v1.0.0-beta.202

Released to production on September 28, 2026 at 12:54 CDT. See every commit in this release on GitHub

New

• Email: every platform email wears the brand-aware header and footer
• Marketplace: a publisher cannot pay itself, and a young one's payouts wait
• Marketplace: screen every submission for phishing, and the platform is a brand
• Commerce: gift cards bought with a questioned payment are frozen or voided
• Payments: card-testing velocity and site-own return URLs on visitor payment doors
• Lockdown: a security lock pauses a site's renewals and payouts; the lift undoes it

Fixed

• Lockdown: the can-still-charge status list is a documented copy
• Marketplace: account age reads across pools; sweeps follow AGL-3365/3367
• Activity log: an SSO member's address is found in their tenant pool
• Console: the site activity-actors lookup carries its lockdown exemption
• Activity log: site feeds and staff cancels name who acted too
• Activity log: every feed row names who acted, never "Someone"
• Console: the lockdown route imports the recurring-charge registry statically
• Email: a usage alert whose org cannot be read still goes, in the platform's brand
• Commerce: paid files, supplier webhooks and the feed stay on honest hosts
• Payments: the card-testing alarm tells the merchant too, and names no threshold

Documentation

• Marketplace: the abuse queue's marketplace rows, and the rules fit their limit

Behind the scenes

• Linear ids: raise the ceiling to AGL-3370, read from Linear
• Sites: the card-velocity dispatcher spec imports its reset by package path