v0.9.0

• Compile the CLI from a closed-world registry of 17 commands and 23 shapes, so an invocation runs only when it matches one registered shape and illegal argument mixes become parse-time errors: connection arguments are no longer globals, arguments must follow their subcommand, --explain takes a plan|analyze value, and every rejection carries a typed cli_* error code
• Replace the nine --*-secret[-env|-config] flags with three typed source arguments --dsn, --conninfo, and --password, each accepting a literal, env:NAME, file:PATH#DOT_PATH, or literal:VALUE, so a malformed source is refused rather than partially interpreted
• Close the pipe-mode write hole: begin now asserts a write-family permission, read_only defaults to true, and every query inside a read-write transaction must repeat the write permission, where previously three JSONL lines with no permission field could delete rows
• Scope container transport flags to one flag per (driver, option) pair, retiring --container and --container-driver along with the runtime compatibility matrix, so an option a driver does not have cannot be written and two driver families are rejected by name
• Carry SSH transport entirely over the ssh child process's stdio bridge, removing the local TCP listener so no other process on the workstation can reach the connection, and keep the bridge source valid on Python 2 where socket errors are not OSError
• Restore the row-encoding fallback on the explicit-transaction paths so EXPLAIN and SHOW run again, and report the narrower decoder as a structured query.row_encoding_degraded log event instead of a Rust Debug dump, starting the streaming sink only once the wrapper is known usable
• Bind bare null, true, and false --param values as JSON primitives, with a text: prefix to force the literal string
• Run the release gate itself in CI with the container end-to-end suite folded into all, and fix the release smoke script handing MSYS paths to a native Windows binary, which failed the write-permission assertion and made the SQL-file and secret-canary checks pass without opening their files
• Upgrade to agent-first-data 0.29.2 with default features off and only the needed document formats enabled, routing raw help and docs output through afdata's write_raw