v0.8.0 — The correctness release

No new surface — a deep correctness pass over the money paths that already exist, with the safety net extended far enough to prove it.

Highlights

A money-out arbitrage, found and fixed. Plan-change proration used list prices while renewals honor the subscription's coupon — so a heavily-discounted customer could downgrade mid-period into more spendable account credit than they ever paid. Proration (and its preview) now credits and charges at the prices the customer actually pays this period. (#422)

Revenue recognition around mid-period downgrades, closed as a family. A downgrade credit could drive Deferred Revenue wrong-sign when recognition had run ahead (#413); the repair was itself soak-tested and hardened — the reversal is now capped at the subscription's genuinely-recognized events (#420), and a schedule debt mechanism ensures an unpaid invoice whose deferral was credited back never re-recognizes that revenue when later paid (#421, migration 000158).

FX reporting exponent-correct. Every FX-normalized report (MRR analytics, revenue segments, waterfall, aging, dunning recovery, consolidation) multiplied minor units by major-to-major rates — JPY figures were 100× off, KWD/BHD 10×. One exponent-aware helper now backs every conversion. (#417)

Metering edges. Dimensional-pricing charges on progressive subscriptions no longer bill at base rates through the filter-blind watermark (#416); pay-in-advance is restricted to additive aggregations — a max-concurrent-seats metric can no longer be billed per heartbeat (#418).

Webhooks fail closed. A dedup-store outage now defers gateway events to the gateway's own retry (503) instead of processing on faith. (#425)

The safety net grew with the fixes

• New standing reconciler invariant: Deferred Revenue must always cover the revenue still scheduled to recognize (deferred_below_scheduled_revenue) — it survives the cross-subscription aggregation that masks wrong-sign checks. (#414)
• The randomized ledger harness now creates a third of its subscriptions inside a discounted period and permanently carries the two seeds that exposed the downgrade-reversal edge. (#424)
• Validated end-to-end: 128 randomized billing sequences, reconciled to audit-grade after every operation, zero discrepancies.

Migrations

000158 (revrec schedule debt) and 000159 (coupon-applied-this-period flag) — both run automatically on boot and are already live.

Container image

docker pull ghcr.io/recurso-dev/recurso:v0.8.0

The Docker image is the release artifact; no binaries are attached.