[github-actions]

🤖 I have created a release beep boop

0.2.0 (2026-10-28)

⚠ BREAKING CHANGES

• require a fresh database without retired archives (#30)

Features

• automod: add custom rules, scoping, and new rule types (#196) (794fc50)
• automod: manage known-bad image hashes in WebUI (#211) (71bc393)
• bot: add bounded exact-image spam test mode (#55) (f43ba88)
• bot: associate Discord audit entries with bot-owned cases (#65) (1b21293)
• bot: capture proving Discord attachments into evidence (#64) (3e2f1dc)
• bot: complete exact-image and repeated-text spam enforcement (#57) (90957aa)
• bot: fence nickname requests by membership and immutable identity (#38) (552082b)
• bot: keep database writes on the bot process (#185) (7a2d748)
• bot: log role, voice, nickname, username, and thread events (#182) (a0b4fb1)
• bot: note prior cases when a member rejoins (#384) (9363bed)
• bot: observe guild memberships with bounded repair (#34) (ea1515f)
• bot: optional reason DM on kick and ban (#381) (5548438)
• bot: report a member's cached voice channel (#385) (2b46d16)
• bot: show container CPU and memory on status (#183) (3abda44)
• conductor: add local encrypted backup and restore (#59) (c37b056)
• conductor: add owner administration and permission preview (#58) (b0e6ffb)
• conductor: add public install validation and operator docs (#63) (f2427a8)
• conductor: discover signed Stable and Nightly releases (#61) (a522871)
• conductor: install selected releases and roll them back (#62) (2a3162e)
• conductor: move enrolled guilds between shared and dedicated stores (#60) (0abfaf6)
• db: add bounded append-only case history with owned removal (#50) (1df3d56)
• db: add inactive durable action queue storage (#33) (1e6e394)
• db: add scoped cases with bounded text evidence and replay-safe removal (#49) (00e84f8)
• db: bind queued actions to captured guild membership (#35) (2091e6c)
• db: journal bounded evidence ownership and cleanup settlement (#52) (35c12e1)
• db: link canonical case sources with retained replay protection (#51) (7c3d5f4)
• db: scope guild-store log settings to captured membership (#48) (f801f6a)
• db: verify captured membership in configuration transactions (#39) (50e39ed)
• db: verify separate guild-store identities and initial bindings (#47) (7574d1b)
• evidence: add Bunny Storage transfers and recovery (#54) (e8face3)
• evidence: add local streaming capture and cleanup (#53) (8ec4e1b)
• make stats and Discord logs easier to read (#89) (a0238b2)
• report routine Discord activity without SQL history (#29) (f132217)
• retain message snapshots and expose owner database usage (#103) (e8d8415)
• status: expose API container use over private read link (#198) (61f72ef)
• tenant: route live guild stores, cases and erasure (#56) (c80e652)

