Release v0.17.0

Upgrading to 0.17.0

Breaking changes — read before upgrading:

1. Run zae-limiter upgrade before deploying v0.17.0 clients. It now applies the stack template
   (#752), which grants the IAM v0.17.0 needs: dynamodb:ConditionCheckItem on the acquire, full and
   aggregator policies, and PutItem / UpdateItem on bucket items for acq / ns-acq. Custom IAM
   must add dynamodb:ConditionCheckItem for every principal that acquires and for a custom
   aggregator role.
2. Acquire-only application roles (acq / ns-acq) write bucket items only (#756, ADR-152). They
   can no longer create entities, set limits, reset or top up buckets, or perform a first-time
   Repository.open(). Open with Repository.connect(), and run setup and upgrades under a
   full / ns-full (operator) role.
3. RepositoryProtocol gained required members and keywords (multi-resource acquire, set_parent,
   reset_bucket / top_up, soft limits and bypass). A custom backend must implement them; see
   docs/api/repository.md.
4. An IAM AccessDeniedException is never admitted, whatever on_unavailable says (#751): it raises
   PermissionDenied (a RateLimiterUnavailable subclass).
5. client_min_version ratchets to 0.17.0 the first time set_parent, a quota top_up, a soft
   limit or bypass is used; older clients are then refused at open.

Upgrade notes:

• Restart every client after upgrading, before the first set_parent: a process that opened the
  stack with an older version keeps debiting the old parent until it reopens.
• Re-run zae-limiter limits apply before purging a namespace that was managed by a manifest, so
  provisioner items written before #778 get their GSI4 sort key and purge_namespace finds them.
• After a provisioner Lambda timeout, the fan-outs it left are retried by the next apply once their
  lease ends (about the function timeout plus one minute).
• Known issue, fixed in v0.17.1: check_availability() / available() can briefly report a
  just-created bucket as full capacity (#791). Display only; admission is unaffected.

Design records accepted with this release: ADR-148 (multi-resource acquire), ADR-149 (reset and
top-up), ADR-150 (move an entity to a new parent), ADR-151 (soft limits and bypass), ADR-152 (acquire
policies).

[0.17.0] - 2026-10-26

Features

• cli: Add --quiet to limits plan, apply and diff (4f15d32)
• lease: Reach each resource of a lease through a handle (576db52)
• limiter: Debit several resources in one acquire, all or none (9cfc7c8)
• repository: Move an entity to a new parent (dec0b68)
• limiter: Let the child's item overrule the cached parent (df6b366)
• cli: Add entity set-parent to move an entity (88d9a0a)
• repository: Pin bucket creates to the owner's META with a ConditionCheck (6ab8311)
• models: Let a quota's ceiling carry a top-up above its grant (67ef2cb)
• aggregator: Keep a quota top-up in the ceiling and end it at reset (58ab6ac)
• repository: Reset and top up an entity's bucket in place (5b0bc58)
• repository: Accept an idempotency key on reset_bucket and top_up (bf086d1)
• cli: Add entity reset and entity top-up (4ad2004)
• cli: Add --idempotency-key to entity reset and entity top-up (0649bc5)
• Export BucketOperationResult (33e2c15)
• models: Add soft limits to Limit, BucketState and statuses (f6a076d)
• limiter: Enforce soft limits on the server and stamp them on buckets (f0f67c7)
• aggregator: Count soft-limit overdraws in usage snapshots (0da77e8)
• limiter: Bypass an entity or resource, admitting without debiting (e227351)
• provisioner: Carry soft limits and bypass through manifests and CloudFormation (361cf23)
• cli: Add --soft and the bypass commands (0e21073)
• repository: Stamp_ttl sets how long a soft or bypass stamp stands (0776899)
• provisioner: Let a CloudFormation stack ask for a full apply (711a63f)
• cli: Say when limits plan or diff finds unfinished fan-outs (6cc1192)
• loadtest: Pass also= through RateLimiterSession.acquire (08052f1)
• loadtest: Add a multi-resource vs nested acquires locustfile (c27b927)
• loadtest: Time each multi-resource iteration as one Locust row (380f55c)

