v0.9.0

Before you upgrade

This upgrade is one-way. Migrations run forward only. An older
binary opens a newer database without complaint and then runs every
destination with an empty stream key — enabled, live, publishing
nothing, with no error anywhere. Rolling back is not a supported
recovery path; restoring your backup is.

Back up the whole data directory, not just polyemesis.db.
Since 0.7.0 destination stream keys are sealed at rest with
secret.key. A database restored without that file comes back with
every destination disabled — by design, because a key that will not
open disables its destination rather than failing open. That restore
looks completely successful until someone goes live.

Re-run install.sh before upgrading an install older than 0.7.0.
update.sh and uninstall.sh are written to disk when you install,
so an older install is running older helpers — including one whose
backup check does not know to look for secret.key. Re-running the
installer regenerates them. See
docs/UPGRADING.md.

Windows is tested, not operated. Two known unresolved defects:
recordings are truncated on service stop, and #440 — an intermittent
Go runtime abort that ends the process mid-broadcast. See
docs/INSTALL.md.

Verify your download against SHA256SUMS, published below.

---

What's Changed

• fix(ci): the go job's ceiling never cleared its own test deadline by @rainmanjam in #637
• feat(ui): remove the layout density toggle by @rainmanjam in #635
• feat(ui): mask printed credentials, and surface unmetered tracks by @rainmanjam in #641
• fix: the readiness audit's Major findings, across seven domains by @rainmanjam in #659
• integration: everything open, combined for one verdict by @rainmanjam in #673
• fix: a destination that is starved by the relay reports itself healthy (#674, #675) by @rainmanjam in #676
• fix: Sonar now gates, and copying the example no longer exposes the UI by @rainmanjam in #677
• fix(ci): the quality gate said FAILED and would not say what failed by @rainmanjam in #678
• fix(ci): the gate reporter did not gate, and main's gate was never asked by @rainmanjam in #679
• chore(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3 by @dependabot[bot] in #670
• fix(ci): the NONE message pointed at a fix that does not work by @rainmanjam in #680
• fix(security): close the 32 open findings — two fixed, six suppressed with guards by @rainmanjam in #681
• docs: the upgrade page contradicted itself, and Stage 4's runbook did not exist by @rainmanjam in #684
• feat(#661): the platform warning, where the rendition is actually chosen by @rainmanjam in #683
• feat(#638): a programme switcher, because the console remembered only its own default by @rainmanjam in #685
• fix(ci): the coverage reporter printed a header and no rows by @rainmanjam in #686
• fix(ci): the audit retry outgrew the job that runs it, and got cancelled by @rainmanjam in #687
• fix(ci): the audit retry was fighting npm's own, and killing calls that worked by @rainmanjam in #688
• fix(media): Exec discarded the tail of a failing child's output by @rainmanjam in #689
• fix(security): audit against a source that answers, and prove it can still see by @rainmanjam in #690
• fix(ci): the coverage list was alphabetical and said it was ranked by @rainmanjam in #691
• test(db): DeleteHook was untested, and UpdateHook's two refusals with it by @rainmanjam in #692
• test+fix: raise new_coverage, and fix two ways the coverage plumbing was lying (#682) by @rainmanjam in #693
• chore(deps): bump github.com/shirou/gopsutil/v4 from 4.26.7 to 4.26.8 in the go-minor-and-patch group by @dependabot[bot] in #666
• chore(deps): bump @astrojs/markdown-satteri from 0.3.5 to 0.3.8 in /web by @dependabot[bot] in #671
• fix(sonar): show where the coverage margin is before it runs out by @rainmanjam in #694
• chore(deps): bump lucide-react from 1.34.0 to 1.37.0 in /ui by @dependabot[bot] in #672
• chore(deps-dev): bump the dev-tooling group across 1 directory with 2 updates by @dependabot[bot] in #622
• chore(deps): bump react-router from 8.3.0 to 8.3.1 in /ui by @dependabot[bot] in #624
• fix(engine): three sidecars could be published into an engine that had stopped (#631) by @rainmanjam in #695
• fix(ffmpeg): an interrupted header read arrived as an unrecognisable exec failure by @rainmanjam in #696
• fix(ci): an informational step spent the whole job budget, twice by @rainmanjam in #698
• chore(deps): bump astro from 7.2.7 to 7.2.9 in /web by @dependabot[bot] in #668
• chore(deps-dev): bump wrangler from 4.121.0 to 4.127.1 in /web in the dev-tooling group across 1 directory by @dependabot[bot] in #667
• fix(testenv): -update-skips deleted the audit trail it exists to protect by @rainmanjam in #699
• test(ci): a soak that can actually catch #440, since nothing else has by @rainmanjam in #700
• test(ci): raise the soak default, now that the runner has been measured by @rainmanjam in #701
• test(acceptance): measure what a destination costs, and whether N cost N times it by @rainmanjam in #702
• test(acceptance): run a broadcast long enough for the slow faults to show by @rainmanjam in #703
• fix(engine): the nil-receiver refusals faulted instead of panicking (#440) by @rainmanjam in #704
• fix: seventeen devices from the poka-yoke audit (#705–#721) by @rainmanjam in #722
• fix(facebook): the product said Facebook has no persistent stream key, and it has one by @rainmanjam in #724
• feat: mid-stream failure injection, Facebook broadcast adoption, and the process-group decision (#380, #723, #725) by @rainmanjam in #726
• fix: add a backup ingest without destroying the broadcast (#727), and four Sonar bugs by @rainmanjam in #728
• docs(changelog): record the thirty-nine commits since the last entry by @rainmanjam in #729
• fix(installer): order TLS most-secure-first, decide the default, and check DNS against this host (#730) by @rainmanjam in #731
• feat(chat): the YouTube quota is the operator's to state, and now reaches the pacer (#732) by @rainmanjam in #733
• fix: twelve poka-yoke hazards, each with a device rather than a warning (#736-#747) by @rainmanjam in #748
• fix(youtube): the setup guide's weekly-expiry defect, and an unverified quota cost that reads as published (#734, #735) by @rainmanjam in #749
• release: v0.9.0 by @rainmanjam in #750
• fix(release): the SBOM anchor check failed exactly when it found the anchor by @rainmanjam in #751

Full Changelog: v0.8.0...v0.9.0