Bug Fixes

• api: cache guild-list auth checks and drop dead Discord logins (#217, #224) (#232) (bd5c958)
• api: cap concurrent connections on the private read listener (#263) (d7e34a1)
• api: finish typed authentication errors (#330) (88020fc)
• api: preserve action-key errors across the control link (#256) (400f7a6)
• api: release the database lock when a write times out (#149) (877c0bc)
• api: reserve the web listener before the private read bind (#259) (e09199a)
• api: respect shared refresh cooldown after session hold expires (#326) (93f5c9a)
• api: stop guild checks from hammering Discord's rate limit (#145) (1b0d9df)
• api: wait for first-boot SQLite database (#255) (55cc8a5)
• automod: skip exact-image actions when the digest was removed after admission (#324) (2e7fbc1)
• batch snapshot capture and shorten writer locks (#174) (5983eb0)
• bot: bound Discord retries on permanent errors (#227) (e4813fc)
• bot: bound oversized hash sets in automod notices (#184) (41cbe77)
• bot: cap each lease CAS attempt so a hung stream can retry (#240) (#323) (f6e63aa)
• bot: capture ban echoes without losing failure releases (#260) (3619977)
• bot: commit member-sync pacing off the log-delivery future (#362) (aa40dd7)
• bot: count guild-store cases on the stats card (#307) (ec2c052), closes #222
• bot: cut member_sync idle database load (#150) (8374a2c)
• bot: fence ban audits and preserve split attribution (#332) (e884952)
• bot: hash exact-image bodies when the declared size is short (#377) (2d0ca3c)
• bot: hold token rejection in-process under pre-revision-7 launchers (#245) (#313) (426367a)
• bot: lease renewal CAS only ever extends expiry (#237) (#310) (58d3857)
• bot: notify member sync on global rate-limit waits; paused-clock 429 tests (#360) (a62ce5b)
• bot: preserve ban attribution across delayed and cancelled callbacks (#344) (4a2b108)
• bot: preserve guild recovery generations after eviction (#333) (9698f4b)
• bot: re-sync slash commands only for the edited server (#226) (#320) (ad0e8b2)
• bot: record one ban row and a manual moderation event (#195) (9dd8d90)
• bot: remember permanent 403/404 Discord REST targets (#288) (8a1cd9f)
• bot: renew the active-bot lease and launcher fence with one CAS request (#213, #214) (#230) (278118a)
• bot: renew the active-bot lease before slow startup work (#212) (f8c3c13)
• bot: report exact-image matches instead of a budget notice (#177) (384cbda)
• bot: save member-sync deadlines from the rate-limit hook (#351) (7c8bae9)
• bot: skip redundant !say confirmation in the invoking channel (#77) (8ed8bc0)
• bot: skip slash command re-sync on unchanged command saves (#226) (#309) (cfad44d)
• bot: stop a slow container-use reply from outliving !stats (#264) (0224ce6)
• ci: bump rustls to 0.23.46 and expire the h2 audit exception (#350) (8cab70a)
• ci: bump webpki crates for RUSTSEC-2026-0381 through 0383 (#363) (4ae771d)
• ci: report owner-triggered Pullfrog PR checks (#98) (d3a57b0)
• ci: scope PR checks and main image rebuilds to affected components (#114) (bddb98f)
• ci: skip conductor for manual SHA publication (#97) (b44e491)
• ci: timed runner deadline and EXIT trap fixes (#253) (#296) (7f97374)
• ci: timed runner parity with cargo for excludes, signals and ignores (#301) (72b4ee7)
• db,api: follow up startup and rate-limit fixes (#146) (4dc472f)
• db,api: stop web reads from taking the write lock (#147) (9c8043e)
• db,bot: distinct sub-60s manual gateway bans (#289) (f9db5f2)
• db,bot: record distinct manual bans when a stale mirror remains active (#279) (13809d0)
• db: batch member coverage-gap reconciliation writes (#281) (169201f)
• db: cache guild-store identity checks (#197) (497f9af), closes #153
• db: count copied rule batch payload once (#268) (0a00735)
• db: export schema verification memo type (#267) (57a39e9)
• db: finish coverage-gap admission safeguards (#346) (34fe68b)
• db: keep coverage-gap marks inside the remote write lifetime (#340) (ce87bf5)
• db: keep lease renewal independent of stalled reads (#336) (435f517)
• db: reduce guild-store hot query load (#173) (0226a0c)
• db: release core before guild commits (#328) (d64dd1d)
• db: stop startup seed from holding a remote transaction open (#143) (e3f69ef)
• db: verify the guild identity row on memo hits (#197) (#201) (6f825e0)
• deps: bump quinn-proto to resolve RustSec advisories (#270) (#278) (deff029)
• deps: update h2 0.4 to patched release (#115) (08b217e)
• honor configured logging level and omit message author IDs (#163) (3b0a8ba)
• image-spam: name unfinished exact-image checks and keep stored hashes (#355) (a4de2a1)
• launcher/bot: clear standby on ready and release lease on lost-lease exit (#283) (7168d22)
• launcher: keep the rejected-token candidate across a restart during the hold (#338) (01f65c8)
• launcher: rebind health before database work on the poll tick (#234) (#321) (b7b64b6)
• launcher: refresh /ready reason when a hold retry fails before start (#247) (#312) (d128de2)
• launcher: restore health when the bot exits during a stalled call (#337) (ade8134)
• launcher: restore token-hold health after readiness failure (#343) (7790adb)
• lease: stop waiting on backoff at shutdown (#238) (#306) (c27c5fc)
• logging: redact reported message and credential diagnostics (#327) (406a81a)
• moderation: ban even when the database marker save fails (#148) (248d663)
• recover bans using immutable attempt tags (#257) (0a70379)
• recovery: map session store/flush errors to 5xx (#242) (#308) (3905271)
• recovery: typed auth error in owner() (#241) (#305) (8a34d7c)
• reset idle remote database streams before pool reuse (#99) (aa6098f)
• retain ban events and reconcile durable audits without duplicates (#352) (a2a235a)
• return Discord guild-list rate limits as temporary errors (#102) (2ae6775)
• runtime: handle missing cgroup memory inputs without unsafe estimates (#314) (a8cc702)
• show unavailable when status release reads fail (#172) (faac129)
• startup: separate readiness from liveness and stop API startup writes (54b8672)
• unblock Dependabot version-update cycles on this private repo (#70) (210c479)
• unify compact durations across Discord notices (#171) (c5e205b)
• updater: clear stale queued selections that omit upgrade (#262) (fb1edae)
• updater: clear stored launcher selection with no capability contract (#144) (8615c8e)
• updater: coordinate bot/API schema upgrades and recovery (#138) (c6fd7f6)
• updater: install required launchers before applications (#139) (e3792f2)
• updater: let the baked bot migrate an older database on first boot (#209) (9530e73)
• updater: reclaim launcher fence as soon as the authority window expires (#322) (41f953c)
• updater: recreate a missing launcher_lease row on fence renewal (#231) (#319) (53a55d3)
• updater: serve API reads while a launcher clear is pending (#194) (6d7bf53)
• webui: overhaul Administration updates layout and status (#105) (8d4e1b8)
• webui: preserve save identity across delayed acknowledgements (#261) (3b92858)
• webui: refresh custom rule heading after rename (#266) (234592f)

Performance Improvements

• webui: cut Discord-backed request fan-out (#225) (#317) (28e23b0)

Code Refactoring

• require a fresh database without retired archives (#30) (1003ac1)

---

This PR was generated with Release Please. See documentation.