v0.58.7

fix(taxonomy): reject trailing JSON and oversized admin request bodies.

v0.58.6

fix(media): round token expiry safely at second precision and reject fractional reader windows.

v0.58.5

fix(media): allow hosts to disable generic download URLs by content kind while preserving governed grants and default behavior.

v0.58.4

fix(search): quarantine invalid search documents by dirty-queue revision.

v0.58.3

Fix discovery fallback to fill from secondary candidates after tenant, kind, anchor, seen, disliked and duplicate filtering. Preserve primary order, error reporting and popularity fill. See #111.

v0.58.2

Fix post reaction counter drift: generic and dedicated post reaction routes now update the canonical reaction, rollup, and post totals in one transaction. Both endpoint response shapes and the generic access gate remain intact. Regression coverage includes route order, repeated and concurrent requests, draft/held/scheduled posts, and other content interactions. See #110.

v0.58.1

Fix: the S3 capability probe treats a 412 on its If-Match step as a clean refusal, so backends that ignore If-None-Match: * (Ceph RGW) record ConditionalPut=false and Check succeeds. On v0.58.0, Check never succeeded on RGW: statusz showed s3 down, and the media worker never started taking jobs. Verified against a real RGW (#109).

v0.58.0

External dependencies never block (#108, contentkit #77).

• S3 capabilities are probed lazily; only clean results are recorded. The manifest Locker is mandatory, and If-Match is used once probed. S3 errors return 503.
• The media worker waits in-process and reports on statusz. Each bucket check has a 10s deadline. Jobs snooze only on a confirmed outage, capped at one day (MaxOutageSnoozes); timeouts and broken objects spend their attempts.
• Breaking: worker.New and cmd/media-worker no longer migrate. Hosts run workqueue.Migrate in their migrate step.
• The moderator has a half-open circuit breaker (CheckModerator). Personalized search falls back to unpersonalized.

v0.57.0

Subtitle sidecars (#101, contentkit #74).

• Uploaded SRT/SSA/ASS/VTT files attach to a video (meta.for, which follows renames) and become WebVTT subtitle tracks in its HLS master. Playlists are built per request, so the video is not re-encoded.
• Text is decoded to UTF-8 (BOM/UTF-16/32; legacy CJK only on strong evidence, Cyrillic, else Windows-1252).
• A single sanitising pass rebuilds every WebVTT output, sidecars and source tracks alike: only //, allowlisted cue settings, no STYLE/REGION/NOTE.
• Size caps: sidecars are checked with Head before download, and oversized source text tracks are skipped.
• Source text tracks have their own subtitle spec, so subtitle changes reprocess only subtitles.
• SDK: sidecar uploads complete in UploadQueue. The gallery focus test is now deterministic.

v0.56.0

Native audio (#99, contentkit #73).

• Kind.Audio: an uploaded audio file becomes AAC-LC 128k, 48 kHz stereo HLS (fMP4), with an M4A variant and download.
• Optional EBU R128 normalisation as a linear gain: volume = min(target − I, −1.5 − TP). It downmixes before measuring, so 5.1 sources land on target.
• Audio runs on its own media_audio queue in the worker schema (MEDIA_WORKER_AUDIO_CONCURRENCY, default 2), so audio never waits behind video. KEDA should count media_video + media_audio.
• SDK: an audio gallery item (player, duration, download, music tile).