v0.12.0

Before you upgrade

This upgrade is one-way. Migrations run forward only. An older
binary opens a newer database without complaint and then runs every
destination with an empty stream key — enabled, live, publishing
nothing, with no error anywhere. Rolling back is not a supported
recovery path; restoring your backup is.

Back up the whole data directory, not just polyemesis.db.
Since 0.7.0 destination stream keys are sealed at rest with
secret.key. A database restored without that file comes back with
every destination disabled — by design, because a key that will not
open disables its destination rather than failing open. That restore
looks completely successful until someone goes live.

Re-run install.sh before upgrading an install older than 0.7.0.
update.sh and uninstall.sh are written to disk when you install,
so an older install is running older helpers — including one whose
backup check does not know to look for secret.key. Re-running the
installer regenerates them. See
docs/UPGRADING.md.

Windows is tested, not operated. One known unresolved defect:
recordings are truncated on service stop. (#440, the intermittent Go
runtime abort, was fixed in 0.9.0.) See
docs/INSTALL.md.

Verify your download against SHA256SUMS, published below, and
that this project's release workflow built it with
gh attestation verify <file> --repo rainmanjam/polyemesis. See
docs/INSTALL.md.

---

What's Changed

• Post-0.11.0 backlog: audit fix, stop-generation race, stall baseline, lock-order coverage, verified PromQL by @rainmanjam in #871
• chore(deps-dev): bump the dev-tooling group across 1 directory with 5 updates by @dependabot[bot] in #864
• chore(deps): bump motion from 13.4.0 to 13.4.4 in /web by @dependabot[bot] in #866
• chore(deps-dev): bump the dev-tooling group across 1 directory with 4 updates by @dependabot[bot] in #863
• chore(deps): bump astro from 7.3.3 to 7.3.5 in /web by @dependabot[bot] in #865
• chore(deps): bump motion from 13.4.1 to 13.4.4 in /ui by @dependabot[bot] in #867
• chore(deps): bump @astrojs/markdown-satteri from 0.4.1 to 0.4.2 in /web by @dependabot[bot] in #868
• chore(deps): bump lucide-react from 1.47.0 to 1.48.0 in /ui by @dependabot[bot] in #869
• October maintenance: fix main's red security/ci (Go 1.27.2 + npm advisories), failover header, settings copy, site screenshot, motion 14 by @rainmanjam in #894
• chore(deps): batch the October Dependabot updates by @rainmanjam in #895
• UX overhaul: 34 UX Council findings, Stream Deck plugin, live track mute and gain by @rainmanjam in #915
• fix(automod): a model verdict missing abusive or confidence is a failure, not a pass by @rainmanjam in #922
• chore(deps): bump go-chi/chi to v5.4.0 (GHSA-j6qf-3m9c-vwj3) by @rainmanjam in #923
• UX Council: close the remaining gaps (B2 B3 A1 A2 A5 A6 A7 A8 A14 A17 A18 A19 S1 S5 S7) by @rainmanjam in #924
• fix(oauth): turn on PKCE for Twitch now that Twitch advertises S256 by @rainmanjam in #926
• UX follow-up: ingest uptime on the shared listener, header chip and preset defaults per programme by @rainmanjam in #927
• Wave 1: failure reasons, events API, Grafana, MCP server, chat overlay by @rainmanjam in #925
• Site: positive banner and comparison framing by @rainmanjam in #928
• chore(deps): batch the late-October Dependabot updates by @rainmanjam in #930
• Fix audio drift on destinations not restarted at a format-changing failover by @rainmanjam in #931
• FFmpeg 9.0.2 compatibility: installer download fix, 9.0/9.0.1 warning, compat CI by @rainmanjam in #929
• Wave 2: OBS bridge, broadcast delay, chat polls, SRTLA failover, automod model checkers, Stream Deck signals by @rainmanjam in #932
• test(obsbridge): fix the stream-event race in the emission test by @rainmanjam in #935
• Fix audio drift on multi-track destinations after a format-changing failover by @rainmanjam in #934
• fix(scripts): OAuth acceptance live step creates no broadcast by default by @rainmanjam in #936
• ui(platforms): label each credential pair in the platform console's own words by @rainmanjam in #938
• test(engine): wait for the whole drain teardown before reading the drained status (windows flake) by @rainmanjam in #939
• test(api): make the planted recordings a fixed point of the recording manager's scan by @rainmanjam in #940
