What changed, in plain language.

Added

• Instance administrators can assign or remove plan overrides for users without requiring Paddle checkout, through a new admin endpoint and plan selection dialog.

Fixed

• Extended button and card touch targets with an invisible bottom area to improve mobile tap usability.
• Removed unnecessary wrapper padding around the Workspace setup guide in the composer.
• Fixed whitespace rendering in feedback dialog radio items.

Changed

• Retired the Post authoring model end to end. Post HTTP routes, MCP post and draft tools, the legacy `publish_post` Job kind, and the `posts` service are removed; the publisher, composer, scheduler, calendar, Engagement, Messaging, and notification paths operate only on Publication and Rendition identifiers. Historical migration files still upgrade older databases, and immutable `legacy_post` / `legacy_post_variant` aliases resolve old links to canonical Publications. The Post compatibility tables (`posts`, `post_destinations`, `post_media`, `post_variants`, `thread_drafts`, `post_media_deliveries`) are dropped after the legacy backfill completes and no Post rows or pending `publish_post` Jobs remain.
• Added repository-owned Oxlint checks that reject unsafe type widening, unverified runtime boundaries, reflective access, module mocking, and other patterns that weaken type and dependency contracts.
• Split engagement and messaging refresh, persistence, provider seams, recurring Jobs, and retries into independent capability outcomes, and removed the transitional communications runtime.
• Contracted REST, MCP, CLI, browser, and direct application Workspace authorization onto one read, edit, or administer decision, removed middleware-owned and membership-only policy helpers, and kept durable Jobs explicitly scoped without user impersonation.
• Extracted Messaging into an independent application module with internal Workspace authorization, capability-specific provider access, stored conversation reads and mutations, durable sends, typed outcomes, provider-write fencing, and its own recurring collection chain over transitional sync-state storage.

66 more entries in the full changelog.

Fixed

• Trimmed the SMTP username so a trailing space in `OPENPOST_SMTP_USERNAME` cannot send a malformed AUTH identity and fail notification email delivery with an SMTP authentication error.
• Logged the terminal failure message when a background Job fails and recorded its retryability in error telemetry, so transient delivery failures are diagnosable without inspecting the database.
• Kept homepage animation cleanup inside the browser lifecycle so marketing prerender no longer calls browser-only animation APIs.
• Kept unlimited Publication scheduling operational when quota storage is unavailable, while preserving canonical usage accounting whenever counters exist and keeping limited plans fail-closed.
• Stopped routine autosaves from replaying the Saved animation and from replacing an unchanged Image Editor document, which refreshed page previews after edits.

5 more entries in the full changelog.

Added

• Added one canonical hosted-plan catalogue and an expiring signed purchase choice that keeps exact pricing and trial terms through password signup, email verification, refresh, and identity-provider signup without defaulting invalid selections to Founder.
• Added an explicit first-Workspace confirmation that shows the selected plan and trial terms, atomically binds the named Workspace to one checkout attempt, and resumes that attempt after refresh without creating duplicates.

Fixed

• Kept thread remove controls above their textareas, tightened publication-history and meme-picker overlays to their content, highlighted the active sidebar draft, removed the redundant AI alt-text review note, and retried one safe transient Memegen catalog read.
• Restored release gating after the hosted purchase-flow merge by accepting formatter-safe provider-catalog sources and checking marketing links and trial copy against the canonical purchase terms.

Fixed

• Qualified PostgreSQL provider-delivery upserts so the durable write fence reaches the provider instead of failing before every publication request.

Changed

• Pruned completed and currently out-of-scope audit-remediation entries so the backlog contains only active or explicitly deferred work.