[github-actions]

Migration checklist

@shivaedev/admin

• Reject overlapping admin route patterns and detail paths outside their page at registry composition. Move colliding pages to distinct routes and place each detail under its page path.

@shivaedev/changes

• Transactions inside batch now publish at their outermost transaction's commit, honoring the scoped CommittedSink, instead of waiting for the batch to end. Use an enclosing transaction when writes and their changes must commit together, or coalesce in the sink when independent transactions need grouped delivery. Nontransactional batch changes still wait for the batch to end, and rolled-back transactions publish nothing.
• SQL repository registration rejects annotated bucket fields whose decoded schemas cannot be represented by change keys, with BucketRegistrationError.invalidFields naming the rejected fields. Use string or number schemas, optionally nullable or optional, for bucket values. Codecs such as Schema.NumberFromString remain supported. Replace opaque declarations with an explicit string or number schema and refinements. When constructing BucketRegistrationError directly, supply invalidFields (an empty array for field-name mismatches).
• The native adapter passed to within now receives a TransactionBoundary as its second argument. Unary adapters remain compatible. Wrap a native combinator that already accepts a second options argument as (body) => native(body, options) to keep those options explicit.

@shivaedev/errors

• @shivaedev/rate-limit now fails with the shared TooManyRequests. Replace imports from @shivaedev/rate-limit/TooManyRequests.ts with @shivaedev/errors/taxonomy.ts and add @shivaedev/errors as a dependency. Use that shared schema in contract rejections and custom stores. Its key and retryAt fields are optional because other callers can create message-only failures; check for their presence before using them. The limiter continues to supply both fields. The old module is removed without an alias.

@shivaedev/form

• messageAtPath(issue, []) now selects only whole-form issues. Pass a field path such as ["name"] to select that field's first message.

@shivaedev/github

• Effectful GitHubToken providers can now fail with GitHubRateLimited alongside GitHubAppError. Consumers handling authentication failures must also handle GitHubRateLimited and use its retryAt when scheduling another attempt.
• Bounded response readers reject NaN, infinite and negative limits with the typed InvalidBodyLimit error from errors.ts. Pass a finite nonnegative byte limit and handle the new failure in the error channel.
• GitHub methods using the bounded response reader also expose InvalidBodyLimit from @shivaedev/http/errors.ts for invalid byte limits. Supply finite nonnegative limits and handle that failure alongside existing response failures.
• CreateCheckRun requires a conclusion when status is completed, with validation before any request. Consumers creating completed runs must supply conclusion; use queued or in_progress when no conclusion is available.
• CheckRunStatus includes waiting, requested and pending from GitHub Actions responses. Consumers with exhaustive status handling must add these cases. GitHub App create and update inputs remain restricted to queued, in_progress and completed.
• Pagination rejects automatic fetch redirects so custom headers cannot reach another origin. Pass a direct same-origin page URL instead of a redirecting URL; links to later pages must also use direct URLs. Other fetch options in the current Effect context are preserved. Use a client without redirect-following middleware.
• GitHub listing methods inherit the redirect restriction. List the repository's current API path instead of an endpoint that redirects after a rename or transfer.

@shivaedev/heavy-lock

• Reclamation uses a shared <lock>.reclaim directory and checks ownership before removing a stale file, so competing reclaimers never displace a live holder. Stop participants and upgrade every implementation sharing a lock path to the documented gate protocol before restarting them; implementations that rename the lock during reclamation cannot safely participate.
• Acquisition now requires Crypto.Crypto alongside the filesystem, path and process-spawning services. Provide NodeServices.layer, or add NodeCrypto.layer to a custom platform layer.
• Import signal helpers from @shivaedev/heavy-lock/adapters/signals.ts instead of @shivaedev/heavy-lock/cli/signals.ts.

@shivaedev/http

• Bounded response readers reject NaN, infinite and negative limits with the typed InvalidBodyLimit error from errors.ts. Pass a finite nonnegative byte limit and handle the new failure in the error channel.
• GitHub methods using the bounded response reader also expose InvalidBodyLimit from @shivaedev/http/errors.ts for invalid byte limits. Supply finite nonnegative limits and handle that failure alongside existing response failures.
• Pagination rejects automatic fetch redirects so custom headers cannot reach another origin. Pass a direct same-origin page URL instead of a redirecting URL; links to later pages must also use direct URLs. Other fetch options in the current Effect context are preserved. Use a client without redirect-following middleware.
• GitHub listing methods inherit the redirect restriction. List the repository's current API path instead of an endpoint that redirects after a rename or transfer.

@shivaedev/identity

• MCP's betterAuthMcp requires admitsUser. Pass admitsUser: mounted.admitsUser from betterAuthMount alongside auth: mounted.auth. Each MCP request refuses users denied by the identity sign-in policy; existing tokens follow admission changes on the next request.

@shivaedev/local-postgres

• clientConnection now returns an Effect. Replace direct calls with yield* clientConnection(url, options) inside an Effect program so password decoding failures stay in the typed error channel.

@shivaedev/mcp

• MCP's betterAuthMcp requires admitsUser. Pass admitsUser: mounted.admitsUser from betterAuthMount alongside auth: mounted.auth. Each MCP request refuses users denied by the identity sign-in policy; existing tokens follow admission changes on the next request.

@shivaedev/pr-watch

• The PR watcher GitHub service’s confirmQueue method now returns Snapshot | undefined. Direct callers must treat undefined as an unconfirmed observation and retain the last successful snapshot without emitting transitions. Custom adapters can return undefined to defer confirmation.
• checkFailures can return undefined when required-check metadata is incomplete. Direct callers must treat undefined as pending and retain their last observation until metadata is complete; true still means a required failure and false means no required failures were observed with sufficient metadata.

