1.18.0 — Money, tenancy and the nightly

Release summary. 147 changelog sections since 1.17.0 (2026-08-31): PRJ-01…PRJ-04, PRJ-07,
PRJ-08, PRJ-10 and PRJ-13 (PRJ-05, -06, -09, -11, -12, -15 and -16 are still queued). Almost none is a new surface: most are places where the product stated
something it had not checked, found by measuring production or by re-reading the code
against its own scenarios. The load-bearing ones:

• LLM spend is bounded in dollars. Nothing bound it before: the per-account OpenRouter
  key was minted and never presented to the provider, and the plan's token ceilings were
  reset to unlimited on every boot. Dollars are the gate now (ADR-0004), tokens the
  backstop, and money stopped being a float.
• Tenancy holes closed. A project viewer could write to the customer's database through
  SSH-exec (psql meta-commands), an unverified account could accept someone else's
  invitation, a chat session with no owner belonged to everybody, one webhook secret
  authorised every tenant, and the DNS-rebinding guard ran at save but never at connect.
• The nightly index had been dying for a month. index_repo completed 16 times in 94
  runs — the vectors lived on the dyno's ephemeral disk, a heartbeat ticked the wrong row,
  and one expression made graph construction O(E×(V+E)). pgvector, one heartbeat, and a
  document cache that took generate_docs from 9 375 s to 2 687 s.
• The orchestrator's decisions are measured. Routing accuracy 98.89% on production's
  model, gated in CI; result gates scored against their contract; an online report of
  what production did.
• The integration suite runs on PostgreSQL, and its first run found a production defect
  — the assistant's message failed to save after a swallowed error on the request session.
• 26 of the oldest UX scenarios re-verified, 17 defects fixed, among them a background
  task that could spin for ever and a "Request sent" for a request that went nowhere.

Upgrade notes: migrations run in the release phase; embedding and graph-schema changes
reindex themselves at boot. PLAN_GRANTS must be set on a deployment with billing on and
no Stripe keys, or scheduled work stops (see CLAUDE.md → Billing & entitlements).