v1.1.0

1.1.0 — 2026-09-16

Support-window release: the Elixir floor rises to 1.20 (a minor, not a
major, by ADR-0010 rule 4 — the first exercise of that rule), the
repo's own toolchain becomes self-enforcing and lockstep-pinned, and
dependencies sit at latest with mix hex.audit running in CI.

Changed

• The supported Elixir window is now ~> 1.20 (was ~> 1.17) —
  nothing below Elixir 1.20 is supported, by owner decision; the OTP
  floor is 28 (CI tests 28 and 29). Consumers on 1.17–1.19 get a
  resolver-level refusal instead of a compile. ADR-0010 rule 4 makes a
  supported-floor bump a MINOR release, so a ~> 1.0 pin resolves
  1.1.0 and then fails resolution on old Elixirs — pin
  {:ash_hooks, "~> 1.0.4"} until you can move (see UPGRADING.md). CI
  tests the window on Erlang/OTP 28 (the dev default, pinned in
  .tool-versions and mirrored by a dedicated leg) and 29; the floor
  leg drops the lock and resolves at the floor to keep the requirement
  honest.
• Repo-local toolchain enforcement — consumers are unaffected: config/
  is excluded from the hex tarball. Development runs on one pinned
  toolchain (.tool-versions: Elixir 1.20.4 / Erlang/OTP 28) mirrored
  by a dedicated CI leg; config/config.exs refuses any OTP release CI
  does not test (currently 28/29) before anything compiles, because
  System.version/0 does not encode the OTP build and a same-Elixir
  foreign build would otherwise compile incompatible BEAMs silently.
  The window, .tool-versions, the OTP allowlist, and the CI matrix
  move together in ONE commit. mix hex.audit now runs in CI on every
  push.
• Dependencies moved to latest (mix hex.outdated shows zero "Update
  possible"): oban 2.23.1 → 2.24.1, dialyxir 1.4.7 → 1.4.8, ex_doc
  0.40.3 → 0.40.4. mix hex.audit clean before and after (and OSV shows
  no advisories against the three new versions).

Fixed

• A %Regex{} inside a module attribute (@redaction_patterns) embeds
  the compiled re_pattern, which is a reference on OTP 28 — Elixir
  < 1.19 cannot escape references when injecting an attribute into a
  function body, so the package did not compile for consumers on
  1.17–1.19 × OTP 28 (a combination the old window admitted). The
  patterns are now built by a defp (identical regexes, flags, and
  order); with the floor now at 1.20 that combination is out-of-window,
  and the defp keeps the escape class dead if the floor ever drops
  below 1.19.
• mix dialyzer on a fresh PLT no longer reports 13 unknown-function/
  unknown-type warnings in test/support: use AshSqlite.Repo emits
  Ecto.Adapters.SQL delegations, and the deps-PLT app enumeration does
  not reliably include :ecto_sql — it is now explicit in
  plt_add_apps with the reason inline.

Added

• scripts/check-currency.sh: exits nonzero whenever mix hex.outdated
  shows resolvable drift, and prints the packages whose latest release the
  resolver will not take under current requirements — each of those must
  carry an inline deliberate-pin reason in mix.exs. Fail-closed: an
  errored hex.outdated run (lock mismatch, resolver failure) also exits
  nonzero.