What changed, in plain language.

Added

• Added `changes/*.md` fragment workflow that merges per-issue changelog entries into `CHANGELOG.md` under `[Unreleased]` before each release, grouped by heading; fragments are deleted after merge so the manual changelog stays conflict-free across parallel tickets.
• Added `devenv` `doctor` script that proxies to `bun run doctor` for a single local health gate.

Changed

• Made the product clear at a glance in README and marketing with refreshed hero, product screenshots, and copy that shows the Publication and Rendition workspace without hiding provider truth.
• Documented the single backend runtime location for `OPENPOST_PADDLE_*` (`backend/.env` for devenv, container environment for Docker) and clarified that bare `PADDLE_*` is never read; Cloud mode now warns at startup with the exact ignored names without printing values.
• Refreshed product screenshots as trustworthy, exact renders of the current app and documented the fragment workflow with granular check guidance (`check:frontend:types`, `check:contracts`, `test:file`, `test:backend:pkg`) and an `.rgignore` to keep searches fast.
• Staged provider, security, and scheduling flows with progressive disclosure: available providers stay primary while setup-required providers move behind a collapsed section, failed provider errors stay dominant with a retry beside the message, authenticator setup is staged one primary action at a time, quick schedule paths are primary while calendar and randomization are behind disclosure, and Workspace Preferences and Security panels collapse media lifecycle, danger zone, and identity sections.

Fixed

• Instance admin plan overrides now work end to end. Assigning an override previously failed with a 500 because the generated subscription row carried an empty `workspace_id` that violated the Postgres foreign key; the model now stores a NULL workspace, and the override grants plan entitlements exactly like a paid Paddle subscription across billing status, entitlement checks, setup state, and public profiles.
• Removing an override from the plan dialog previously returned 422 because the empty `plan_id` was rejected by request validation; empty `plan_id` now reaches the removal path as documented.
• Resolved configured Mastodon adapter by canonical `instance_url` before dynamic registration so OAuth callbacks find the correct provider key.
• Loaded `SSL_CERT_FILE` into the Go root pool on macOS so local E2E Mastodon CA is trusted without `InsecureSkipVerify`.
• Ignored aborted fetch errors after component teardown and pagehide so stale composer requests do not pollute console telemetry.

7 more entries in the full changelog.

Added

• Instance administrators can assign or remove plan overrides for users without requiring Paddle checkout, through a new admin endpoint and plan selection dialog.

Fixed

• Extended button and card touch targets with an invisible bottom area to improve mobile tap usability.
• Removed unnecessary wrapper padding around the Workspace setup guide in the composer.
• Fixed whitespace rendering in feedback dialog radio items.

Changed

• Retired the Post authoring model end to end. Post HTTP routes, MCP post and draft tools, the legacy `publish_post` Job kind, and the `posts` service are removed; the publisher, composer, scheduler, calendar, Engagement, Messaging, and notification paths operate only on Publication and Rendition identifiers. Historical migration files still upgrade older databases, and immutable `legacy_post` / `legacy_post_variant` aliases resolve old links to canonical Publications. The Post compatibility tables (`posts`, `post_destinations`, `post_media`, `post_variants`, `thread_drafts`, `post_media_deliveries`) are dropped after the legacy backfill completes and no Post rows or pending `publish_post` Jobs remain.
• Added repository-owned Oxlint checks that reject unsafe type widening, unverified runtime boundaries, reflective access, module mocking, and other patterns that weaken type and dependency contracts.
• Split engagement and messaging refresh, persistence, provider seams, recurring Jobs, and retries into independent capability outcomes, and removed the transitional communications runtime.
• Contracted REST, MCP, CLI, browser, and direct application Workspace authorization onto one read, edit, or administer decision, removed middleware-owned and membership-only policy helpers, and kept durable Jobs explicitly scoped without user impersonation.
• Extracted Messaging into an independent application module with internal Workspace authorization, capability-specific provider access, stored conversation reads and mutations, durable sends, typed outcomes, provider-write fencing, and its own recurring collection chain over transitional sync-state storage.

66 more entries in the full changelog.

Fixed

• Trimmed the SMTP username so a trailing space in `OPENPOST_SMTP_USERNAME` cannot send a malformed AUTH identity and fail notification email delivery with an SMTP authentication error.
• Logged the terminal failure message when a background Job fails and recorded its retryability in error telemetry, so transient delivery failures are diagnosable without inspecting the database.
• Kept homepage animation cleanup inside the browser lifecycle so marketing prerender no longer calls browser-only animation APIs.
• Kept unlimited Publication scheduling operational when quota storage is unavailable, while preserving canonical usage accounting whenever counters exist and keeping limited plans fail-closed.
• Stopped routine autosaves from replaying the Saved animation and from replacing an unchanged Image Editor document, which refreshed page previews after edits.

5 more entries in the full changelog.

Added

• Added one canonical hosted-plan catalogue and an expiring signed purchase choice that keeps exact pricing and trial terms through password signup, email verification, refresh, and identity-provider signup without defaulting invalid selections to Founder.
• Added an explicit first-Workspace confirmation that shows the selected plan and trial terms, atomically binds the named Workspace to one checkout attempt, and resumes that attempt after refresh without creating duplicates.

Fixed

• Kept thread remove controls above their textareas, tightened publication-history and meme-picker overlays to their content, highlighted the active sidebar draft, removed the redundant AI alt-text review note, and retried one safe transient Memegen catalog read.
• Restored release gating after the hosted purchase-flow merge by accepting formatter-safe provider-catalog sources and checking marketing links and trial copy against the canonical purchase terms.