Actions + Routes:
- Per-action discriminated body validation (oneOf, AJV enforced)
- Zod v4 / JSON Schema / legacy field-map action schemas
- Actions in OpenAPI, MCP, and registry
- Route-level mcp config honored (mcp: false, annotations)
- buildActionBodySchema single source of truth
- actionPermissions fallback in OpenAPI auth detection
- routeGuards on defineResource (resource-level preHandlers)
- defineGuard typed context extraction helper
- handleRaw envelope wrapper for raw routes

Outbox:
- OutboxStore expanded (claimPending, fail, write options)
- relayBatch with RelayResult, publishMany support
- exponentialBackoff retry helper
- OutboxOwnershipError, InvalidOutboxEventError, onError callback
- Terminology: delivered/deliveredAt canonical

Repository:
- CrudRepository<TDoc> canonical contract
- Hard delete forwarding, keyset pagination
- RepositoryLike expanded, conformance test (31 tests)

Idempotency:
- MongoIdempotencyStore first-lock fix (upsertedCount)
- ensureIndex lazy retry from write paths
- tryLock error discrimination (E11000 vs infra)
- Redis unlock TOCTOU fix (Lua script)
- Plugin integration test (8 tests)
- TTL cleanup test (real Mongo TTL monitor)

DX:
- resourceDir on createApp
- fieldRules → OpenAPI parity
- ErrorMapper export
- Export smoke tests (dist artifact validation)

Deps:
- @fastify/multipart 9 → 10
- better-auth 1.6.2, biome 2.4.11, knip 6.4.1, qs 6.15.1

278 test files, 3844 tests passing