Bug Fixes

• lease: Make a refund trim itself in the same write (bdae950)
• lease: Pin what a refund's ceiling was computed from (a90596a)
• lease: Pin the schedule a refund's ceiling came from (eaeaf6e)
• limiter: Take a compensation's pin from a user limit (65b2d8a)
• infra: Store Lambda zip entries world-readable (2015683)
• lease: Never let a refund create a stub bucket (767f008)
• lease: Pin a refund from what the lease wrote (3cc65e3)
• lease: Keep a quota refund in its debit's period (2b40e82)
• lease: Pin what a refund's ceiling was computed from (aa9ca93)
• lease: Keep the read's quota period when the retry returns no image (458a9d4)
• lease: Drop only the quota credits whose period moved (4f2bde1)
• lease: Pin the reset schedule a quota credit's edge came from (5776eaa)
• lease: Pin every read-based raise on the balance it read (175f3a8)
• lease: Never let the consumption-only retry spend an unapplied period (0debd1d)
• provisioner: Never lose a fan-out a change-only apply owes (cdd4396)
• cli: Outlast the provisioner Lambda's timeout on limits apply (d650f36)
• cli: Report a throttled provisioner invoke instead of a traceback (34a8bf1)
• cli: Warn that a timed-out apply may still be running (1ba09fe)
• cli: Size the invoke timeout from the deployed provisioner (dddf5c4)
• aggregator: Stop proactive shard doubling from running away (13ca0a8)
• aggregator: Credit wcu's refill when a refill write moves rf (2193cd7)
• aggregator: Refill at the batch's latest shard count (a0e778f)
• limiter: Treat a transaction conflict on the fast path as contention (585a237)
• limiter: Make speculative compensation best-effort (f15d6ee)
• limiter: Answer sustained contention with a short 429 (17a14e5)
• limiter: Answer a zero grant lost to contention with a short 429 (9344afc)
• lease: Keep writing rollback refunds after one fails (19d0b58)
• repository: Keep a won doubling when a sibling stamp conflicts (490fcfc)
• limiter: Answer a conflicted grant-size freeze with a short 429 (a81e6fc)
• limiter: Leave a slot with an empty donor out of the contended 429 (ba9d17d)
• limiter: Keep moves_contended on the period redo (ee08737)
• repository: Keep stamping siblings past a contended one (edab48e)
• limiter: Never build an empty contended 429 (46997a3)
• limiter: Report the child's real violation over a busy parent (4b08c3d)
• limiter: Report the per-shard share in a contended 429 (c760c24)
• lease: Report the requested amount in a contended 429 (1425915)
• lease: Report the undebited balance in a contended 429 (ebb8035)
• lease: Compute the credit image in post_init, not _index_declared (1ce9bdb)
• limiter: Keep a contended 429 contended across resources (c12c87f)
• lease: Keep committed credit images when combining leases (185670c)
• limiter: Report a contended quota move as contention across resources (c6a941e)
• limiter: Redo a multi-resource commit once after a lost period lock (e7e57aa)
• limiter: Let ResourceDisabled outrank a 429 across resources (9852841)
• limiter: Refund before the disabled check, and keep the 429 if it fails (d4f2a9b)
• limiter: Let a disabled cascade parent outrank a 429 across resources (0ca1dc0)
• limiter: Refund landed fast-path debits when a multi-resource acquire is cancelled (3d11562)
• limiter: Carry the redo flag through the oversized-transaction re-plan (0363f4b)
• limiter: Debit the item's parent after refunding the cached one (75114d5)
• limiter: A parent the child has left cannot disable it (776c855)
• repository: Start an entity's parent generation at its creation instant (1e6428a)
• lease: Check a created bucket's owner stamp against META (a9c1505)
• aggregator: Restamp Path 2 clones a parent move overtook (d712939)
• repository: Give every entity an incarnation the owner pin respects (2ceaaca)
• lease: Force a slow pass when a created bucket's owner check fails (60e21af)
• lease: Never let a stale incarnation's slow pass overwrite the stamp (9e2c4a0)
• limiter: Clear a stamped shard's vu = 0 on that same shard (2eaf20c)
• lease: Force the slow pass when the owner-check join is cancelled (e693d65)
• lease: Start the owner check after the commit's last await (6881fe9)
• generator: Raise CancelledError from a killed gevent spawn (6f89ad0)