@shivaedev/quality

• manifestReader requires an Effect scope so its reads stop when the owning operation ends. Consumers must create and use the reader within Effect.scoped.
• ImportGraph includes required configFindings metadata. Consumers constructing graphs themselves must supply this array (configFindings: [] when there are no diagnostics); graphs returned by importGraph already include it.

@shivaedev/rate-limit

• @shivaedev/rate-limit now fails with the shared TooManyRequests. Replace imports from @shivaedev/rate-limit/TooManyRequests.ts with @shivaedev/errors/taxonomy.ts and add @shivaedev/errors as a dependency. Use that shared schema in contract rejections and custom stores. Its key and retryAt fields are optional because other callers can create message-only failures; check for their presence before using them. The limiter continues to supply both fields. The old module is removed without an alias.

@shivaedev/react

• Direct callers of @shivaedev/react/client/mountLive.ts now run mountLive(client, window) as an Effect requiring AtomRegistry.AtomRegistry, instead of passing the registry as its first argument. Provide the registry with Effect.provideService(AtomRegistry.AtomRegistry, registry) and call the returned cleanup when the reader unmounts.
• Direct calls to the loader returned by queryRoute now require location alongside abortController, context, deps and params. Pass the native TanStack loader context, or add the requested location to a custom loader invocation.

@shivaedev/releases

• checkReleaseCoverage now requires FileSystem.FileSystem to read the recorded release base. Provide NodeServices.layer from @effect/platform-node, or add a filesystem layer alongside the existing child-process spawner.
• planRelease, applyRelease, and the plan and apply CLI commands now read the Git base to reject removed dependencies even with registry version ranges. Run them in a Git repository with a resolvable origin/main or main and common history. Effect API callers must provide ChildProcessSpawner.ChildProcessSpawner alongside FileSystem.FileSystem (for example with NodeServices.layer) and handle GitError failures from history reads. For Git-free snapshot planning, call computePlan(packages, sources, previousPackages) with the base packages explicitly.

@shivaedev/sql

• Transactions inside batch now publish at their outermost transaction's commit, honoring the scoped CommittedSink, instead of waiting for the batch to end. Use an enclosing transaction when writes and their changes must commit together, or coalesce in the sink when independent transactions need grouped delivery. Nontransactional batch changes still wait for the batch to end, and rolled-back transactions publish nothing.
• SQL repository registration rejects annotated bucket fields whose decoded schemas cannot be represented by change keys, with BucketRegistrationError.invalidFields naming the rejected fields. Use string or number schemas, optionally nullable or optional, for bucket values. Codecs such as Schema.NumberFromString remain supported. Replace opaque declarations with an explicit string or number schema and refinements. When constructing BucketRegistrationError directly, supply invalidFields (an empty array for field-name mismatches).
• Migration runners with schema components or a release now hold a session advisory lock through components and release publication. Allocate at least two pool connections for an active runner plus capacity for waiting runners and other work, and migrate transaction-pooled connections to direct connections or session pooling. Components continue to run outside the ledger transaction. Runs with only numbered migrations retain their transaction lock and one-connection pool support.
• Direct callers of postgresRelease(...).apply must handle SchemaError alongside SqlError because the component now decodes its PostgreSQL clock row.

@shivaedev/vitest-rerun

• Code constructing Snapshot values for the exported internal merge API must supply summary with Vitest's snapshot summary. The runner creates this field automatically.

@shivaedev/webhooks

• WebhookEvent.decode reports payload decoding failures as WebhookPayloadError from @shivaedev/webhooks/server/WebhookPayloadError.ts, with the original SchemaError in cause. Direct callers must catch WebhookPayloadError instead of SchemaError for invalid payloads. Custom event decoders must wrap payload schema failures in new WebhookPayloadError({ cause }), or use webhookEvent to separate decoding from application mapping. Application failures keep their original error types.

@shivaedev/work-board

• Work Board's Changes.files is replaced by Changes.inventory, which returns { files, unavailable }. Consumers must read inventory.files and qualify identity and membership using inventory.unavailable. updateFiles accepts and returns this inventory. Navigation membership counts are nullable; treat null as unknown while the index is incomplete. listMarkdown fails when a directory cannot be read; use scanMarkdown to inspect readable files alongside unavailable paths.
• Work Fleet Board reads fail with BoardFailure code incomplete-observation while sources are unavailable. Consumers must treat identity and membership as unknown and retain existing execution state until sources can be read again.

@shivaedev/work-fleet

• Layers composed directly with hostPolicy must now provide LaunchTier from host/launchTier.ts. Provide launchTierLayer with the host's MainSource and GithubApi; fleetHostLayer and the CLI wire this automatically.
• The PR watcher GitHub service’s confirmQueue method now returns Snapshot | undefined. Direct callers must treat undefined as an unconfirmed observation and retain the last successful snapshot without emitting transitions. Custom adapters can return undefined to defer confirmation.
• Work Board's Changes.files is replaced by Changes.inventory, which returns { files, unavailable }. Consumers must read inventory.files and qualify identity and membership using inventory.unavailable. updateFiles accepts and returns this inventory. Navigation membership counts are nullable; treat null as unknown while the index is incomplete. listMarkdown fails when a directory cannot be read; use scanMarkdown to inspect readable files alongside unavailable paths.
• Work Fleet Board reads fail with BoardFailure code incomplete-observation while sources are unavailable. Consumers must treat identity and membership as unknown and retain existing execution state until sources can be read again.

Why?

This PR holds the current release plan: press Approve and run, then merge when full CI is green.

How?

This branch is regenerated from main with the releases plan applied. Merging it publishes through the existing main-only npm trusted publishing workflow.

