Marc-André Bombeck 94854bd8f7 fix(backup): trace an account made for an upload when it is made ...

The upload creates a passwordless account before it reads the file and
deletes it again when the file is refused. The only audit row was
written after a successful store, so a refused upload whose delete also
failed left an account nobody could sign into and no record of where it
came from.

The account and its admin.user.create row (outcome "created") now
commit together, and the discard writes admin.user.delete with outcome
"deleted" or "failed", so a leftover account always has a trace. The
runbook says how to remove one by hand.

2026-10-29 21:42:18 +01:00

..

migrations

feat(v1.4): multi-tenant prep — off-host backup, encryption-key versioning, worker/web split, native-Bearer UA gating (#135)

2026-05-08 14:33:39 +02:00

apple-health-distance-repair.md

fix(ops): stop the distance repair losing its rollup tail in silence

2026-09-10 00:37:15 +02:00

attempt-number-semantics.md

fix(integrations): log a failed sync as a signal, not an audit row

2026-10-20 10:03:30 +02:00

backup-restore.md

fix(backup): trace an account made for an upload when it is made

2026-10-29 21:42:18 +01:00

blood-pressure-missing-diastolic.md

fix(idempotency): replay a key only for the same request body

2026-10-04 10:14:22 +02:00

deploy.md

Merge the release with the security review fixes into the data-safety review fixes

2026-10-25 18:36:54 +01:00

disaster-recovery.md

fix(db-backup): keep instances apart in a shared bucket, and no decrypted dump behind

2026-10-25 17:30:29 +01:00

encryption-key-rotation.md

fix(recovery): the database dumps count in the keys the backups still need

2026-10-25 17:20:16 +01:00

env-check.md

Correct operator runbooks against the current code

2026-08-27 12:18:34 +02:00

heap-diagnostics.md

feat(observability): break the heap sample down by V8 space

2026-10-20 20:27:24 +02:00

intake-repair.md

refactor(medications): drop the compliance rollup table that nothing reads

2026-10-20 13:01:45 +02:00

measurement-maintenance.md

fix(auth): issue a Secure session cookie under the __Host- prefix

2026-10-25 17:44:31 +01:00

mfa-enforcement.md

docs(security): note that required-MFA prompts but does not wall the API

2026-06-27 22:23:54 +02:00

migration-0409-plaintext-location.md

docs(ops): add the recovery steps for an upgrade stopped at migration 0409

2026-10-16 03:57:46 +02:00

password-reset.md

fix(image): ship the operator scripts the runbooks run in the container

2026-09-26 15:26:03 +02:00

postgres-major-upgrade.md

docs: say what deletion keeps and for how long, and drop stale claims

2026-10-25 16:47:00 +01:00

query-statistics.md

ops: load pg_stat_statements in the bundled database

2026-10-08 15:01:02 +02:00

security-recovery.md

docs(01-09): document security contract changes

2026-07-29 14:08:37 +02:00

tls-cert-pin.md

Correct operator runbooks against the current code

2026-08-27 12:18:34 +02:00