• lease: Give a killed sync owner check the vu = 0 safety net (0bfddcf)
• lease: Re-raise an owner-check cancel only when it is the caller's (e07378b)
• lease: Skip the vu = 0 writes when the join is interrupted (e028a77)
• generator: Settle a gevent spawn whose greenlet dies before it runs (2c5b64f)
• limiter: Apply the parent shard hint only to the parent it came from (62bc4f0)
• lease: Retry contention on every send of the commit transaction (bfcfc16)
• limiter: Read the parent strongly consistently in _find_disabled (12e7a35)
• repository: Never let an older owner stamp move the entity cache back (1336ba3)
• cli: Name the old parent from a consistent read (0f61c95)
• repository: Never let a failed audit write hide the move's outcome (ae9e2b7)
• infra: Grant the item actions acquire() writes with (279bafc)
• limiter: Never admit on an IAM denial under on_unavailable=ALLOW (296dcfb)
• repository: Never let a stale META read move the entity cache back (9144f09)
• infra: Upgrade applies the current template before the Lambda code (92cf260)
• cli: Upgrade applies permissions before it pushes Lambda code (743fac5)
• repository: Apply a reset or top-up once when its response is lost (f1957c5)
• repository: Never fail a reset or top-up after it committed (4e0f111)
• repository: Let a session reset end the window, not refill it (d73680c)
• lease: Force a clamp for a refund above a quota's grant, ignoring tu (aadcaff)
• repository: Record each reset or top-up in its own item (9e40a1b)
• repository: Treat a transaction in progress as an unclear outcome (a5f1cd3)
• repository: Refuse a top-up of a limit not yet on the bucket (8f12b7a)
• lease: Ask for the whole item on a refund only when a top-up was read (6b174b1)
• repository: Draw each call's request token at random, not from the key (967059e)
• repository: Audit a reset or top-up once when callers share a key (02dccef)
• repository: Delete an entity's operation records with it (680049d)
• repository: Give each attempt of a top-up's create its own token (42d34b5)
• repository: Keep a reset or top-up that landed behind an error (45eae79)
• repository: Tie each operation record to one incarnation of its entity (c79b001)
• repository: Identify an entity by #716's pinc, and keep pre-META records (915f349)
• repository: Warn when a landed reset or top-up may have lost its audit (5f71cbb)
• repository: Match a no-META incarnation on both sides of a record (cf684e9)
• repository: Write a reset or top-up's audit event in its transaction (0183778)
• repository: Refresh a default bucket's ttl on a reset or top-up (d90af26)
• repository: Record a keyed reset or top-up that writes nothing (7dc570e)
• repository: Remove a stale ttl when topping up an entity bucket (c672573)
• lease: A refund pins the quota top-up its ceiling includes (bb1bd14)
• repository: Drop a quota refund an operator reset overtook (de897c4)
• repository: Pin a top-up's bucket create to its owner's META (dab3c52)
• repository: Stop retrying a reset or top-up no retry can fix (98e0f24)
• repository: A namespace scope carries the top-up gate flag (9d7fa63)
• repository: A namespace scope shares the shard-cap warning set (6c834de)
• repository: Leave resource-decided buckets alone on a system soft change (229b16d)
• repository: The slow path sets or removes the bypass stamp (1ab41d3)
• repository: A bypass stamp expires and is renewed from config (81d960f)
• repository: A soft stamp expires and is renewed from config (1c244ea)
• limiter: A rejected slow pass still fixes a disagreeing stamp (6a142d1)
• provisioner: Time each stamp deadline from the read behind it (a56310b)
• limiter: A rejected bypassed move credits back no debit (9d3e31b)
• repository: A soft stamp admits a limit only beside its cp (be718ce)
• infra: Ns-full may query its namespace's GSI4 partition (a9d85c1)
• limiter: A multi-resource acquire re-plans a lost bypass enforced (d17aa9d)
• repository: The bypass refund is a self-trimming credit (9054da9)
• lease: A soft quota is never rejected on its retry period guard (62f53f2)
• repository: A contended bypass-shaped write goes to the slow path (b56e1e4)
• repository: A top-up create stamps bypass and soft from config (8f298fe)
