v0.1.0-alpha.251

What's Changed

• fix(L0): WP1 — minor cleanup across eight Layer-0 packages by @jonesrussell in #1834
• refactor(ingestion): WP2 — reconcile standalone README + rename foundation EnvelopeValidator→MessageEnvelopeValidator + inject trace-id generator by @jonesrussell in #1835
• refactor(routing): WP3 — relocate CacheConfigResolver out of cache (L0→routing L4) (#1807) by @jonesrussell in #1836
• fix(audit): WP4 — observable fail-open write path (marker + metric seam) (#1792) by @jonesrussell in #1837
• fix(queue): WP5 — honest #[UniqueJob]/#[RateLimited] surface (M2) + proportional pop() claim retry (M3) by @jonesrussell in #1838
• fix(database-legacy): WP6 — fully close condition()/orderBy() identifier quoting (#1816) by @jonesrussell in #1839
• fix(test): WP7 — keep CSRF kernel-runner stdout clean so local composer verify matches CI by @jonesrussell in #1840
• fix(foundation): WP1 — redact secrets from the logging pipeline (RedactorProcessor) by @jonesrussell in #1841
• fix(foundation): WP2 — stop ExceptionHandler leaking raw messages/paths in production by @jonesrussell in #1842
• refactor(foundation): WP3 — ConfigLoader static-logger removal + EventListenerRegistrar dedup (+ BuiltinRouteRegistrar dead-route triage) by @jonesrussell in #1843
• refactor(foundation): WP4 — extract HttpKernel/AbstractKernel god-methods (behavior-neutral) by @jonesrussell in #1844
• refactor(foundation): WP5 — invert BuiltinRouteRegistrar L0→L4 route-table coupling + add string-literal layer gate by @jonesrussell in #1845
• chore(deps): bump actions/cache from 5 to 6 by @dependabot[bot] in #1831
• feat(entity-storage): add access-checked getQuery() to EntityRepository (C-22) by @jonesrussell in #1846
• test(entity-storage): C-22 WP1 — behavior-identity harness (SqlEntityStorage vs EntityRepository) by @jonesrussell in #1847
• refactor(query-consumers): C-22 WP2 — migrate getStorage()->getQuery() to getRepository()->getQuery() by @jonesrussell in #1848
• refactor(entity-storage): C-22 WP3 — migrate read/write consumers off getStorage() to getRepository() by @jonesrussell in #1849
• refactor(entity-storage): C-22 WP4 — delete the legacy save engine (SqlEntityStorage/EntityStorageFactory) by @jonesrussell in #1850
• fix(foundation): WP1 — SlugGenerator preserves Indigenous orthography (Unicode slugs) by @jonesrussell in #1851
• fix(relationship): WP3 — traverse() fail-closed endpoint visibility + delete guard registered for all entity types (security) by @jonesrussell in #1852
• fix(media): WP4 — upload MIME validation sniff-only + fail-closed; svg/octet-stream out of defaults (security) by @jonesrussell in #1853
• fix(media): WP5 — race-safe vid allocation + original-filename retention by @jonesrussell in #1854
• fix(attachment): WP1 — RFC 5987/6266 filename* preserves Indigenous filenames in downloads by @jonesrussell in #1855
• fix(attachment): WP2 — enforce the at-most-one-active invariant on every write surface by @jonesrussell in #1857
• fix(attachment): WP3 — minors cluster: production schema materialization, composer drift, access-check contract, updated_at by @jonesrussell in #1858
• fix(security): WP4 — framework-wide dead-subscriber sweep: re-key unserved dispatcher FQCNs, add check-dispatcher-keys gate by @jonesrussell in #1859
• docs(specs): entity-system spec-review ack for WP4 (#1859) — fixes the spec-drift red merged to main by @jonesrussell in #1862
• fix(foundation): WP5 — ViteAssetManager manifest-failure observability + TenantAssetResolver URL/root pairing by @jonesrussell in #1863
• fix(foundation): WP6 — layer-gate scan covers all of src/, Diagnostic layering codified, five Diagnostic fixes by @jonesrussell in #1864
• fix(foundation): WP7 — single reflective scan per manifest compile, PL008/PL005 layer-gate hardening, corrupt-cache self-heal logging by @jonesrussell in #1865
• fix(engagement): WP1 — close anonymous-ownership hole (isAuthenticated guard + user_id field lock) (security) by @jonesrussell in #1867
• fix(testing): WP2 — glob packages/*/tests/Contract into the Unit suite so orphaned contract tests run by @jonesrussell in #1868
• fix(path): WP3 — NFC-normalize aliases + enforce (alias, langcode) uniqueness via a live BeforeSaveEvent listener by @jonesrussell in #1869
• fix(taxonomy): WP4 — TermAccessPolicy view check fails closed on absent status (security) by @jonesrussell in #1870
• fix(groups): WP5 — park the dead group/group_type JSON:API surface (discoverable:false + assert deny-by-default) by @jonesrussell in #1872

Full Changelog: v0.1.0-alpha.250...v0.1.0-alpha.251