Package	Current	Release	Bump
@shivaedev/access	0.3.5	0.3.6	patch
@shivaedev/admin	0.17.0	0.18.0	minor
@shivaedev/browser-check	0.2.2	0.2.3	patch
@shivaedev/changes	0.6.0	0.7.0	minor
@shivaedev/contract	0.30.1	0.30.2	patch
@shivaedev/create-app	0.35.0	0.36.0	minor
@shivaedev/deploy	0.0.0	0.1.0	minor
@shivaedev/email	0.1.0	0.1.1	patch
@shivaedev/errors	0.4.1	0.5.0	minor
@shivaedev/form	0.10.0	0.11.0	minor
@shivaedev/github	0.8.6	0.9.0	minor
@shivaedev/heavy-lock	0.7.1	0.8.0	minor
@shivaedev/http	0.3.1	0.4.0	minor
@shivaedev/identity	0.17.0	0.18.0	minor
@shivaedev/jobs	0.29.1	0.29.2	patch
@shivaedev/local-postgres	0.8.0	0.9.0	minor
@shivaedev/mcp	0.3.0	0.4.0	minor
@shivaedev/platform	0.38.0	0.38.1	patch
@shivaedev/pr-watch	0.6.6	0.7.0	minor
@shivaedev/quality	0.54.0	0.55.0	minor
@shivaedev/rate-limit	0.1.0	0.2.0	minor
@shivaedev/react	0.32.0	0.33.0	minor
@shivaedev/releases	0.6.3	0.7.0	minor
@shivaedev/server	0.17.0	0.18.0	minor
@shivaedev/service	0.6.0	0.6.1	patch
@shivaedev/skills	0.6.1	0.6.2	patch
@shivaedev/sql	0.31.0	0.32.0	minor
@shivaedev/test	0.12.0	0.12.1	patch
@shivaedev/test-sql	0.16.0	0.16.1	patch
@shivaedev/test-story	0.32.0	0.33.0	minor
@shivaedev/vitest-rerun	0.2.1	0.3.0	minor
@shivaedev/webhooks	0.3.11	0.4.0	minor
@shivaedev/work-board	0.41.2	0.42.0	minor
@shivaedev/work-fleet	0.29.2	0.30.0	minor

Changes

admin-collection-policy.md

Packages: @shivaedev/admin

Fixed

• Preserve permission read policies on admin page queries so live collection reads load and refresh after writes across tenants, while retaining the page grant and query restrictions.

admin-route-overlaps.md

Packages: @shivaedev/admin

Breaking

• Reject overlapping admin route patterns and detail paths outside their page at registry composition. Move colliding pages to distinct routes and place each detail under its page path.

Fixed

• Apply the first registered page's permission to /admin and /admin/ in both the client and server guards.

Fixed

• Match detail routes with a declared trailing slash consistently with page routes.

admin-session-contracts.md

Packages: @shivaedev/admin

Fixed

• Accept session-scoped contracts in adminPage and preserve their scope through middleware and client binding, including queries using readsCollections.

app-auth-quota.md

Packages: @shivaedev/github

Fixed

• Installation lookups and token exchanges use the same rate-limit detection and retry deadlines as App and resource requests. Quota exhaustion returns typed GitHubRateLimited, and requests fail locally until its deadline instead of repeating authentication requests.

Breaking

• Effectful GitHubToken providers can now fail with GitHubRateLimited alongside GitHubAppError. Consumers handling authentication failures must also handle GitHubRateLimited and use its retryAt when scheduling another attempt.

automatic-query-request-headers.md

Packages: @shivaedev/contract

Fixed

• Keep per-query headers on automatic live subscriptions and rerun-and-compare reads.

Fixed

• Reopen a denied hinted query's subscription on explicit refresh so it can return data after access is granted.

batched-commit-delivery.md

Packages: @shivaedev/changes, @shivaedev/sql

Breaking

• Transactions inside batch now publish at their outermost transaction's commit, honoring the scoped CommittedSink, instead of waiting for the batch to end. Use an enclosing transaction when writes and their changes must commit together, or coalesce in the sink when independent transactions need grouped delivery. Nontransactional batch changes still wait for the batch to end, and rolled-back transactions publish nothing.

Fixed

• Exceptions in change observers are logged without stopping sink delivery or changing transaction outcomes, including SQL change observations.

board-migration-owned-files.md

Packages: @shivaedev/work-board

Fixed

• Migrate only workspace-owned Markdown selected by the scanner, leaving dependency folders, hidden folders and outside reference files unchanged and avoiding ancestor symlink loops.

bounded-response-edges.md

Packages: @shivaedev/http, @shivaedev/github

Fixed

• Read HEAD responses and statuses 204, 205 and 304 as empty bytes or text; JSON decoding still rejects empty input.

Fixed

• Limit encoded responses by bytes exposed by the native client stream, without comparing compressed Content-Length to decoded bytes. Fetch exposes decompressed bytes; Node's native HTTP transport exposes encoded bytes.

Breaking

• Bounded response readers reject NaN, infinite and negative limits with the typed InvalidBodyLimit error from errors.ts. Pass a finite nonnegative byte limit and handle the new failure in the error channel.

Breaking

• GitHub methods using the bounded response reader also expose InvalidBodyLimit from @shivaedev/http/errors.ts for invalid byte limits. Supply finite nonnegative limits and handle that failure alongside existing response failures.

bounded-worker-drain.md

Packages: @shivaedev/jobs

Fixed

• Bound worker shutdown drain by stop.timeout (30 seconds by default). Workers drain concurrently, interrupt in-flight Effects at the timeout and log a warning for each registration that times out. Work that finishes within the timeout completes normally.

browser-check-current-captures.md

Packages: @shivaedev/browser-check

Fixed

• Launch the cached Chromium executable checked for readiness, including when the separate headless shell is absent.

