#2223
Security Center: complete location-scoped finding snapshots for current-run reporting
#2217
IAM service accounts: verified deterministic-account lifecycle method with safe 404/409 handling
#2227
Secret Manager: complete metadata-only secret/version hygiene snapshot across projects
#2198
extension push: allow explicit private visibility in the manifest and at publish time, including public collectives
#2221
Verification reviews infer pass from Claude usage-limit errors
#2203
Publishing manual contradicts registry omission defaults and supported visibility values
#2200
Registry API: opt-in private visibility at publish time with fully backward-compatible defaults (prerequisite for CLI #2198)
#1716
Generic OTLP endpoint appends signal path after query or fragment
#1696
Cloud Build create supplies project instead of required projectId path parameter
#1756
Make official Docker image OCI-compliant
#1694
Global Secret Manager methods build an invalid regional parent
#1249
Telemetry stats consumer: unsanitized subcommand in Mongo update path drops user metrics silently
#1071
Slow Mongo: subscription.findByCollectiveId N+1 fan-out inflates p95 (lab issue list)
#1025
Scorecard: beta/rc-only extensions show "not scored" despite successful scoring (GET /score resolves only latestVersion)
#843
Make serve WebSocket idle/keepalive timeout configurable (untunable default aborts runs when serve's loop briefly blocks)
#171
CLI dumps 300-line Cliffy Command object on unknown flags / subcommands
#164
swamp datastore sync is minutes-slow at 4k-file scale even with zero-diff; outer 300s timeout fires
#157
swamp extension install: datastore push hangs ~8.5m then crashes with Deno TLS panic (tls_wrap.rs:1918 unwrap on None)
#123
User extensions silently dropped when base type not yet registered at scan time
#125