Every release, newest first

✨ Added

• —HTTP idempotency. A mutating call can send Idempotency-Key. The server claims it after the gate and validation, replays the stored response, and holds a lease while do runs. Rows live in oke_idempotency on the journal driver until the TTL (default 24h). The client sends one key per non-GET call and surfaces Idempotent-Replayed: true as meta.idempotentReplayed. The key is 21 characters from crypto.getRandomValues through the okid alphabet, so a page on plain HTTP still sends one. If crypto is missing, the call sends no key and runs once.
• —Client gzip budget is **6 kB** (was 5 kB). The growth is the idempotency feature, not waste: measured client gzip is 5194, which was over 90% of 5120.
• —Effect inference follows a project helper whose parameter is named fx, and a same-function fx.store chain alias. liveQuery and applySearchEmbedCdc record their effects as package intrinsics. The shorter starter's link flows stamp the SQL, KV, and signal effects those helpers perform.
• —Vault audit.sink: "webhook" POSTs each operation as secret-free JSON to vault.audit.webhookUrl. oke vault audit (list, verify, purge) stays on the SQL hash chain and refuses stdout / webhook.
• —otp({ mode: "provider" }) exposes POST /auth/otp/resend for the same SMS number. The provider issues a new code; resendCooldownMs applies. Another channel is rejected.
• —Absolute budget samples that can still double and stay under their cap (cold start, and console initial load while it sits this far under 700 kB) fail CI at 2× the last committed value. The 75 ms cold-start cap stays. The probe keeps the best of five rounds and confirms a failure once, so one noisy run does not fail the build.
• —The okengine/http static import graph fails CI when zod or the hybrid-search runtime is included. Forbidden modules live in one list, so the next heavy module is a single entry.
• —Agent skill oke-perf — before a release, measure budgets, flag drift the gates still allow, bisect to the commit, and fix it with a lazy import, createDebouncedRunner, or a memo (/oke-perf).

💥 Breaking Changes

• —With retry configured, a call retries when it is GET/QUERY or it carries an idempotency key (automatic on every non-GET call). idempotencyKey: false runs once unless that call passes { retry: true }. A 409 IdempotencyInProgress waits for Retry-After and retries within those attempts.
• —createTestApp enforces Manifest tokens. Inline tests that are not an app pass capability: "open". App suites pick the tokens up from the project root.
• —Code that renames, destructures, or lets fx (or a chain alias) escape fails extract with **OKE1900**. Name the parameter fx and keep chain aliases in the same function. An explicit effects block must include every effect inference can see. It may add keys. It no longer replaces the inferred set.
• —Store RLS emit calls pgTable.withRLS whenever rls: true. After upgrading, a command without a policy returns zero rows, with no error, and there is no runtime warning. Shorter adds an open SELECT policy in the same change.

♻️ Changed

🐛 Fixed