sporades 0.9.32 → 0.9.35

package/CHANGES.md

@@ -1,55 +1,29 @@
 # Changes
 
-## Unreleased - 2026-10-13
+## Unreleased - 2026-10-20
 
-Changes since v0.9.31.
+Changes since v0.9.34.
 
 ### 🚀 Features
 
-- Add pinned monitoring release acceptance verifier (#229) (872f33866).
-- Add admission lifecycle proof harness and human verification handoff (#221) (9e4608535).
-- Add resource and API-performance alerts (#222) (0dc656b53).
-- Add inventory-driven availability alerts and recoveries (#204) (803ca6060).
-- Support validated Auto-Submitted on send (#220) (40d3317ec).
-- Add safe monitoring maintenance and fresh restore (#213) (6542368d1).
-- Add bounded telemetry outage recovery and pipeline visibility (#207) (fc04b41b3).
+- Add atomic human identity termination (ADR 0057) (#273) (769df876).
+- Add day-based Host backup retention (retentionDays / keep-within) (#275) (3724e2ad).
+- Allow loopback Stripe API origins in Dev sessions (#270) (57a9aec3).
 
 ### 🐛 Bug Fixes
 
-- Bump for vulns (f68221783).
-- Prevent favicon 404s in new scaffolds (#219) (d44aa0970).
-- Offer only supported OAuth sign-in actions (#215) (1977b8e49).
-- Cache hashed public assets immutably (#186) (871540c2f).
+- Fix runtime injection on secondary HTML documents (#274) (91e06995).
 
-### 📝 Documentation
+### 🔧 Improvements
 
-- Complete admission lifecycle evidence and restore Hosted stats (#227) (ffa5eb6d5).
-- Preserve Collector asset modes under systemd umask (#224) (c3a6e6e65).
-- Diagnose and migrate Host monitoring connections (#212) (e9c635e6f).
-- Expose bounded, redacted admission evidence (#218) (4ac66e837).
-- Stabilize public-tree staging and PDF deadline tests (#217) (7753267cd).
-- Apply admission before WebSocket upgrades (#214) (1897d6932).
-- Stabilize Dev ClamAV framed readiness on macOS (#216) (312e55e26).
-- Scope Postgres and libsql live query refreshes by table (#202) (e23007e82).
-- Complete canonical non-address HTTP admission matching (#210) (bdfe6d872).
-- Enforce bounded fixed-window quotas for trusted admission clients (#211) (b7bbd3f13).
-- Rotate and revoke per-sender telemetry credentials (#203) (789b4862a).
-- Establish trusted Hosted client-address admission (#209) (b274551d2).
-- Trace outbound fetch dependency time (#199) (d243884f2).
-- Enforce exact-path HTTP denial before Capsule routing (#193) (3e59f8862).
-- Trace individual WebSocket operations and connection activity (#198) (4473caeac).
-- Complete malformed request liveness coverage (#201) (2e8c02038).
-- Automatically synchronize Host lifecycle inventory (#195) (f7b35cbbc).
-- Trace durable Job attempts and queue pressure (#200) (b4042ce8d).
-- Trace authentication and File operations within HTTP requests (#197) (d37a224fd).
-- Trace database time within Capsule requests (#196) (9e92f0fa0).
-- Publish deployer-owned read-only admission policy generations (#189) (45066b7a2).
-- Support project public assets across Capsule sessions (#188) (de6806ed3).
-- Verify multipart limit diagnostics over real HTTP (#185) (1b8dfd77f).
+- Bump ignore (b2e1be97).
 
-### 🧪 Tests
+### 📝 Documentation
 
-- Make the connection-lost screen clear and actionable (#226) (6cf8993a9).
+- Ship a stateful Stripe Team Billing fake (#269) (bceed0bc).
+- Propose a supported Team Billing test-provider boundary (ADR 0058) (#268) (e62eaf87).
+- Propose atomic human identity termination in ADR 0057 (#267) (29995233).
+- Forbid Compose merge keys and value-bind Host elevation in ADR 0056 (#261) (edf701a6).
 
 ## v0.9.11 - 2026-09-02
 
@@ -151,3 +125,6 @@ generated artifacts, and documentation.
 
 
 
+
+
+