steid

docs: the handover for the guard and helper refactors

refactor: formatters and URL builders out of browse, into their own modules

refactor: one ownership guard and one write-failure mapping, in context

docs: the git split, folded into plans

docs: handover for the git split

docs: architecture.md stops describing two things that changed

refactor: one file per git port, and both read adapters together

docs: the test-file convention, and the tidy-up wave's first two steps

refactor: git_query's parsers move into four modules beside it

refactor: sqlite's tests move to a sibling file

refactor: git_query's tests move to a sibling file

refactor: webhook's tests move to a sibling file

refactor: browse's tests move to a sibling file

refactor: pull_request's tests move to a sibling file

refactor: repo's tests move to a sibling file

refactor: the settings form's two sections travel as one value

docs: fold the password reset handover into plans and the runbook

docs: the handover for the password-reset step

fix: hash on both forgot paths, and give the reset page a budget it fits in

feat: steid reset-password, for an owner with no email or no access to it

feat: /auth/forgot, /auth/reset/{token}, and a password section on settings

feat: the four ways a password changes, with one set of rules behind them

feat: a Mailer port and an SMTP adapter, so an instance can tell someone a link

feat: password reset records, so a forgotten password has something to spend

docs: the backup holes the handover named, carried into current

docs: fold the backup and restore handover into plans

docs: handover for the backup and restore wave

build: install.sh --backups daily, off by default

feat: an owner-only backup download on the settings page

feat: steid backup and steid restore

feat: one consistent archive of an instance, in and out

feat: count every user, organisation and repository

docs: fold the served-releases handover into plans, and mark 5b done

docs: handover for the served-releases step

fix: a first install kept Caddy's placeholder Caddyfile instead of writing one

ops: serve releases from the instance, and a --publish flag so it keeps happening

docs: fold the metrics handover into plans and the runbook

fix: a handler's error is a response too, so it is counted and headered

feat: /metrics, behind the operator bearer, and the counting behind it

feat: a Metrics struct and a hand-written Prometheus exposition

docs: fold the operator surface handover into plans

docs: hand over the operator surface

build: bump h2 past RUSTSEC-2026-0258, and make cargo audit part of done

feat: an operator surface a control plane can drive without a browser

feat: describe an instance, and let git report its version

feat: count users and repositories, so an operator can be told how big a tenant is

feat: a command line and an operator token, so the ops wave has one shape to fill

docs: the ops step the control plane needs, as the top of the backlog

docs: a DDD and organisation review of the four-wave codebase

build: release 0.4.0, waves 2 to 4