• limiter: A soft limit in a limits= override is never fast-rejected (7de0f19)
• lease: Scope bypassed and overdrawn to one resource of a lease (e11c6e5)
• limiter: Check_availability allows what a live bypass admits (b04b39a)
• limiter: A hard limits= override is enforced on a soft-stamped bucket (c3cd4d2)
• limiter: Refuse a negative amount in acquire() (36e7907)
• lease: A slow pass that read META before a move debits the new parent (86f9005)
• lease: A move lost to another item's lock is contention (50202d9)
• repository: Retry a transaction conflict on the META writes (3f5a9da)
• limiter: An IAM denial outranks other errors of a multi-resource acquire (bf82552)
• limiter: Re-plan only the part that lost its bypass (950b3c4)
• infra: The acquire policies write bucket items only (3141a92)
• limiter: Carry the item's other limits through an override pass (1479bd2)
• limiter: Carry an override's other limits as configured (f4c606b)
• limiter: Open no carried window on a rejected override pass (dfded79)
• limiter: Keep vu for a limit an override pass leaves unseeded (3293bfa)
• limiter: Run the slow pass on the shard whose vu = 0 it clears (d78b778)
• limiter: Judge a stamp failure's balances as the condition does (49efbd5)
• repository: Make delete_entity delete every item or raise (407e37d)
• repository: Bound purge_namespace's unprocessed-delete retries (2fe9453)
• infra: Grant BatchWriteItem in the ns-full policy (9aeb355)
• repository: Keep a stopped delete_entity findable and audited (8550822)
• repository: Admit a soft stamp only beside the balance (ed20685)
• limiter: Drop the vu vote that kept override traffic slow (c611a58)
• lease: Never let the retry debit a limit missing from the item (a3a3a52)
• lease: Re-plan a retry whose item lacks any limit it debits (efbb584)
• provisioner: Make limits plan preview the full apply it owes (c25db4e)
• provisioner: Keep each owed fan-out in its own pending item (d8c7921)
• provisioner: Retry a pending fan-out from the table, not the manifest (a4f79f1)
• provisioner: Run a predicted fan-out even when the write looks like a no-op (b9e12d6)
• provisioner: Pre-read a deleted level to predict only the fan-outs it needs (58195b9)
• provisioner: Index pending fan-out items in GSI4 so purges find them (a789dbe)
• provisioner: Resume an unfinished full apply instead of restarting it (aa11789)
• cli: Stop calling an apply with failed retries up-to-date (f9f1363)
• lease: Report a limit missing from the retry's item as not exceeded (f6259e1)
• lease: Never report a waived soft limit exceeded in a retry 429 (04468d3)
• lease: Waive soft limits in a retry 429 built from memory (6d1b627)
• provisioner: Index config items and the state record in GSI4 (8020ae1)
• provisioner: Fan out an apply's own changes from the live config (e11dd98)
• provisioner: Lease each pending item to its apply until it is surely gone (55c90c9)
• provisioner: Resume only an interrupted full apply's own work (1b86c31)
• provisioner: Treat a soft change like every other owed fan-out (efbd492)
• cli: Stop calling a plan with pending fan-outs up-to-date (5953ae8)
• provisioner: Share a pending fan-out between every apply that owes it (c4c536c)
• provisioner: A finished full apply leaves no share to resume (12d0ca6)
• provisioner: Count a re-sent claim whose first send landed as claimed (dfb8eee)
• provisioner: Report pending fan-outs after an apply, not "up-to-date" (ff06271)
• provisioner: Strip a deleted entity level's own limits from its buckets (b076b8b)
• provisioner: Take on a fan-out only the write's image showed (e28f3d2)
• provisioner: Resolve what a fan-out stamps with strongly consistent reads (82047b9)
• provisioner: Claim an expired single owner that sits beside an empty map (78b9752)
• provisioner: Claim a pending item left with no owner and no map (4a8d64b)
• cli: Report pending fan-outs after an apply that changed config too (26b81b2)
• provisioner: Reconcile an entity level updated to declare no limits (1d8ab1b)
• provisioner: Strip a limit an entity update drops from its buckets (4514410)
• loadtest: Fire RATE_LIMITED only for the acquire that was rejected (634d9db)
• loadtest: Give every process the run's one cascade parent (7f30fa4)