Fixed

• Clear previous screenshots before each check so shorter and failed runs leave only their own captures.

browser-check-visible-inputs.md

Packages: @shivaedev/browser-check

Fixed

• Skip hidden text matches when checking for visible text, while still failing when all matches are hidden.

Fixed

• Reject invalid base and page URLs with a browser-check diagnostic before installing or opening Chromium.

browser-live-waits.md

Packages: @shivaedev/browser-check

Fixed

• Failed or interrupted live-notes checks handle pending WebSocket waits without unhandled rejections. Live verification requires RPC hint chunks and a notes.list request instead of matching words in unrelated frames.

browser-report-privacy.md

Packages: @shivaedev/errors, @shivaedev/server, @shivaedev/create-app

Added

• Add redactBrowserText to mask quoted browser literals, including escaped quotes and multiline content, while preserving diagnostic shape and the existing server text policy.

Added

• Add opt-in browserErrors settings for an Error log per report, signed-in user.id attribution and session enforcement. The starter enables all three.

Fixed

• Mask browser report messages and stacks before they reach diagnostic sinks and record reports at Error severity.

bucket-value-registration.md

Packages: @shivaedev/changes, @shivaedev/sql

Added

• @shivaedev/changes/keys.ts exports isBucketSchema to check whether a schema decodes to string or number keys, including nullable and optional model fields. declaredBuckets includes this check as supported.

Breaking

• SQL repository registration rejects annotated bucket fields whose decoded schemas cannot be represented by change keys, with BucketRegistrationError.invalidFields naming the rejected fields. Use string or number schemas, optionally nullable or optional, for bucket values. Codecs such as Schema.NumberFromString remain supported. Replace opaque declarations with an explicit string or number schema and refinements. When constructing BucketRegistrationError directly, supply invalidFields (an empty array for field-name mismatches).

calm-handoff-format.md

Packages: @shivaedev/work-board

Fixed

• Show the saved handoff header format in the file preview and provide parseable source examples for requests, relationships, evidence, questions and handoffs.

calm-manifest-reads.md

Packages: @shivaedev/quality

Fixed

• Interrupting a scan stops its pending manifest reads.

Fixed

• Report expected filesystem failures from rules as findings. Report unreadable manifests and manifests removed after discovery under manifests/valid; keep optional missing-file lookups unchanged.

Breaking

• manifestReader requires an Effect scope so its reads stop when the owning operation ends. Consumers must create and use the reader within Effect.scoped.

channel-acquisition-boundary.md

Packages: @shivaedev/changes

Added

• Give native transaction adapters a boundary that restores interruption during connection acquisition and records a commit before pending interruption resumes.

Breaking

• The native adapter passed to within now receives a TransactionBoundary as its second argument. Unary adapters remain compatible. Wrap a native combinator that already accepts a second options argument as (body) => native(body, options) to keep those options explicit.

ci-capacity-tier.md

Packages: @shivaedev/work-fleet

Added

• Hosts can select fast or default worker service tiers from queued GitHub Actions runs, with configurable hysteresis, interval-cached reads through Fleet's GitHub reserve, and the current decision in status. Failed reads retain the last tier; each attempt records its selected launch settings.

Breaking

• Layers composed directly with hostPolicy must now provide LaunchTier from host/launchTier.ts. Provide launchTierLayer with the host's MainSource and GithubApi; fleetHostLayer and the CLI wire this automatically.

compiler-import-analysis.md

Packages: @shivaedev/quality

Fixed

• Report tsconfig diagnostics as import findings and honor configured module resolution, path aliases and package export conditions, including NodeNext import and require branches.

Breaking

• ImportGraph includes required configFindings metadata. Consumers constructing graphs themselves must supply this array (configFindings: [] when there are no diagnostics); graphs returned by importGraph already include it.

current-form-messages.md

Packages: @shivaedev/form

Added

• Read whole-form Schema refinement messages with errorAt([]) after submission and with Invalid.formMessage on invalid submissions.

Fixed

• Hide previous asynchronous Schema messages on top-level fields while decoding changed input.

Breaking

• messageAtPath(issue, []) now selects only whole-form issues. Pass a field path such as ["name"] to select that field's first message.

declared-retries-refused.md

Packages: @shivaedev/vitest-rerun

Fixed

• Refuse per-test and per-suite Vitest retries after each attempt, naming every affected file and test. Use --reruns for global fresh-process retries whose recoveries are recorded in flaky-tests.json.

deliberate-file-hook-reruns.md

Packages: @shivaedev/vitest-rerun

Fixed

• Rerun a file in full when its beforeAll or afterAll fails, including nested suite hooks. Keep unresolved hook diagnostics and new failures in the merged results.

deploy-railway-services.md

Packages: @shivaedev/deploy

Added

• Compose native Railway web and worker service definitions with overridable pre-deploy migration, trusted proxy, client-IP header and worker draining defaults.

encoded-fields-handler-construction.md

Packages: @shivaedev/errors

Fixed

• Reject sensitivity conflicts through public encoded field names when registering an RPC's diagnostic policy.

Fixed

• Map throws during RPC handler construction through the group boundary for unary and streaming handlers, including native RPC wrappers.

fleet-git-scope.md

Packages: @shivaedev/work-fleet

Fixed

• Stop pending Git fetches, merge predictions and report ancestry checks when their Effect is interrupted, and wait for the child process to close before interruption completes.

fleet-pr-reconciliation.md

Packages: @shivaedev/work-fleet, @shivaedev/pr-watch

Breaking

• The PR watcher GitHub service’s confirmQueue method now returns Snapshot | undefined. Direct callers must treat undefined as an unconfirmed observation and retain the last successful snapshot without emitting transitions. Custom adapters can return undefined to defer confirmation.