• fix(engine): count restarts the live-gain path causes by @rainmanjam in #933
• chore: retire Trovo, which shut down on 30 June 2026 by @rainmanjam in #937
• UX overhaul: Settings redesign and app-wide council fixes (Phase 1 + 2) by @rainmanjam in #941
• chore(ffmpeg): require FFmpeg 8.0+; CI tests the latest 8.x and 9.x by @rainmanjam in #943
• Wave 3: X (gated), YouTube vertical, live captions, Twitch VOD track, recurring events, planned rollover + follow-up fixes by @rainmanjam in #942
• test(api): floor bcrypt in the engine-backed fixtures (internal/api -race 1260s -> 377s) by @rainmanjam in #944
• feat(chat): automod flags and sanction state readable on Chat (UX Council A48) by @rainmanjam in #945
• fix(ui): rollover panel reads its programme off the card, not a second GET by @rainmanjam in #947
• Wave 4 #9: public player upgrades (UX, offline card, QoE beacons, HEVC/AV1 fallback) by @rainmanjam in #946
• fix: deliver the stdio relay's refusal answer; bind the srtla dual-stack test to an explicit port by @rainmanjam in #952
• ci(streamdeck): validate and pack the plugin, attach it to releases by @rainmanjam in #948
• Wave 4 #10: S3-compatible offload (mirror mode) + CDN-ready player origin by @rainmanjam in #949
• Wave 4 #4: cross-platform analytics (sampler, live panel, per-stream report, Prometheus/MQTT/CSV, Stream Deck Viewers) by @rainmanjam in #950
• Broadcast delay: Dump, and Cut now on the Stream Deck (#11) by @rainmanjam in #951
• fix(scripts): test-in-docker.sh derives its Go image from go.mod by @rainmanjam in #954
• chore(deps): November batch of safe minor/patch updates and digest pins by @rainmanjam in #955
• fix(ffmpeg): escape filter values at both filtergraph levels on the live path by @rainmanjam in #956
• Wave 4 #5a/#5b: highlight suggestions and vertical shorts in the clip editor by @rainmanjam in #953
• Installer: install caption fonts (fontconfig, DejaVu, Noto CJK) in binary mode by @rainmanjam in #957
• ci: save caches on main only, upload suite logs on failure only by @rainmanjam in #958
• fix(alerts): route Notifier.Flush through the run loop while Run is live by @rainmanjam in #959
• fix(api,recording): root-cause two macOS internal/api flakes by @rainmanjam in #961
• design: broadcast palette tokens (console + website) by @rainmanjam in #960
• Fix five flaky tests at their causes; stop the job tier before the store closes by @rainmanjam in #962
• site: design-review quick wins (rows 3–6, 9, 10, 12, 20–24, 26) by @rainmanjam in #963
• site: one card grid, aligned to the column on every page by @rainmanjam in #965
• design: console quick wins from the 2026-11 design review by @rainmanjam in #964
• test: stop Go tests depending on host free disk, the startup-sweep race and a leaking media.Exec by @rainmanjam in #966
• feat(clips): publish a clip or short to YouTube Shorts or TikTok (Wave 4 #5c) by @rainmanjam in https://git...

v0.11.0

Before you upgrade

This upgrade is one-way. Migrations run forward only. An older
binary opens a newer database without complaint and then runs every
destination with an empty stream key — enabled, live, publishing
nothing, with no error anywhere. Rolling back is not a supported
recovery path; restoring your backup is.

Back up the whole data directory, not just polyemesis.db.
Since 0.7.0 destination stream keys are sealed at rest with
secret.key. A database restored without that file comes back with
every destination disabled — by design, because a key that will not
open disables its destination rather than failing open. That restore
looks completely successful until someone goes live.

Re-run install.sh before upgrading an install older than 0.7.0.
update.sh and uninstall.sh are written to disk when you install,
so an older install is running older helpers — including one whose
backup check does not know to look for secret.key. Re-running the
installer regenerates them. See
docs/UPGRADING.md.

Windows is tested, not operated. One known unresolved defect:
recordings are truncated on service stop. (#440, the intermittent Go
runtime abort, was fixed in 0.9.0.) See
docs/INSTALL.md.

Verify your download against SHA256SUMS, published below, and
that this project's release workflow built it with
gh attestation verify <file> --repo rainmanjam/polyemesis. See
docs/INSTALL.md.