Documentation

• Record the self-trimming credit in the writer table (d4fe4ea)
• Record the refund pins in the writer table (a4caa38)
• repository: Document the self-trimming credit's protocol keywords (ad5eb23)
• Record the refund's period guard, item guard and image (5b17fdb)
• State what a custom backend's adjust write must guarantee (5442514)
• Record the reset-schedule residuals of the quota period guard (3f0b02f)
• Document the raise pin and the retry period guard (ddcac39)
• adr: Propose ADR-149, immediate reset and top-up (28d906d)
• adr: Propose ADR-150, move an entity to a new parent (69c80f7)
• limiter: Design multi-resource acquire (8f460c1)
• adr: Propose ADR-148, multi-resource acquire (bcc40be)
• aggregator: Note over-sharded entities left by the runaway (41556e8)
• aggregator: Note the capped doubling under client clock skew (dfce58d)
• aggregator: Describe proactive sharding as a backstop to client doubling (1a39b3d)
• aggregator: Correct the wcu tc comment (7ee86d1)
• Describe the new proactive sharding rule (79bb7c4)
• limiter: Describe transaction-conflict handling on the fast path (2730300)
• limiter: Note best-effort refunds and the ambiguous-retry residual (b64ccaa)
• exceptions: Contended 429: no violations, use primary_violation (78a5aec)
• repository: Note that a retried fast-path write keeps its instant (2c6f777)
• Document the #724 sibling-stamp residual and contended-429 rules (0b66307)
• Note that a zero-granted slot under a busy parent stays contended (c092150)
• limiter: Document acquiring several resources at once (4251295)
• Name the multi-resource credit helpers correctly (cb814a5)
• Describe the multi-resource error path (383afdc)
• adr: Record the review fixes in ADR-150 and its design (7cb367d)
• adr: Record incarnations and the owner-check fallback in ADR-150 (c99b176)
• adr: Record the two owner pins and same-shard clearing in ADR-150 (c26ca2f)
• adr: Record a second cancel during the vu = 0 fallback as a residual (6f4863c)
• adr: Say the owner check runs during the caller's block (c5824be)
• lease: Note when a stale cancelling() count re-raises a check cancel (bf6a159)
• Document moving an entity to a new parent (c94fd88)
• Record the owner check and creation generation in CLAUDE.md (bd9abc9)
• Record incarnations and the deferred owner check in CLAUDE.md (305960b)
• Record the slow path's same-incarnation pin in CLAUDE.md (9d91602)
• limiter: Say the post-create owner check runs in the background (c0ea28f)
• limiter: Describe how the owner-check join treats a cancel (840486d)
• claude: List the generator's new task-tracking aborts (b49fa73)
• adr: Trim ADR-150 to the decision (0661250)
• Describe the pinned bucket create (c2797d3)
• adr: ADR-152 acquire policies grant the item actions they write with (96d4cab)
• Price the owner check on every bucket create (575ed94)
• adr: ADR-150 names the recreate-race residual (4b5beb3)
• adr: ADR-150 amends invariant 9, not ADR-112 (00f7f86)
• infra: Fix stale acquire comments and pin the policy descriptions (79a647f)
• Count the owner check in quota and multi-resource costs (52ffffd)
• adr: Fix ADR-149's link to ADR-137 (8eef52f)
• adr: Correct ADR-149 and its design after the PR #720 review (d5389ff)
• adr: Record the second #720 review in ADR-149 and its design (de0951c)
• adr: Record the third #720 review in the reset and top-up design (2f9f381)
• adr: Record the targeted #720 review in the reset and top-up design (1837b26)
• adr: Record a delete-and-recreate during one call as a residual (b5b8d64)
• plans: Record a same-second recreate as a residual until #716 (42afdff)
• repository: Document a pre-META record outliving a recreate (9d4782b)
• schema: Say that tu records every quota top-up, not only the overflow (58c1af6)
• Document reset and top-up for an entity's bucket (2db9d9f)