Fixed

• Fleet reconciles tracked PRs that merged or closed while its watcher was stopped and continues watching open PRs after restart.

Fixed

• Failed Fleet queue confirmations preserve the previous snapshot and defer transitions until GitHub confirms the observation.

freeze-approved-release.md

Packages: @shivaedev/releases

Fixed

• Accept pending changesets added later on main when a release records its base in .changeset/release-base, including after squash merging. Keep rejecting dropped or rewritten release inputs and notes. Pass the checked main revision as the optional fourth argument to checkReleaseCoverage when composing repository validation.

Breaking

• checkReleaseCoverage now requires FileSystem.FileSystem to read the recorded release base. Provide NodeServices.layer from @effect/platform-node, or add a filesystem layer alongside the existing child-process spawner.

generated-dependency-ranges.md

Packages: @shivaedev/releases

Fixed

• Reject generated dependency ranges that differ from the planned dependency version, naming the dependent package and range to regenerate.

github-conditional-pagination.md

Packages: @shivaedev/github

Fixed

• Keep conditional response caches separate for requests with different query parameters. Refresh pagination Link metadata on 304 responses while reusing cached bodies and decoded values, so lists follow the current next page and stop when its Link disappears.

github-mutation-checks.md

Packages: @shivaedev/github

Added

• Send PUT and DELETE through the shared authenticated mutation path, omit absent request bodies, and decode bodyless 204 results as void by omitting the response schema or using Schema.Void.

Added

• Find the latest commit check run by name, app ID, or both with findLatestCheckRun, and create or update it with upsertCheckRun. Check-run responses expose the app ID when present and recognize GitHub Actions-only read statuses.

Breaking

• CreateCheckRun requires a conclusion when status is completed, with validation before any request. Consumers creating completed runs must supply conclusion; use queued or in_progress when no conclusion is available.

Breaking

• CheckRunStatus includes waiting, requested and pending from GitHub Actions responses. Consumers with exhaustive status handling must add these cases. GitHub App create and update inputs remain restricted to queued, in_progress and completed.

heavy-lock-child-path.md

Packages: @shivaedev/heavy-lock

Fixed

• Pass the selected lock path in the held environment so child processes join the same lock when an explicit lockPath overrides their environment.

heavy-lock-live-reclamation.md

Packages: @shivaedev/heavy-lock

Breaking

• Reclamation uses a shared <lock>.reclaim directory and checks ownership before removing a stale file, so competing reclaimers never displace a live holder. Stop participants and upgrade every implementation sharing a lock path to the documented gate protocol before restarting them; implementations that rename the lock during reclamation cannot safely participate.

Fixed

• Remove draft lock files after partial writes, acquisition failures and interruption.

Fixed

• Report draft and reclamation-gate cleanup failures as acquisition failures, rolling back any newly acquired hold. Scoped release failures surface as defects containing a HeavyLockError and preserve a work failure alongside the cleanup failure.

heavy-lock-runtime-services.md

Packages: @shivaedev/heavy-lock

Changed

• Generate lock IDs through Effect's Crypto service and read process metadata and signals through runtime adapters.

Breaking

• Acquisition now requires Crypto.Crypto alongside the filesystem, path and process-spawning services. Provide NodeServices.layer, or add NodeCrypto.layer to a custom platform layer.

Breaking

• Import signal helpers from @shivaedev/heavy-lock/adapters/signals.ts instead of @shivaedev/heavy-lock/cli/signals.ts.

historical-migration-steps.md

Packages: @shivaedev/test-sql

Fixed

• Keep migrationSteps().migrateTo and the starting phase of migrationUpgrade at the requested numbered migration without running current-schema components or publishing a release. Full migration runs still apply components and record the configured release through migratePostgres.

hosted-migration-changes.md

Packages: @shivaedev/server

Fixed

• Install PostgreSQL change hooks before preparing hosted migrations so committed repository writes refresh subscribers in other processes exactly once.

http-pagination-origin.md

Packages: @shivaedev/http, @shivaedev/github

Fixed

• Remove userinfo, query strings and fragments from status-error URLs.

Fixed

• Keep pagination links on the request's origin.

Breaking

• Pagination rejects automatic fetch redirects so custom headers cannot reach another origin. Pass a direct same-origin page URL instead of a redirecting URL; links to later pages must also use direct URLs. Other fetch options in the current Effect context are preserved. Use a client without redirect-following middleware.

Breaking

• GitHub listing methods inherit the redirect restriction. List the repository's current API path instead of an endpoint that redirects after a rename or transfer.

identity-auth-sql-interruption.md

Packages: @shivaedev/identity

Fixed

• Interrupting a session lookup, provider-account lookup or mounted Better Auth request cancels its pending PostgreSQL query. Transaction commit, rollback and connection cleanup still finish after cancellation.

Fixed

• Present SQL interruption to Better Auth as a cancelled request so an interrupted session lookup does not log an internal server error.

identity-command-viewer.md

Packages: @shivaedev/identity

Fixed

• Compute command invalidation once with the resolved viewer and publish declared changes for optional-auth commands, including anonymous callers.

incomplete-board-inventory.md

Packages: @shivaedev/work-board, @shivaedev/work-fleet

Fixed

• Work Board reports unreadable child directories by path and keeps identity, search and membership incomplete until they can be read again. Fleet execution records remain visible without an unverified document join.

Fixed

• Work Fleet refuses to select a Board identity while sources are unavailable.