---

What's Changed

• fix: resolve the bugs exploratory testing of v0.10.0 found by @rainmanjam in #838
• fix(engine): an idle shutdown no longer claims a wrong subscriber by @rainmanjam in #839
• chore(deps): bump modernc.org/sqlite from 1.58.0 to 1.59.0 in the go-minor-and-patch group across 1 directory by @dependabot[bot] in #824
• chore(deps): twelve dependabot bumps as one tested change by @rainmanjam in #840
• fix(ffmpeg): routed tracks survive a real failover outage by @rainmanjam in #841
• test(supervisor): the unknown-kind teardown test no longer races stray teardowns by @rainmanjam in #844
• fix(playout): switching playout.sourceId takes effect without a restart by @rainmanjam in #842
• fix(ingest): console-made sources keep their SRT encoder across the upgrade by @rainmanjam in #843
• test(ui): the session test waits until App is listening before sending a 401 by @rainmanjam in #846
• fix(status,metrics,alerts): a stalled destination reads stalled, and every falling_behind is closed by @rainmanjam in #845
• fix: every remaining staging-readiness row (combines #847–#854) by @rainmanjam in #855
• fix(install): an install stopped by a signal is rolled back, not reported as a success by @rainmanjam in #859
• chore(deps): bump github.com/bluenviron/gortmplib from 1.0.2 to 1.0.3 in the go-minor-and-patch group by @dependabot[bot] in #856
• chore(deps-dev): bump @types/node from 24.13.5 to 24.13.6 in /ui in the dev-tooling group by @dependabot[bot] in #858
• chore(dependabot): hold the CUDA line; take only digest updates of the pinned tag by @rainmanjam in #860
• fix(release): a rehearsal reports [Unreleased] instead of failing on it by @rainmanjam in #861
• release: date v0.11.0 (2026-09-24 UTC) and fold its upgrade notes by @rainmanjam in #862

Full Changelog: v0.10.0...v0.11.0

v0.10.0

Before you upgrade

This upgrade is one-way. Migrations run forward only. An older
binary opens a newer database without complaint and then runs every
destination with an empty stream key — enabled, live, publishing
nothing, with no error anywhere. Rolling back is not a supported
recovery path; restoring your backup is.

Back up the whole data directory, not just polyemesis.db.
Since 0.7.0 destination stream keys are sealed at rest with
secret.key. A database restored without that file comes back with
every destination disabled — by design, because a key that will not
open disables its destination rather than failing open. That restore
looks completely successful until someone goes live.

Re-run install.sh before upgrading an install older than 0.7.0.
update.sh and uninstall.sh are written to disk when you install,
so an older install is running older helpers — including one whose
backup check does not know to look for secret.key. Re-running the
installer regenerates them. See
docs/UPGRADING.md.

Windows is tested, not operated. Two known unresolved defects:
recordings are truncated on service stop, and #440 — an intermittent
Go runtime abort that ends the process mid-broadcast. See
docs/INSTALL.md.

Verify your download against SHA256SUMS, published below.