• Describe the reviewed reset and top-up behaviour (72fae88)
• Describe idempotent reset and top-up after the second #720 review (069f379)
• Describe the request nonce, record writer and delete_entity cleanup (24f17d5)
• Describe operation records' incarnation and post-write errors (c31c60a)
• Describe pinc identity and the in-flight recreate residual (cd086f5)
• guide: List the idempotency-key cases a recreate leaves open (fdf2b8f)
• guide: Drop the same-second recreate case from the key table (5368dc2)
• guide: Bring the guide and CLAUDE.md up to #720's round-6 fixes (a4498f6)
• claude: Note that a reset or top-up removes an entity bucket's stale ttl (2a565e7)
• guide: Say what a reset or top-up that gives up leaves behind (bef5c0e)
• Add the reset / top-up operation record and its cost to CLAUDE.md (a4a5064)
• Correct why the reset / top-up incarnation residual stays open (f56f4be)
• plans: Describe #730's refund and the F1/F2 pins in the reset design (9b18ea6)
• adr: ADR-149 amends ADR-145 and fits the ADR format (0913834)
• plans: Record the reset and top-up decisions and date the snapshot (0c3b7ca)
• Say IAM cannot stop an application topping itself up (efd5855)
• CLAUDE.md's reset/top-up signatures and export status (93fd9a8)
• adr: Propose ADR-151, soft limits and bypass (022ca40)
• Document soft limits and bypass (69fec9d)
• adr: ADR-151 stamps expire, and the slow path heals them (9423a80)
• Soft and bypass stamps are deadlines (ADR-151 V2) (30bf3c8)
• A cached pass reads soft-ness uncached only for a stamped item (6394dca)
• The retry seeds a soft stamp, it never renews or removes one (0c2ca12)
• repository: Announce the soft-limit and bypass protocol changes (ec1ee05)
• A Hard vs Soft Limits section, and ADR-151's config ADRs (b72e3f4)
• Correct the multi-resource first-acquire cost and re-plan count (9149ae2)
• adr: Record ADR-150's two recreate residuals (f6db486)
• plans: The multi-resource design is implemented (e6b3ec7)
• guide: Per-resource limits, a shared budget, plans and orgs (9c1bd0c)
• guide: Upgrade a plan with set_limits, not top_up (40ba4ef)
• An override pass carries the item's other limits (822030f)
• Say where an override pass's carriers come from (032e7cd)
• operations: A manual repair for over-sharded buckets (db2fd15)
• limiter: Say which shards a slow-path hint pins (ced386b)
• infra: Say exactly what ns-full's BatchWriteItem can reach (25930ae)
• A soft stamp needs the balance; the vu vote is gone (90dc78f)
• Note the bypass term's missing-balance residual (2f18a91)
• Acquire-only applications open with connect() (028f0ff)
• lease: State what the retry does with a limit it cannot seed (0e2eb0d)
• lease: The retry re-plans for any debited limit its item lacks (877c45f)
• provisioner: Document the change-only apply and FullApply (45d2b63)
• provisioner: Describe pending fan-outs as their own items (f63fda7)
• lease: Name every way a retry's item can lack a limit (4c937c9)
• provisioner: Say what re-asserting a declared disabled costs (ddede78)
• provisioner: Describe the apply's pending fan-outs as the code now runs them (fdefb55)
• provisioner: Describe shared pending fan-outs and the apply's pending count (677f2ee)
• provisioner: Note image-only write-ahead, consistent walks and entity strips (ecec22b)
• loadtest: List the multi-resource locustfile and also= passthrough (e12c1e8)
• loadtest: Describe the run-wide cascade parent (33cbf25)
• loadtest: State the parent-deletion guarantee for a normal stop only (0af7295)
• loadtest: Describe multi_resource's parent with #781's wording (db293d4)
• limiter: Record ADR-148's D1-D8 as ratified as built (6f147f8)
• limiter: Record ADR-149, ADR-150 and ADR-151 decisions as ratified (09f191e)
• adr: Accept ADRs 148-152 with their amendments declared (f57596a)

