#3976
Scheduled flaky-test detection is failing
#3939
v3 read model: guard against aliased key spellings on case-insensitive filesystems, without slowing replay
#3954
Scheduled flaky-test detection is failing
#3918
stagecraft remote studio: one long-lived connection to serve instead of a swamp process per read
#3921
stagecraft remote studio poll: follow-ups from #3658 review (flaky test, mid-poll first page, quiet-poll test)
#3965
docs(manual): the manual documents swamp subscription status and start — standings, call to action, flags and --json output
#3951
swamp subscription start opens the Swamp Club billing page, or a collective's with --collective, and status points its call to action at it
#3916
v3: the compaction policy bounds how much history a fresh clone replays (retainMs, minCommits, retainCommits) and the base load skips files the tail removes
#3953
datastore_v3_replica_verify_test stall case flakes under the full integration run: restore.pid is read before the stub writes it
#3935
v3 on S3/GCS: a replica restore yields a corrupt commits.db (fails SQLite's integrity check), so fresh clones and restores of the datastore fail; reproduces with Litestream alone from its first compacted L1 file (found by #3916)
#3950
swamp subscription status reports the plan and billing standing of the signed-in user and each collective, worded as auth whoami words it
#3949
/o/<slug>/billing sends a signed-out visitor to the collective page, or a 404 when private, instead of through login and back like /billing
#3942
swamp-extensions GCS storage test 'put: an abort mid-upload leaves no object and no resumable session' fails about 1 run in 5 (fixed 50 ms sleeps)
#3947
refactor(cli): share auth whoami's collective-standing helpers ahead of swamp subscription, and pin Personal License and Admin standings
#3924
@swamp/cve/tailworm: check the reachability matrix against a Tailscale-hosted tailnet
#3944
AWS codegen treats nested primaryIdentifier pointers as top-level fields
#3943
AWS codegen collapses nested createOnly/readOnly paths to their last segment
#3946
Generated state schemas require every child of nested objects, so normal resources warn on create/get
#3901
swamp-club.com/cve/tailworm states two things its sources do not say: finding 5's memory growth and no exploitation in the wild
#3945
cve/tailworm extension README says the findings were not seen in the wild, which no source states
#3915
Datastore rework Phase 5 (team mode) 1/3: serve's datastore API — commit, chunk and catch-up endpoints, authorisation on each op's intent, principal stamping and actionable conflicts
#3923
@swamp/cve/tailworm: reachability follow-ups from #3919 review
#3919
@swamp/cve/tailworm: opt-in reachability matrix from each node's packet filter
#3922
Datastore rework Phase 5: content-level authorisation for forwarded definition and evaluated-file writes
#3920
swamp-club.com/cve/tailworm: cover grade, probeScript, gradeFleet and the reachability matrix (extension 2026.10.25.5)
#3913
Docs: --trusted-hosts accepts host:port for public addresses on non-default ports
#3900
@swamp/cve/tailworm: after mitigate caps headscale, the rescan still tells you to set MemoryMax and Restart=always
#3910
@swamp/cve/tailworm grade: unix serve targets the probe could not resolve are graded as ordinary sockets
#3909
kubernetes: externalsecret and normalizeMeta follow-ups from #3907
#3902
v3 crash recovery's progress line breaks --json stderr: a failing command that recovered prints text before its JSON error (regression from #3363 / #3893)
#3877
Docs: vaults reference should say a wide local_encryption key file gets a warning
#3859
Docs: manual states the old pre-flight check rule and scores fast-check by deno doc --lint
#3821
Docs: define the sensitive-output fallback vault order and document the doctor vaults fallback warning
#3893
v3 long silent waits: crash recovery runs ~24 s with no output, data prune is silent 6-10 s in log mode, and a lagging read hangs ~112 s when Litestream's listing is cut (found by #3756)
#3889
Add @swamp/cve/http2shell: scan and mitigate the Brotli decoder RCE (CVE-2026-111497, Node2Shell/HTTP2Shell)
#3891
extension_tarball_analyzer_test fails on macOS: tar --mode is GNU-only
#2907
S3/GCS datastore: a push that fails after uploading drops its recorded deletes, so the retry brings deleted data back
#3860
v2 S3: about 4-5% of serial workflow runs fail with datastore_unpublished_data_version ('a concurrent run or the serve poller synced') when nothing else is running (found by #3756)
#3756
Datastore rework Phase 4 I: dogfood and benchmark solo v3 (filesystem, S3, GCS) in a throwaway repo with the released binary, check the kill criteria, and decide whether to announce
#3882
v3 bucket outage: a command cut off while becoming the writer says its changes are saved locally when nothing was saved (workflow approve), and the suggested recover fails for a run cut mid-step (found by #3756)
#3879
auth login browser flow prints a fatal stack trace when swamp-club cannot be reached
#3880
Scheduled flaky-test detection is failing
#3803
v3 first clone and restore of a bucket datastore take 2.6-3x v2, missing #3418's 1.5x target (found by #3756)
#3767
CVE pages: horizontally scrolling code blocks are not keyboard-reachable
#3800
Homepage club plate link has no visible keyboard focus
#3788
Scheduled flaky-test detection is failing
#3822
swamp update downloads before failing in a sticky directory with another user's binary, and blames an immutable flag
#3771
Docs: extra-headers how-to systemd snippet puts a path in SWAMP_SERVE_EXTRA_HEADERS
#3823
Docs: install-swamp says SWAMP_HOME moves everything, but agent skill folders stay in the user's home folder
#3792