---

What's Changed

• docs: correct four defects found by a documentation review by @rainmanjam in #753
• fix(web): the site shipped screenshots eight days older than the docs by @rainmanjam in #754
• fix(web): two advisories published since the last green run by @rainmanjam in #767
• chore(deps): bump astro from 7.2.9 to 7.3.1 in /web by @dependabot[bot] in #765
• chore(deps): bump motion from 13.1.1 to 13.2.0 in /web by @dependabot[bot] in #763
• chore(deps): bump docker/setup-qemu-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #755
• chore(deps-dev): bump the dev-tooling group in /ui with 2 updates by @dependabot[bot] in #757
• chore(deps-dev): bump wrangler from 4.127.1 to 4.129.0 in /web in the dev-tooling group across 1 directory by @dependabot[bot] in #761
• chore(deps): bump the go-minor-and-patch group with 2 updates by @dependabot[bot] in #756
• chore(deps): bump lucide-react from 1.37.0 to 1.41.0 in /ui by @dependabot[bot] in #758
• chore(deps): bump hls.js from 1.7.1 to 1.7.2 in /ui by @dependabot[bot] in #759
• chore(deps-dev): vitest 5 across both workspaces, as one commit by @rainmanjam in #790
• fix(ui): twenty-one capabilities the server had and no operator could reach by @rainmanjam in #789
• feat(design): execute the design system — one palette, one type scale, both surfaces by @rainmanjam in #766
• docs(media): recapture every screenshot against the design system by @rainmanjam in #791
• fix(engine): a preview start whose hub vanishes kept its relay port by @rainmanjam in #792
• test(ports): draw test ports below the OS dynamic range (#752) by @rainmanjam in #793
• chore: refresh the GitNexus index counts by @rainmanjam in #794
• feat(web): automatic moderation on the features page, and a guard for claims by @rainmanjam in #795
• fix(ci): pick the newest whisper.cpp release that carries the binary by @rainmanjam in #797
• chore(deps): hold typescript 7 in web/, and close the standing red PR by @rainmanjam in #796
• test(engine): pin the invariant two unguarded Subscribe calls rest on by @rainmanjam in #809
• fix(capture): seed a mix-matrix destination, and correct two captions it exposed by @rainmanjam in #811
• chore(deps): bump the go-minor-and-patch group with 5 updates by @dependabot[bot] in #800
• chore(deps-dev): bump wrangler from 4.129.0 to 4.131.1 in /web in the dev-tooling group by @dependabot[bot] in #798
• chore(deps): bump @astrojs/markdown-satteri from 0.3.8 to 0.4.1 in /web by @dependabot[bot] in #801
• chore(deps): bump astro from 7.3.1 to 7.3.2 in /web by @dependabot[bot] in #803
• chore(deps-dev): bump the dev-tooling group in /ui with 3 updates by @dependabot[bot] in #804
• chore(deps): bump hls.js from 1.7.2 to 1.7.3 in /ui by @dependabot[bot] in #805
• chore(deps): bump @astrojs/sitemap from 3.7.3 to 3.7.4 in /web by @dependabot[bot] in #802
• chore(deps): bump lucide-react from 1.41.0 to 1.45.0 in /ui by @dependabot[bot] in #807
• chore(deps): react 19.3 as one bump, and a guard that sees the next split pair by @rainmanjam in #812
• chore(deps): mermaid 12, with the lodash-es advisory its new dependency carries by @rainmanjam in #813
• docs: what gitnexus impact does not see, and why a zero is not an answer by @rainmanjam in #814
• ci: two checks that could only ever report, and now block by @rainmanjam in #815
• docs: where the work on 21 deleted branches went by @rainmanjam in #816
• docs: name the three tag namespaces, and correct the archive note by @rainmanjam in #817
• fix(web): a competitor's price was wrong on the live site, and nothing could say so by @rainmanjam in #819
• docs(changelog): the entry #819 merged without, and the 0.10.0 body it joins by @rainmanjam in #818
• docs(automod): the rule examples an operator needs, and a test that runs them by @rainmanjam in #820
• docs: close 105 gaps a code-vs-doc audit found across twelve files by @rainmanjam in #821
• release: v0.10.0 by @rainmanjam in #822
• release: date v0.10.0 for the day it is actually tagged by @rainmanjam in #836
• release: date v0.10.0 in UTC, which is what the gate compares by @rainmanjam in #837

Full Changelog: v0.9.0...v0.10.0

v0.9.0

Before you upgrade

This upgrade is one-way. Migrations run forward only. An older
binary opens a newer database without complaint and then runs every
destination with an empty stream key — enabled, live, publishing
nothing, with no error anywhere. Rolling back is not a supported
recovery path; restoring your backup is.

Back up the whole data directory, not just polyemesis.db.
Since 0.7.0 destination stream keys are sealed at rest with
secret.key. A database restored without that file comes back with
every destination disabled — by design, because a key that will not
open disables its destination rather than failing open. That restore
looks completely successful until someone goes live.

Re-run install.sh before upgrading an install older than 0.7.0.
update.sh and uninstall.sh are written to disk when you install,
so an older install is running older helpers — including one whose
backup check does not know to look for secret.key. Re-running the
installer regenerates them. See
docs/UPGRADING.md.

Windows is tested, not operated. Two known unresolved defects:
recordings are truncated on service stop, and #440 — an intermittent
Go runtime abort that ends the process mid-broadcast. See
docs/INSTALL.md.

Verify your download against SHA256SUMS, published below.

