel({ requestId, auth, reason })` withdraws a still-pending request after human-actor and host-authorization revalidation, records cancellation actor/reason evidence, and atomically cancels linked open/claimed human tasks without creating an approval decision. Durable tenant migration `0002_approval_cancellation.sql` adds the evidence columns. Docs: [Approvals](../../docs/core-concepts/approvals.md).
+
+### Fixed
+
+- **Tenant flow heartbeats extend the authoritative spine hint.** A long-running tenant-placed step now extends its guarded `opaque_dispatch` lease before extending the tenant `flow_executions` lease. A stale worker cannot extend or acknowledge a hint owned by a peer, so a healthy step is not re-dispatched when the original spine lease duration elapses.
+- **Flow retry policies now schedule their declared backoff.** A failed step with retries remaining moves to `waiting`, releases its lease, and is claimable only at its computed fixed/exponential `wakeAt`. Tenant-placed flows persist `retry-scheduled` execution state, a retry wait, and a future-dated dispatch outbox row in one tenant transaction before acknowledging the inbound spine hint.
+- **Dispatch outbox and execution state use the framework schema.** The event pump and durable writers resolve `dispatch_outbox` / `execution_state` as `frameworkSchema ?? PLUMBUS_FRAMEWORK_SCHEMA ?? FRAMEWORK_SCHEMA` and no longer qualify those tables by the plane handle's `coreSchema` (that name is for tenant entity tables). Server and worker bootstraps pass `frameworkSchema` through to the engine and pump. Audit metadata with NUL bytes is named instead of rejected by jsonb.
+
 ## 0.8.0-beta.2 — 2026-09-16
 
 ### Added