# Changelog and versioning

## Hardening pass
Copied console and homepage cURL commands send literal values through stdin, preventing leading @ values from reading local files and preventing shell expansion of values. Console key changes clear stale metadata/results, and generation clears old capability fields. Status monitor names and legacy error messages render as text; monitors without a heartbeat show Unknown. v1 rejects literal NUL with 400 invalid_value instead of a storage error, and rejects JSON exponent overflow with 400 invalid_json before mutation. Ordinary finite JSON and escaped JSON NUL strings remain supported. Legacy API handlers and contracts are unchanged. No migration or deployment.

## Pass 4 — developer experience
OpenAPI 3.1 at /openapi.json; concise instructions at /llms.txt; reorganized docs, language examples and integration guides. Console adds safe copy-as-cURL, TTL countdown, batch/history-range controls, formatted/raw output and public badge preview. Aggregate HTTP metrics expose freshness and bounded latency estimates. No data migration.

## Pass 3 — optional workflows
Bounded UTC counter history, badge color thresholds and presets, explicit authorized POST consumption and configurable absolute TTL for v1-created burn notes. Additive migration 003; existing counter and burn contracts retained.

## Pass 2 — versioned core API
Generated keys, separate read/write capabilities, metadata/raw/HEAD/DELETE, conditional writes, JSON Merge Patch, touch and bounded non-atomic batches. Opt-in absolute expiry and UTF-8 byte limits. Additive migration 002; no backfill or shortened legacy expiry.

## Pass 1 — approved security corrections
Protected overwrites require existing credentials; cache entries cannot bypass protection, expiry or quarantine. Cross-worker locks and atomic burn consumption; header credentials and credential redaction. Public activity/statistics expose aggregates only. These intentional security corrections were separately approved; legacy query passwords remain supported.

## Policy
Legacy routes and /v1 coexist. There is no forced query-password deprecation or client migration schedule. New features are opt-in or additive. A breaking API contract requires a new major route version and documented migration; urgent security corrections require an explicit compatibility notice. OpenAPI info.version tracks this public contract, not deployment state. Documentation may describe repository features before they are deployed. Never infer that a Git commit deployed a service.

Schemas retain ordinary legacy responses, defaults, whitespace and character-based limits. v1 uses exact UTF-8 bytes and explicit error envelopes. Capability permissions and opted-in absolute deadlines also apply through legacy routes. ETags are opaque; never parse them. Conditional conflicts require rereading state. Do not retry an uncertain mutation or consume blindly.

Namespaced listing, SSE/resume, single-use access tokens, arbitrary binary storage, MCP, webhooks and ephemeral channels remain deferred.