---

What's Changed

• fix(ci): the go job's ceiling never cleared its own test deadline by @rainmanjam in #637
• feat(ui): remove the layout density toggle by @rainmanjam in #635
• feat(ui): mask printed credentials, and surface unmetered tracks by @rainmanjam in #641
• fix: the readiness audit's Major findings, across seven domains by @rainmanjam in #659
• integration: everything open, combined for one verdict by @rainmanjam in #673
• fix: a destination that is starved by the relay reports itself healthy (#674, #675) by @rainmanjam in #676
• fix: Sonar now gates, and copying the example no longer exposes the UI by @rainmanjam in #677
• fix(ci): the quality gate said FAILED and would not say what failed by @rainmanjam in #678
• fix(ci): the gate reporter did not gate, and main's gate was never asked by @rainmanjam in #679
• chore(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3 by @dependabot[bot] in #670
• fix(ci): the NONE message pointed at a fix that does not work by @rainmanjam in #680
• fix(security): close the 32 open findings — two fixed, six suppressed with guards by @rainmanjam in #681
• docs: the upgrade page contradicted itself, and Stage 4's runbook did not exist by @rainmanjam in #684
• feat(#661): the platform warning, where the rendition is actually chosen by @rainmanjam in #683
• feat(#638): a programme switcher, because the console remembered only its own default by @rainmanjam in #685
• fix(ci): the coverage reporter printed a header and no rows by @rainmanjam in #686
• fix(ci): the audit retry outgrew the job that runs it, and got cancelled by @rainmanjam in #687
• fix(ci): the audit retry was fighting npm's own, and killing calls that worked by @rainmanjam in #688
• fix(media): Exec discarded the tail of a failing child's output by @rainmanjam in #689
• fix(security): audit against a source that answers, and prove it can still see by @rainmanjam in #690
• fix(ci): the coverage list was alphabetical and said it was ranked by @rainmanjam in #691
• test(db): DeleteHook was untested, and UpdateHook's two refusals with it by @rainmanjam in #692
• test+fix: raise new_coverage, and fix two ways the coverage plumbing was lying (#682) by @rainmanjam in #693
• chore(deps): bump github.com/shirou/gopsutil/v4 from 4.26.7 to 4.26.8 in the go-minor-and-patch group by @dependabot[bot] in #666
• chore(deps): bump @astrojs/markdown-satteri from 0.3.5 to 0.3.8 in /web by @dependabot[bot] in #671
• fix(sonar): show where the coverage margin is before it runs out by @rainmanjam in #694
• chore(deps): bump lucide-react from 1.34.0 to 1.37.0 in /ui by @dependabot[bot] in #672
• chore(deps-dev): bump the dev-tooling group across 1 directory with 2 updates by @dependabot[bot] in #622
• chore(deps): bump react-router from 8.3.0 to 8.3.1 in /ui by @dependabot[bot] in #624
• fix(engine): three sidecars could be published into an engine that had stopped (#631) by @rainmanjam in #695
• fix(ffmpeg): an interrupted header read arrived as an unrecognisable exec failure by @rainmanjam in #696
• fix(ci): an informational step spent the whole job budget, twice by @rainmanjam in #698
• chore(deps): bump astro from 7.2.7 to 7.2.9 in /web by @dependabot[bot] in #668
• chore(deps-dev): bump wrangler from 4.121.0 to 4.127.1 in /web in the dev-tooling group across 1 directory by @dependabot[bot] in #667
• fix(testenv): -update-skips deleted the audit trail it exists to protect by @rainmanjam in #699
• test(ci): a soak that can actually catch #440, since nothing else has by @rainmanjam in #700
• test(ci): raise the soak default, now that the runner has been measured by @rainmanjam in #701
• test(acceptance): measure what a destination costs, and whether N cost N times it by @rainmanjam in #702
• test(acceptance): run a broadcast long enough for the slow faults to show by @rainmanjam in #703
• fix(engine): the nil-receiver refusals faulted instead of panicking (#440) by @rainmanjam in #704
• fix: seventeen devices from the poka-yoke audit (#705–#721) by @rainmanjam in #722
• fix(facebook): the product said Facebook has no persistent stream key, and it has one by @rainmanjam in #724
• feat: mid-stream failure injection, Facebook broadcast adoption, and the process-group decision (#380, #723, #725) by @rainmanjam in #726
• fix: add a backup ingest without destroying the broadcast (#727), and four Sonar bugs by @rainmanjam in #728
• docs(changelog): record the thirty-nine commits since the last entry by @rainmanjam in #729
• fix(installer): order TLS most-secure-first, decide the default, and check DNS against this host (#730) by @rainmanjam in #731
• feat(chat): the YouTube quota is the operator's to state, and now reaches the pacer (#732) by @rainmanjam in #733
• fix: twelve poka-yoke hazards, each with a device rather than a warning (#736-#747) by @rainmanjam in #748
• fix(youtube): the setup guide's weekly-expiry defect, and an unverified quota cost that reads as published (#734, #735) by @rainmanjam in #749
• release: v0.9.0 by @rainmanjam in #750
• fix(release): the SBOM anchor check failed exactly when it found the anchor by @rainmanjam in #751