Performance

• provisioner: Apply only the entries that changed (6f6c55b)
• lease: Write reconcile and refund items concurrently (d1c0e9c)
• limiter: Run the created-bucket owner check after the caller's block (4b983b9)
• lease: Run the post-create owner check as a background task (f17d5a1)
• repository: Read an entity's META once when a top-up creates its bucket (03d9bd9)
• repository: Query delete_entity's operation records concurrently (eefa99c)
• limiter: Read config only for an item with limits to carry (77dedb6)
• provisioner: Owe a full apply's system soft restamp only when soft is in play (32a4291)

Refactoring

• repository: Build a credit's ceiling terms in one place (6d75e22)
• cli: Move provisioner timeout constant to infra (deecf92)
• limiter: Send a busy parent's child violation down the one rejection path (07b9b2f)
• schema: Read an entity's incarnation through one shared helper (c4d4335)
• lease: Remove the post-create owner checks (d82cf83)
• repository: Declare restamp_owner_if_current on the protocol (aaf3ec9)
• schema: Take #716's entity_incarnation helper byte for byte (358293b)
• loadtest: Name the budget limit for what it is, budget_rpm (f686567)
• loadtest: Share one cascade parent across the whole run (ae62828)
• loadtest: Run multi_resource's parent through the #781 contract (3cc4eb2)

Styling

• cli: Say "1 shard", and say when a top-up writes nothing (d8706d9)
• test: Read version with a from-import in the ratchet test (9a371e7)
• repository: Drop the unused refill time in plan_operation (97aded6)
• provisioner: Log a lease another apply took over instead of passing (578cd82)