Breaking

• Work Board's Changes.files is replaced by Changes.inventory, which returns { files, unavailable }. Consumers must read inventory.files and qualify identity and membership using inventory.unavailable. updateFiles accepts and returns this inventory. Navigation membership counts are nullable; treat null as unknown while the index is incomplete. listMarkdown fails when a directory cannot be read; use scanMarkdown to inspect readable files alongside unavailable paths.

Breaking

• Work Fleet Board reads fail with BoardFailure code incomplete-observation while sources are unavailable. Consumers must treat identity and membership as unknown and retain existing execution state until sources can be read again.

jobs-error-callback-scope.md

Packages: @shivaedev/jobs

Fixed

• Tie onError callbacks to the jobs Layer's lifetime. Closing the Layer interrupts pending callbacks and waits for them to end before release completes; callbacks that finish before shutdown behave as before.

jobs-redacted-diagnostics.md

Packages: @shivaedev/jobs, @shivaedev/admin

Fixed

• Redact scheduled worker logs using the same diagnostic policy as queue workers. Job details sanitize stored failure output and source failure output through the same schema as job listings, including native pg-boss timeout records.

jsonb-filter-values.md

Packages: @shivaedev/sql

Fixed

• Match SQL NULL for null equality filters on JSONB fields in reads, counts and deletes. Values accepted by the column schema compare through its codec before filter operators are considered, including JSON objects with gt or in keys.

late-save-drafts.md

Packages: @shivaedev/form, @shivaedev/react

Added

• Form and React submission configurations accept a savedValues mapping to normalize a successful submission against its captured baseline while retaining later field edits.

Fixed

• Editors preserve newer received baselines when an earlier save completes, and merge normalized saved fields without erasing later edits.

Fixed

• Create forms retain optional keys removed while a submission is in flight when resetting their inputs.

local-docker-endpoint.md

Packages: @shivaedev/local-postgres

Fixed

• Pin Docker operations to the validated local endpoint and refuse conflicting Docker host or context settings in the command environment before invoking Docker.

many-github-installations.md

Packages: @shivaedev/github

Added

• One githubApp Layer now provides GitHubApp and withInstallation to share clients across installations, with separate token refresh, conditional caches and rate-limit state. The cache holds at most 100 clients, evicts the least recently used client when full and replaces clients after 30 minutes idle.

mapped-auth-role-administration.md

Packages: @shivaedev/identity, @shivaedev/admin

Added

• Accept the application's Better Auth options in role assignment, provider-account role seeds and admin Users handlers to follow custom table and column mappings. Existing calls retain the default mapping.

Fixed

• Preserve the configured role column when mounting stored roles, generating role-aware migrations and checking the auth schema.

mcp-issuer-discovery.md

Packages: @shivaedev/mcp

Fixed

• Serve OAuth discovery at the configured issuer's discovery path, including custom and root issuers.

Fixed

• Keep OAuth metadata rejections in the typed AuthUnavailable channel and retain the original cause of configuration, metadata and grant failures.

Fixed

• Accept case-insensitive bearer authorization schemes.

mcp-user-admission.md

Packages: @shivaedev/mcp, @shivaedev/identity

Added

• Identity mounts expose admitsUser(userId) to check the current sign-in policy for authenticated users on other transports, without caching rule verdicts.

Fixed

• Identity checks with a zero recheck interval start an independent rule lookup even while another check for the same account is pending.

Breaking

• MCP's betterAuthMcp requires admitsUser. Pass admitsUser: mounted.admitsUser from betterAuthMount alongside auth: mounted.auth. Each MCP request refuses users denied by the identity sign-in policy; existing tokens follow admission changes on the next request.

merged-run-reports.md

Packages: @shivaedev/vitest-rerun

Fixed

• Judge coverage thresholds against merged coverage, preserve rerun unhandled errors in JUnit and snapshot totals and coverage in JSON, and remove attempt snapshots when a run is interrupted.

Breaking

• Code constructing Snapshot values for the exported internal merge API must supply summary with Vitest's snapshot summary. The runner creates this field automatically.

native-postgres.md

Packages: @shivaedev/local-postgres

Fixed

• Accept PostgreSQL 18.6 distribution version suffixes and leave native server connection limits unchanged when the managed container is unavailable.

Fixed

• Return a typed LocalPostgresError for malformed URL password escapes instead of a defect.

Breaking

• clientConnection now returns an Effect. Replace direct calls with yield* clientConnection(url, options) inside an Effect program so password decoding failures stay in the typed error channel.

nested-field-refs.md

Packages: @shivaedev/form

Fixed

• Nested field refs read and write object properties and array elements without overflowing the stack.

otlp-response-bounds.md

Packages: @shivaedev/server

Fixed

• Limit OTLP collector response bodies to 64 KiB, cancelling oversized responses with a typed HTTP decode error while preserving bounded, redacted failure diagnostics.

Fixed

• Fail host startup with a typed configuration error for malformed or non-HTTP(S) OTLP endpoints instead of disabling export or falling back from an invalid traces endpoint.

otlp-story-readouts.md

Packages: @shivaedev/test-story

Added

• Read exported secrets, traced SQL queries and reported errors from the fake OTLP receiver in stories.

Added

• Build a scoped tracing layer with the tracer logger included, and flush buffered and in-flight spans to the receiver without stopping tracing.

pr-watch-incomplete-required-checks.md

Packages: @shivaedev/pr-watch

Breaking

• checkFailures can return undefined when required-check metadata is incomplete. Direct callers must treat undefined as pending and retain their last observation until metadata is complete; true still means a required failure and false means no required failures were observed with sufficient metadata.