Full Changelog: v0.8.0...v0.9.0

v0.8.0

Before you upgrade

This upgrade is one-way. Migrations run forward only. An older
binary opens a newer database without complaint and then runs every
destination with an empty stream key — enabled, live, publishing
nothing, with no error anywhere. Rolling back is not a supported
recovery path; restoring your backup is.

Back up the whole data directory, not just polyemesis.db.
Since 0.7.0 destination stream keys are sealed at rest with
secret.key. A database restored without that file comes back with
every destination disabled — by design, because a key that will not
open disables its destination rather than failing open. That restore
looks completely successful until someone goes live.

Re-run install.sh before upgrading an install older than 0.7.0.
update.sh and uninstall.sh are written to disk when you install,
so an older install is running older helpers — including one whose
backup check does not know to look for secret.key. Re-running the
installer regenerates them. See
docs/UPGRADING.md.

Windows is tested, not operated. Two known unresolved defects:
recordings are truncated on service stop, and #440 — an intermittent
Go runtime abort that ends the process mid-broadcast. See
docs/INSTALL.md.

Verify your download against SHA256SUMS, published below.

---

What's Changed

• feat(web): bind the coined name to the repository, and record what stays out by @rainmanjam in #621
• fix(ui): the ingest stream key was on screen in plain text by @rainmanjam in #625
• fix(supervisor): uptime counted the wait for an encoder as airtime by @rainmanjam in #626
• fix(supervisor): teardowns waited out a grace period sized for the recorder by @rainmanjam in #629
• feat(engine): warn when a copied ingest codec will not be accepted by @rainmanjam in #630
• feat(web): a bandwidth calculator that models a stream-copying restreamer by @rainmanjam in #632
• fix(web): the calculator caption wrapped around the button by @rainmanjam in #633
• feat(calculator): per-destination settings inside each destination card by @rainmanjam in #634

Full Changelog: v0.7.0...v0.8.0

v0.7.0

Before you upgrade

This upgrade is one-way. Migrations run forward only. An older
binary opens a newer database without complaint and then runs every
destination with an empty stream key — enabled, live, publishing
nothing, with no error anywhere. Rolling back is not a supported
recovery path; restoring your backup is.

Back up the whole data directory, not just polyemesis.db.
Since 0.7.0 destination stream keys are sealed at rest with
secret.key. A database restored without that file comes back with
every destination disabled — by design, because a key that will not
open disables its destination rather than failing open. That restore
looks completely successful until someone goes live.

Re-run install.sh before upgrading an install older than 0.7.0.
update.sh and uninstall.sh are written to disk when you install,
so an older install is running older helpers — including one whose
backup check does not know to look for secret.key. Re-running the
installer regenerates them. See
docs/UPGRADING.md.

Windows is tested, not operated. Two known unresolved defects:
recordings are truncated on service stop, and #440 — an intermittent
Go runtime abort that ends the process mid-broadcast. See
docs/INSTALL.md.

Verify your download against SHA256SUMS, published below.

