- Mint every gallery token with a jti so one guest's logout no longer
revokes same-second logins of the same event (the revocation key fell
back to eventId + iat once assertActive started running for gallery
sessions).
- Return 400 instead of 500 when require_password is true and no
password is sent through the shared creation service.
- Trust Sec-Fetch-Site: same-origin before the Origin/Host/scheme check
so installs behind a proxy without X-Forwarded-Proto can still log in.
- Redact the newsletter unsubscribe token and order the verb rule ahead
of the public-surface rule.
- Always destroy the pool on shutdown, bound the drain with
SHUTDOWN_TIMEOUT_MS, exit on a second signal, keep orphan download-job
recovery best-effort, restore the S3 importer's first tick.
- Remove the inert allow_presigned_download setting end-to-end.
- Accept "0"/"1" booleans on v1 again and keep the gallery_created email
queue insert best-effort.
- Fetch gallery pages after the first concurrently, stop the progressive
upload refetch from cancelling itself, disable Tiptap v3 TrailingNode.
- Keep nginx crit errors and X-Forwarded-For in the safe log formats.
- Warn once per event on an unparseable expires_at, retry the gallery
event lookup, surface the admin preview denial reason.
Paul Nothaft
06e45e1de4