Bug Fixes

• api: clamp paging and never panic on non-object metadata (9252803)
• auth: accept a signed identity dated up to 30 s ahead of this clock (b7d7c74)
• auth: give each internal caller its own token, scopes and tenants (394f65b)
• auth: reads need a person or a release scope; roadmap writes need a person (d5cdab9)
• auth: trust unverified identity headers only when asked for, locally (b58def9)
• consolidation: stop clearing and polluting release notes; settle each week once (1ee7e31)
• db: set statement_timeout as a role default; PgBouncer refuses startup options (671a6dd)
• idempotency: commit the key, the write and its stored response together (55f3633)
• logging: log only verified identity, quiet the probe, keep panics in the JSON log (972e204)
• releases: merge metadata on PATCH and drop the forgeable promotion-readiness gate (7f3e7d7)
• releases: require RELEASE_DELETE to deprecate or restore through PATCH (4db9791)
• releases: serve the highest version as latest, and validate what is published (534674c)
• roadmap: hold the pending-idea cap under concurrent submissions (d1c40ee)
• runtime: stop gracefully on SIGTERM and bound request, auth-api and SQL time (8917997)
• auth: stop forwarding caller-set IP headers to auth-api /verify (5ca089d)

Features

• auth: add RELEASE_PERF_WRITE, and stop API keys moderating the roadmap (42e4fd5)

Performance Improvements

• api: bound the performance, overview, roadmap and mirror reads (9b44339)