---

What's Changed

• council/findability: the vocabulary nobody searches for, and the comparison that omitted the incumbent by @rainmanjam in #146
• testing workstream: #103 and #96 fixed, #94's premise corrected, #107 started by @rainmanjam in #153
• A seam ledger for #126, and the roadmap correction from #108 by @rainmanjam in #152
• Audio can be copied bit-for-bit to SRT and file destinations (#144), plus a harness for #141 by @rainmanjam in #151
• Wire internal/upgrade behind three gated endpoints, and let the banner use them by @rainmanjam in #149
• Security: token upload bypass (#140), token scopes (#104), partial SRT bind (#105) by @rainmanjam in #150
• read means metadata, and library search was serving the words (#154) by @rainmanjam in #171
• Redaction contract, webhook-path disclosure, and three authorization behaviours (#162, #160, #159, #158, #170) by @rainmanjam in #172
• The ledger repeated the pathology it was built to catch: 42 of 50 sweeps had nothing to assert by @rainmanjam in #173
• ci(security): gitleaks scanned every fetched branch, so any branch reddened every PR (#174) by @rainmanjam in #175
• The ledger's claims about itself: a dead regeneration command, a bare-# discharge, and three shape proofs that resolved to nothing by @rainmanjam in #178
• Three termination incidents in one day: the interval between asking a process to die and observing it dead (#179, #180) by @rainmanjam in #199
• feat(media): probe an upload before accepting it, and show what it is by @rainmanjam in #118
• test: sixteen mutation-verified tests for the handlers that destroy things by @rainmanjam in #219
• test(engine): eight mutation-verified gaps in the selector, and the sweep that read the wrong hub by @rainmanjam in #225
• fix(routing): a bodyless preset apply now uses the defaults the catalogue advertises by @rainmanjam in #224
• test(api): the chunked case sent the defaults, so it could not fail by @rainmanjam in #232
• test(api): pin #171's transcript split, and both halves of the annotations write by @rainmanjam in #227
• test(api): the stored webhook, the surviving hook, and the empty-buffer 409 by @rainmanjam in #228
• chore(deps): bump modernc.org/sqlite from 1.55.0 to 1.56.0 in the go-minor-and-patch group by @dependabot[bot] in #212
• chore(deps): bump hls.js from 1.6.16 to 1.6.17 in /ui by @dependabot[bot] in #214
• chore(deps-dev): bump the dev-tooling group in /ui with 2 updates by @dependabot[bot] in #213
• chore(deps): bump lucide-react from 1.28.0 to 1.30.0 in /ui by @dependabot[bot] in #215
• fix(jobs): a state conflict is 409, and a running job is not deletable (#220, #221) by @rainmanjam in #233
• security board round: the pull-URL disclosure, the playout Vary, the upload TOCTOU, and the gitleaks cross-blame by @rainmanjam in #234
• fix(instruments): -cover on internal/api measured the preflight; a missing ffprobe skipped the upload gate by @rainmanjam in #235
• fix(api): /sources handed a read token the pull credential #234 missed by @rainmanjam in #236
• docs: the four breaking changes the CHANGELOG did not mention by @rainmanjam in #237
• test: the two branches that echoed the MQTT broker password, and eight tests that can each be made to fail by @rainmanjam in #238
• test(supervisor): the start-delay budget read Windows spawn cost as a reapplied delay by @rainmanjam in #239
• test(api): retire the playout OPTIONS deferral, and record why its tripwire never fired by @rainmanjam in #240
• docs(changelog): the security fix, the two shipped features, and one Fixed list instead of two by @rainmanjam in #241
• style(scripts): clear 40 of 45 SonarCloud shell findings; 4 quarantined with measured evidence by @rainmanjam in #252
• Seven-agent issue sweep: three shipped disclosures, the engine lifecycle, and the first attributed #126 occurrence by @rainmanjam in #251
• fix(engine): the scrubber collected a decoded password and searched a raw argv by @rainmanjam in #242
• uploads: the sweep, the claim window, the verdict contract and the pull-source gate (#185, #186, #188, #201, #203) by @rainmanjam in #244
• test(api,web): the shape registry runs its proofs (#176), the NotFound probes record their branch (#167), and /assets/ stops listing the bundles by @rainmanjam in #245
• CI and product cluster: strand-free clip exports, upgrade audit events, a split build step, and measurements for four issues that stay open by @rainmanjam in #246
• test(engine): the child lifecycle, and the ffprobe #183 asks for by @rainmanjam in #247
• test(rigor): a surviving backoff mutant, a floor with no ceiling, four guessed intervals, and a guard that could not see itself by @rainmanjam in #248
• The termination class: the interval between asking a process to die and observing it dead (#192, #193, #194, #196, #197, #207, #208, #209, #210) by @rainmanjam in #250
• test(alerts): the disclosure test raced the loop it did not need (#249) by @rainmanjam in #253
• fix(ffmpeg): pin the file protocol on the engine's pull input (#201); scope the re-verify job (#202) by @rainmanjam in #254
• test(ui): move the drift guards that could not see a render into the browser (#107) by @rainmanjam in #258
• ci: retry the FFmpeg download, which hard-failed two jobs today by @rainmanjam in #256
• test(api): the non-GET denials had no positive control; #157's residual is now a differential census by @rainmanjam in #257
• ci: retry apt, which is the install that has actually been failing by @rainmanjam in #260
• ledger: the done-criterion, written down and met on four of its five conjuncts (#156, #157, #167, #168) by @rainmanjam in #268
• feat(uploads): the third verdict state — a refusal the record can hold, and its four consumers by @rainmanjam in #264
• ci(site): a Cloudflare Pages deploy for web/, gated on a secret that does not exist yet by @rainmanjam in #262
• measure: predictedStepMs is a start-lag, the flake instrument's blind spot is 70% of failures, and #190 splits in two by @rainmanjam in #263
• feat(ffmpeg): count the length of a raw elementary stream instead of refusing it (#218) by @rainmanjam in #267
• fix(sources): the pull-upload gate was on the route the engine does not read (#255)...

