Certified by two full 36-phase release-gate runs (2026-07-18/19) at 4b72b9b — zero product blockers after triage.
Highlights
Tag-loss classes closed:
- Create-race not-found (#114): resources whose tag call raced their own provisioning (burst creates) were permanently untagged; not-found errors within 10 min of eventTime now retry.
- Broken day-2 config (CT6-005, #117): malformed SSM config now retries into the DLQ + alarm instead of silently acking every in-scope event.
- 13 handler fixes from golden-event replay verification, plus a coverage gate: all 158 handler branches live-tagged, replayed, or ledgered — CI-enforced.
Deploy/preflight hardening:
- Org migration no-op (CT6-004, #118): the documented v21→v22 org migration could deploy zero taggers while printing success — now fails loudly with remediation.
- SCP preflight fixed for role/SSO callers (#123): the tag:TagResources SCP check silently never ran for assumed-role deployers.
- Per-account CloudTrail preflight (#112), derived-IAM-name length validation (CT6-006, #115), StackSet peer detection (CT6-007, #115).
Operational fixes:
- Centralized per-region SNS alerts for org deployments (#108) + CT6-003 KMS fix (alerts were silently dead in v21/v22.0.0).
- Backfill time budget (#116) + wait-sentinel fix (#121 — no more guaranteed 20-min idle burn).
- delete.sh exit-code fix (#120), delete-form MPE truncation fix (#113).
Upgrading
Single-account: re-run deploy.sh or use upgrade.sh. Multi-account org deployments migrating from v21: follow INSTRUCTIONS.md — the admin stack must be deleted before re-deploying (see CT6-004 notes).
Full details in CHANGELOG.md.