v2.6.3

A patch release that fixes the eight medium-severity issues found by the independent audit of v2.6.0. No new features and no upgrade steps - the same limits you already configured are now enforced in a few places that used to have gaps.

• Quota and export ceilings are now enforced atomically with the bundled store. Before, a slow store let parallel requests slip past each other and overshoot the cap. Checking and recording is now a single step.
• CSV exports are now charged like JSON exports. A CSV body used to price at zero by accident - in a live test it pulled 150 records through a ceiling of 60. Now every export format pays the same way.
• An action with no declared price is refused instead of free. If your app forgot to price an action, it used to run free forever. Now it is refused until it has a price (or you set a fallback price).
• A crashing host callback no longer loses a warning flag. If your notification handler threw an error, the flag used to vanish. Now it is kept and delivered again at the next touch.
• A NaN input no longer locks a user group forever. One malformed number used to poison a group's counter until restart. Now it is refused on the spot and the counter heals itself.
• Tracking memory is capped and cleans itself up. Per-identity tracking state now has a size limit and evicts the least active entries, instead of growing forever.
• Calibration rotation now really resets scores. When an evidence window rolls over, old scores and contributions are actually cleared - before, they lingered and could re-flag a group instantly.
• The test suite grew to prove it: 338 tests, 336 passing, including 16 new tests that all fail on the pre-patch code.

Full technical write-up: v2.6.3 deep dive. The clock hardening in v2.6.2 is covered in the v2.6.2 deep dive and the changelog.