Fixed

• Keep observations pending when required-check metadata omits a failed check or status, or lacks a cursor for remaining pages, instead of saving a snapshot with no failing required checks. Preserve known required failures and resume observations when metadata is complete.

pr-watch-interruptible-output.md

Packages: @shivaedev/pr-watch

Fixed

• Allow shutdown to interrupt pending transition output callbacks without saving the undelivered snapshot, so the transition remains available on restart.

Fixed

• Preserve stop emission errors as typed failures, including when polling fails.

proxy-url-parameters.md

Packages: @shivaedev/test-sql

Fixed

• Route PostgreSQL URLs with host or port query parameters through the disconnect proxy, so setReachable(false) cuts existing connections and refuses new ones.

quality-custom-service-config.md

Packages: @shivaedev/quality

Fixed

• Accept local rules that require custom Effect services in defineConfig, while preserving their rule IDs and schema input types.

quality-empty-biome-selection.md

Packages: @shivaedev/quality

Fixed

• Refuse empty Biome selections with a Quality repair message for both quality lint and quality fix on Biome 2.6.3.

quiet-field-rejections.md

Packages: @shivaedev/form

Fixed

• Keep a field's server rejection when it loses focus without a value change. Changing the rejected input still clears the server message.

quoted-credential-assignments.md

Packages: @shivaedev/errors

Fixed

• Redact complete single- and double-quoted credential assignments, including spaces, escaped quotes and multiline values, while preserving surrounding public text.

reader-live-windows.md

Packages: @shivaedev/react

Breaking

• Direct callers of @shivaedev/react/client/mountLive.ts now run mountLive(client, window) as an Effect requiring AtomRegistry.AtomRegistry, instead of passing the registry as its first argument. Provide the registry with Effect.provideService(AtomRegistry.AtomRegistry, registry) and call the returned cleanup when the reader unmounts.

Fixed

• Keep live coalescing overrides owned by each query reader, so removing a reader restores the remaining reader's override. Clearing a session's live coalescing override restores the binding's original window.

record-global-retries.md

Packages: @shivaedev/quality

Added

• Report test, suite and story registrations that declare a retry option with tests/global-retries. Remove local retries so vitest-rerun's global reruns record flakes.

rejected-response-bodies.md

Packages: @shivaedev/http, @shivaedev/github

Fixed

• Release response bodies before returning status or body-size failures, and keep schema failures from holding HTTP connections.

Fixed

• Release GitHub response bodies on rejection and before refreshing a rejected installation token, so repeated failures do not exhaust the connection pool.

release-migration-paragraphs.md

Packages: @shivaedev/releases

Fixed

• Preserve blank lines between indented release-note paragraphs in collected changelogs and migration checklists.

released-workers-stop.md

Packages: @shivaedev/sql, @shivaedev/jobs, @shivaedev/server

Fixed

• Fail the scope coordinating a worker release with the original cause when heartbeat or ownership polling retries are exhausted, and stop registered jobs workers before removing the release lease. Application-host workers can no longer keep fetching after their release coordinator fails.

removed-release-dependencies.md

Packages: @shivaedev/releases

Fixed

• Reject planning, applying and checking releases with published dependencies on removed packages, including registry version ranges, and name the dependent and removed package. Snapshot plans also reject missing workspace: targets without base manifests. Development-only dependencies and private dependents do not block removal.

Breaking

• planRelease, applyRelease, and the plan and apply CLI commands now read the Git base to reject removed dependencies even with registry version ranges. Run them in a Git repository with a resolvable origin/main or main and common history. Effect API callers must provide ChildProcessSpawner.ChildProcessSpawner alongside FileSystem.FileSystem (for example with NodeServices.layer) and handle GitError failures from history reads. For Git-free snapshot planning, call computePlan(packages, sources, previousPackages) with the base packages explicitly.

rerun-task-identities.md

Packages: @shivaedev/vitest-rerun

Fixed

• Refuse reruns that change a test name, suite name or task kind at the same Vitest ID, preserving the earlier final reports instead of reporting a false recovery.

reserved-changes-operation.md

Packages: @shivaedev/contract

Fixed

• Reject authored queries, commands and streams named $changes with a declaration error instead of silently replacing them with the built-in changes stream.

retry-skills-sync.md

Packages: @shivaedev/skills

Fixed

• Allow a failed first sync or a failed sync of newly selected skills to be retried after the copy failure is resolved, while preserving repository-owned skills.

Fixed

• Refuse sync before changing files when .agents/skills and .claude/skills resolve to the same directory.

route-query-recovery.md

Packages: @shivaedev/react

Added

• Return a useRetry hook from queryRoute so a route's error component can refresh its query and render a successful result without rebuilding the query or replacing the surrounding shell.

Added

• Accept optional redirects.signedOut and redirects.refused callbacks for native typed TanStack redirects. Signed-out redirects can preserve the full return location with signInSearch; refused reads handle both Forbidden and QueryReadDenied.

Breaking

• Direct calls to the loader returned by queryRoute now require location alongside abortController, context, deps and params. Pass the native TanStack loader context, or add the requested location to a custom loader invocation.

screen-find-timeout-cleanup.md

Packages: @shivaedev/test-story

Fixed

• A timed-out DOM screen lookup closes its interrupted React act() scope before the story finishes, so later stories in the same file render and respond normally.

service-reference-requirements.md

Packages: @shivaedev/service

Fixed

• Accept native Context.Reference keys in defineService requirements without treating their never identifier as caller-owned Scope.Scope.

session-stream-owner.md

Packages: @shivaedev/contract

Fixed

• Run session-owned streams through their owning registry's client, preserving its transport and headers and ending the streams when the session closes. Streams without a session owner continue to use the caller's client.

shared-rate-limit-refusal.md

Packages: @shivaedev/errors, @shivaedev/rate-limit

Added

• @shivaedev/errors' shared TooManyRequests accepts optional key and retryAt fields, preserving rate-limit details across RPC while still accepting message-only failures.

