v3.2.4

Fixes

• Fix primo push 300s timeout on content-heavy sites (#1200). The import was doing a per-record delete-and-recreate of all content entries on every push, and every entry Save triggered PocketBase relation-existence validation — ~33,000 SQL statements for a 44-page site, enough to blow Railway's un-raiseable 300s edge timeout. Redundant import work is now skipped so pushes stay well under the limit.
• Make file→CMS upload sync idempotent (#1203). Every push re-uploaded unchanged images: an already-suffixed upload picked up another hash suffix and a fresh site_uploads record each time, orphaning the prior one and growing a single image into many byte-identical duplicates — pushes resent everything until they aborted. Reconcile now matches incoming uploads by content hash first (filename second), so an unchanged image is a no-op regardless of the name sent, and bootstrap returns created_ids so the CLI's first push can write back canonical names.
• Don't drop link fields while the referenced page is still loading (#1199). A link field to an unloaded page was omitted entirely, so blocks reading link.label/link.url crashed until the page happened to load. It now emits a well-formed link object immediately (empty safe_url until resolvable) and lets reactivity fill in the URL.
• Harden on-page repeater matching against entry reorder (#1201). On-page edits to repeater subfields could bind to the wrong row and appear to revert when storage order diverged from render order (after a row reorder or CLI re-import). Matching no longer relies on entries arriving in render order.

Changes

• Enable daily backups by default on fresh deploys (#1202). A new deploy now gets a default 0 3 * * * schedule (keep 7), overridable via PRIMO_BACKUP_CRON and never clobbering a schedule set in the admin UI. Backups land on the pb_data volume — a floor, not off-site protection; configure Backups.S3 for durable backups.
• Publish the :latest Docker tag explicitly, and document it for Railway (#1197). :latest now reliably tracks releases rather than being an implicit side effect. Railway/self-host deployers should follow ghcr.io/primocms/primo:latest for auto-updates — the one-click template's :main is a rolling build, not a release.
• Move the version label out of the editor toolbar into the profile popover (#1196). It now reads as a subtle muted line in the dashboard sidebar dropdown instead of sitting prominently next to the publish controls.
• Remove dead SSH deploy jobs from CI (#1195). Both jobs SSHed to the retired palacms.com host and failed on every release tag / every push to main; images are still built and pushed to ghcr.
• Ignore local-only internal/SPEC-*.md design specs (#1198).