v0.6.0

What's Changed

• feat: surface the update check, and report what an upgrade would interrupt by @rainmanjam in #128
• perf(rendition): drop frames before scaling them, not after by @rainmanjam in #132
• feat(upgrade): decide what upgrade means per install, and keep a way back by @rainmanjam in #129
• feat(web): a pointer lens over the background grid, and document -reset-admin by @rainmanjam in #130
• fix(engine): take a feed's timeline offset after the teardown, not before it by @rainmanjam in #131
• fix(web): correct the claims on the site that the code does not support by @rainmanjam in #133
• fix(engine): put the feed's timeline offset back on the decision time by @rainmanjam in #136
• test(failover): report where a backwards DTS lands and how big it is by @rainmanjam in #137
• revert(web): remove the pointer warp over the background grid by @rainmanjam in #135
• fix(supervisor): Stop says when it killed the child instead of watching it exit by @rainmanjam in #139

Full Changelog: v0.5.0...v0.6.0

v0.5.0

What's Changed

• feat(engine): bind and publish both ingest ports by default by @rainmanjam in #123
• test(docker): prove per-destination routing over E-RTMP, not just SRT by @rainmanjam in #124
• fix: the four-tier core review, and the nine deferred findings behind it by @rainmanjam in #125

Full Changelog: v0.4.0...v0.5.0

v0.4.0

What's Changed

• docs: the two engine-wide invariants 0.3.0 added by @rainmanjam in #102
• Light mode and the destination card, planned for 0.4.0 by @rainmanjam in #97
• fix(docker): the upgrade backup archived an empty volume and exited 0 by @rainmanjam in #109
• fix(web): an unmatched /api path answered 200 with the UI, not a 404 by @rainmanjam in #110
• fix(install): --tls acme --yes spun forever; a re-install never restarted by @rainmanjam in #111
• fix(install): the default docker install reported unhealthy forever by @rainmanjam in #112
• fix(ui): a short window drew two scrollbars, and one scrolled 14px of nothing by @rainmanjam in #113
• feat(alerts): security and configuration events for Slack and Discord by @rainmanjam in #114
• fix(engine): recordings were truncated on stop, not finalised by @rainmanjam in #116
• docs: a lossy link breaks the SRT handshake, not the stream by @rainmanjam in #115
• feat(alerts): tell an operator a destination stopped keeping up by @rainmanjam in #117
• docs: the recording truncation was not Windows-only by @rainmanjam in #119
• Multi-source RTMP, a 32-track ceiling, a marketing site, and per-platform encoder guidance by @rainmanjam in #120
• Wire the motion scale, stop the urgent state hiding, make the site read like an instrument by @rainmanjam in #121
• docs: cut 0.4.0 by @rainmanjam in #122

Full Changelog: v0.3.0...v0.4.0

v0.3.0

What's Changed

• Catch the docs up to what 0.2.0 actually shipped by @rainmanjam in #98
• Adversarial audit of 0.2.0, and everything it found by @rainmanjam in #99
• docs: cut 0.3.0 by @rainmanjam in #100
• perf(test): the api suite spent its whole budget hashing passwords by @rainmanjam in #101

Full Changelog: v0.2.0...v0.3.0