Breaking

• @shivaedev/rate-limit now fails with the shared TooManyRequests. Replace imports from @shivaedev/rate-limit/TooManyRequests.ts with @shivaedev/errors/taxonomy.ts and add @shivaedev/errors as a dependency. Use that shared schema in contract rejections and custom stores. Its key and retryAt fields are optional because other callers can create message-only failures; check for their presence before using them. The limiter continues to supply both fields. The old module is removed without an alias.

signed-webhook-stories.md

Packages: @shivaedev/webhooks

Added

• Deliver signed webhook payloads to an application's HTTP route with deliverWebhook from @shivaedev/webhooks/server/testing.ts. It resolves the source's configured secret, signs GitHub deliveries by default, accepts custom signers and header overrides for refusal stories, and returns the native Effect HTTP response without a test-story dependency.

stale-biome-exceptions.md

Packages: @shivaedev/quality

Fixed

• Reject stale Biome lint and assist exceptions during quality lint, naming the file/rule pair to remove from the selected Quality config.

starter-enclosing-repository.md

Packages: @shivaedev/create-app

Fixed

• Apply starter updates to apps inside enclosing Git repositories while preserving sibling files and unrelated staged changes. Keep the generation record unchanged when a nonempty starter delta applies no changes.

starter-note-save-delete.md

Packages: @shivaedev/create-app

Fixed

• Generated notes apps show an alert when adding or saving a note defects, keep the draft, and handle delete completion in the note's own action.

starter-production-email.md

Packages: @shivaedev/create-app

Fixed

• Generated Railway workers receive shared RESEND_API_KEY, EMAIL_FROM and PUBLIC_URL settings. Production workers require an explicit email sender at startup; deployment instructions describe queued auth email delivery and the worker's production settings.

starter-signal-settlement.md

Packages: @shivaedev/create-app

Fixed

• Generated starter stories settle through screen pending signals and completed HTTP/live results instead of status markup or timed connection sampling. Remove the redundant third-party session lifecycle fixture and its teardown delays.

steady-migration-runners.md

Packages: @shivaedev/sql

Breaking

• Migration runners with schema components or a release now hold a session advisory lock through components and release publication. Allocate at least two pool connections for an active runner plus capacity for waiting runners and other work, and migrate transaction-pooled connections to direct connections or session pooling. Components continue to run outside the ledger transaction. Runs with only numbered migrations retain their transaction lock and one-connection pool support.

Breaking

• Direct callers of postgresRelease(...).apply must handle SchemaError alongside SqlError because the component now decodes its PostgreSQL clock row.

Fixed

• Publish a release only after every component succeeds, and reject marker writes from invocations older than the recorded one. recordedAt identifies the invocation's PostgreSQL start time; a new invocation can still deploy an earlier release label.

story-kit-imports.md

Packages: @shivaedev/test-story, @shivaedev/test, @shivaedev/quality

Changed

• Story kits and the Effect test adapter import native Effect submodules instead of whole barrels. Cookie windows, member windows, React mounting and OTLP decoding load when used; browser RPC imports use dedicated modules.

Changed

• App test workers reuse Node's on-disk compilation cache while keeping Vitest's file isolation.

story-lifecycle-diagnostics.md

Packages: @shivaedev/test-story

Fixed

• Creation failures keep their original cause and name the story kit, the create phase and the rerun command. Cleanup failures evaluate asynchronous inspect hooks with the kit's services and print their state instead of serializing an Effect.

test-layer-timeout.md

Packages: @shivaedev/test

Fixed

• Interrupt pending file Layer acquisition when its test times out and run registered finalizers before file completion without unhandled rejections. Fixture tests, it.effect and it.live share a five-second cleanup limit and TestScopeCloseTimeout error.

test-sql-pending-acquisition.md

Packages: @shivaedev/test-sql

Fixed

• Allow rollback tests to be interrupted while waiting for a pooled connection without turning interruption into a failure.

Fixed

• Include the lock holder's connection acquisition in a race's lock-taking timeout.

transact-pending-acquisition.md

Packages: @shivaedev/sql

Fixed

• Allow interrupted transactions to stop waiting for a pooled connection while preserving announcements for commits that land during interruption.

webhook-mapping-request-scope.md

Packages: @shivaedev/webhooks

Fixed

• Run each webhook mapping in its own request scope so acquired resources are released when the request finishes, including on failure or interruption, instead of at application shutdown.

webhooks-failure-phases.md

Packages: @shivaedev/webhooks

Fixed

• Classify webhook failures at the receiving phase: invalid payloads return 400, while application schema errors return a logged 503. Preserve frozen application failures and their tags without mutating them when attaching the retry response.

Breaking

• WebhookEvent.decode reports payload decoding failures as WebhookPayloadError from @shivaedev/webhooks/server/WebhookPayloadError.ts, with the original SchemaError in cause. Direct callers must catch WebhookPayloadError instead of SchemaError for invalid payloads. Custom event decoders must wrap payload schema failures in new WebhookPayloadError({ cause }), or use webhookEvent to separate decoding from application mapping. Application failures keep their original error types.

Decisions

• Enable Allow GitHub Actions to create pull requests under Settings → Actions → General → Workflow permissions. Only GITHUB_TOKEN is used.
• While this PR is in the merge queue, the automation leaves it untouched so a force-push cannot eject it.

[tally-code-quality]

Coverage 89.6% (±0.0 pts) · Patch 100.0%

Both added lines are covered.

_{4c575e2 (merged onto 923ee33) vs main at 923ee33 · updated Nov 2, 01:19 UTC · Full report}