Testing

• provisioner: Cover pending retries and unknown config levels (57612cb)
• lease: Cover a rollback that skips a bucket item it never debited (eb92e6b)
• lease: Cover a dropped quota credit and a failing guarded write (19e1678)
• lease: Bind the aggregator repro's image before the lease (213d6b2)
• aggregator: Expect the refill's balance pin in exact conditions (c211226)
• lease: A failed raise pin does not spend the expired period (a3a8553)
• provisioner: Cover entity re-asserts, --full payload, odd numbers (2bdcd6b)
• cli: Read the provisioner Timeout from the parsed template (b6113fb)
• aggregator: Steady traffic below the write ceiling never shards (e7b00cc)
• repository: Count a write through the conflict retry as a writer (48c4fea)
• repository: Pin that a doubling survives any propagation error (aaf515e)
• limiter: Pin the contended 429 for a zero-granted child under a busy parent (739da40)
• benchmark: Pin the multi-resource acquire's capacity (cdc650a)
• lease: Keep quota conservation under a mixed multi-resource lease (e938d7c)
• limiter: Pin a contended quota move across resources end to end (2b11f62)
• limiter: Cover the parts the disabled look skips as non-cascading (ded1f28)
• aggregator: Expect the clone owner check's META read (834e5ec)
• lease: Cover the owner check on a backend without it (5aa8313)
• repository: Pin the generation-only owner stamp (d68dc88)
• lease: Cover a re-sent write after a claim that loses or errors (b51e9a9)
• lease: Cover an interrupted async owner-check join (ee9d258)
• lease: Cover the META pin on every send and the single-path older stamp (a20e9be)
• repository: Hold I8 and the rejection cache across reset and top-up (3de4bdb)
• repository: A reset leaves a limit no longer configured alone (f7e56bc)
• repository: Keep the second #720 review's passing probes (46da1d2)
• repository: Cover delete_entity skipping non-zero shards for records (289a0ee)
• repository: A namespace scope sets every attribute init does (9589661)
• integration: Reset and top-up against LocalStack (b53845c)
• repository: A quota top-up ratchets client_min_version (b1f6ca7)
• e2e: Reset and top-up under each managed policy on real AWS (0b70a5f)
• limiter: Cover the namespace discovery pages and soft stamp errors (06f21b0)
• limiter: Follow the bypass stamp in the disable fan-out expectations (7f72b7c)
• limiter: Cover a bypassed create that loses its race, and undeclared limits (cfd5948)
• provisioner: Cover the soft restamp's REMOVE branch and its tokens (a786eff)
• Cover the stamp-deadline fallback branches (ca2523e)
• Soft and bypass on LocalStack, through sync, and in the fuzz (48c94b6)
• lease: Cover a lease with nothing for the asked resource (610c05e)
• Pin the #467 / #311 behaviours the stack's tests skipped (fcb3e34)
• Register the META PutItem retry helper as a writer (bc78668)
• Pin #675 / #677 behaviours the validation found untested (fc81fe3)
• Keep the negative-amount test's limits from refilling (8fb139b)
• Cover the M2 and P2 fallback branches (29c9c88)
• limiter: Pin a stamp-only parent shard when the child goes slow (ed29e24)
• repository: Make the #742 tests fail on behaviour, not a patch (0dd3ea2)
• infra: Check ns-full's delete_entity removes buckets and records (0266c78)
• limiter: Pin the clock in the config-changed fallback test (749fbf0)
• lease: Pin that a trusted soft seed keeps the retry's condition (dd19ebc)
• lease: A seed that loses its pin to a doubling is now re-planned (18414e4)
• lease: Cover which limits count as a genuine retry shortfall (e6ca66f)
• provisioner: Pin soft and bypass under the change-only apply (0392cbf)
• provisioner: Cover the pending-item edge paths (d8a90db)
• provisioner: Cover predicted fan-outs and drop dead action branches (e61f406)
• provisioner: Pin the GSI4SK backfill of pre-#778 config items (7a59c33)
• provisioner: Pin that a failed config write fans out nothing new (b44cba2)
• provisioner: Cover the lease clock and drop dead fan-out callbacks (0c74694)
• e2e: Cover multi-resource acquire, set_parent and bypass on real AWS (5f870f2)

Miscellaneous Tasks

• Release prep v0.17.0 (a226422)

CI

• release: Refuse a lightweight release tag, and document annotated tags (81a16dc)
• Run Tests, Lint and Docs on pull requests into any branch (4b2e6ae)

Build

• deps-dev: Bump ruff (7d6ec13)
• deps-dev: Bump ruff (46921a2)