Orbit 1.7.0: Moderation Grew Up and Sentinel Went Global

A small moderation update escaped containment

Orbit 1.7.0 began with a reasonable request: make Event Logging send notifications again and make the moderation case drawer less cramped. Fourteen commits later, we have a rebuilt moderation lifecycle, member profiles, a cross-guild safety network, new policy controls, safer configuration transfer, a much broader AutoMod simulator, and updated legal documents. This is why our estimates now require adult supervision.

Introducing the Orbit Sentinel Network

Orbit Sentinel is a new cross-community safety system for severe threats that are relevant beyond one Discord server. It is designed for evidence-backed cases such as coordinated scams, malware distribution, credible threats, exploitation, or organised ban-evasion networks. Ordinary server-rule disputes, low-impact spam, personality conflicts, retaliation, and the ancient offence of being annoying in general chat do not qualify.

A participating guild may submit an eligible successful ban case only through a dedicated dynamic permission. The submitted case acts as the anchor, while Orbit captures the complete related non-note moderation history for that subject in the contributing guild. Reports from different guilds are combined into one dossier, the same guild cannot submit the same person twice, and an already listed person cannot be submitted again merely to create a taller pile of identical paperwork.

Every submission requires a fresh confirmation of the current Sentinel submission terms. The dialog explains the narrow eligibility boundary, evidence responsibilities, prohibited retaliatory or knowingly false reports, retention implications, and the consequences of abuse. Acceptance is versioned and audited for each report; there is deliberately no 'I definitely read this once in 2024' shortcut.

A deterministic assessment produces an initial recommendation: decline, manual review, or admission candidate. An unattended decline recommendation may close after 48 hours, but Sentinel can never automatically accept, publish, or globally enforce a report. Admission always requires an authorised human decision with a recorded reason, and authorised reviewers can override the recommendation.

The registry supports public, masked, and private visibility. Identity, avatar, and reason visibility are separately controlled, while the affected person can access a dedicated subject-safe explanation for their own entry. Internal evidence, submitting-guild identity, staff discussion, assessment detail, and enforcement failures are not returned by the public or self-service APIs. Hiding a field with CSS has not been accepted as cryptography.

Authorised reviewers can prepare a public explanation with multiple independent redaction ranges. Orbit stores the staff source separately and compiles a public segment document in which redacted blocks contain no hidden source text, original length, or recoverable metadata. The browser receives a designed blackout, not the secret with a black rectangle politely placed over it.

Accepted entries normally last no more than two years and are projected to participating guilds on a 24-hour cycle. Guilds can maintain explicit bypasses and optionally notify moderators when a bypassed listed person joins. A guild can opt out, while platform policy can separately restrict its ability to submit reports or use Sentinel enforcement when the system is abused.

Opting out starts a durable reconciliation rather than flipping a decorative switch. Orbit removes only bans it can identify as Sentinel-originated and preserves pre-existing or independently imposed guild bans. If Discord permissions prevent cleanup, the guild remains in a disabling state and Orbit retries after access is restored, closing the loophole where removing the bot's unban permission briefly was expected to outsmart the state machine.

An active Sentinel entry materially affects the existing Orbit Standing projection and prevents the listed person from operating Orbit in guilds they own; ordinary administrator access in another owner's guild remains subject to that guild's permissions. The Dashboard presents the restriction explicitly and provides a subject route for the current explanation and appeal path.

Member profiles replaced the internal-note junk drawer

Authorised guild staff can now search members and open a guild-scoped profile containing Discord identity and membership facts, account age where it can be derived safely, moderation history, active-warning summaries, and staff context. The profile stays inside the caller's authorised guild; Orbit did not quietly become a general-purpose Discord identity lookup service.

Internal notes are now separate staff records instead of pretending to be moderation cases. They keep their own authorship, status, timestamps, audit history and permission boundary, which means a note no longer inflates case counts or wanders into case lifecycle controls because two unrelated concepts once shared a convenient table-shaped neighbourhood.

Members can open only their own restricted profile. That view has a focused layout without the moderator navigation shell and excludes internal note bodies, private comments, evidence, unrelated actor metadata and other members' information. Moderators keep the normal guild workspace and member search when their dynamic permissions allow it.

Moderation now has a lifecycle, not just a database row

The moderation page now uses one consolidated filter surface, a wider and more structured case drawer, and a fixed 'New moderation action' control that remains reachable while getting out of the way whenever a dialog or drawer is open. The previous secondary filter bar has been removed. We found that filtering the filters was not, in fact, the missing productivity feature.

Case details are organised around outcome, subject, action, reason, execution, review, appeal and timeline. Empty sections stay hidden, resolved identities replace raw IDs where available, failed actions show a highlighted Discord or permission error, and lifecycle colours distinguish a failed action from a voided or deleted record without assigning every uncomfortable state the same shade of red.

Voiding or deleting a case now updates the linked Discord moderation message and removes stale interactive components such as 'Add missing details'. Permanent deletion stops before destroying data if Orbit knows about a Discord message but cannot safely strip its controls, leaving a retryable operational issue instead of a live button pointing into the void.

A permanently deleted case disappears from queues, search, statistics and ordinary member history, but its direct URL can still return a minimal guild-scoped deletion marker to authorised staff. The marker contains the case number and type, original creation time, deletion time and deleting operator snapshot; it does not retain the subject, reason, evidence, comments or appeal statement.

Warnings remembered that they are a feature

Warnings are now active or inactive records with explicit expiry rather than old cases wearing a warning label. Guilds can set a default duration, optionally allow moderators to choose a finite or unlimited custom duration, deactivate a warning without voiding its case, and require a fresh finite expiry or an explicit unlimited choice when reactivating it. Expiry removes active enforcement weight but preserves the historical case.

Guilds can optionally queue a kick when a member reaches a configured number of active warnings. Count-specific member messages can explain the current total, while system-level limits bound message variants and other warning settings. Discord execution and direct-message results are recorded separately, because 'we tried' and 'Discord did it' are not interchangeable states.

Reviews now require something reviewable

Failed moderation actions no longer enter review, because reviewing a punishment that Discord never applied was mainly an exercise in administrative performance art. Review eligibility is calculated server-side, and the case drawer highlights the failure reason instead of offering controls for a lifecycle that never began.

A guild can disable Orbit's moderation review system. That suppresses new review eligibility and removes review controls globally for the guild without pretending to reverse existing moderation actions. Appeal links remain signed, time-bounded and revocable, and only authorised roles can review the resulting request.

Moderation settings now have their own route and a broader responsive workspace for action-specific appeal rules, member notices, warning defaults, escalation thresholds and review policy. The old compressed panel attempted to display every decision at once and succeeded mainly at making all of them equally difficult to find.

Event Logging can finally prove it sends events

The Core Tool runtime now isolates invalid configuration to the affected tool instead of allowing one malformed option set to disable every guild capability. Event Logging activation, category availability, routing and storage readiness are evaluated separately, closing the failure path where the interface looked configured while the runtime had quietly declined the entire arrangement.

Administrators with `orbit.logs.manage` can send real test notifications for member, message, voice and moderation families to the currently configured guild route. Tests use the guild's effective locale, suppress mentions, validate tool and category policy, and record delivery telemetry. The button does not paint a green tick locally and call that observability. It asks Discord.

Durable source history remains separate from Discord projection. Orbit persists the supported source event before optional delivery, while a diagnostic test creates a real channel message and delivery record without manufacturing a fake guild event. Delivery Health can therefore distinguish disabled tooling, missing routes, unavailable storage, missing permissions, Discord rejection and successful delivery.

AutoMod testing learned about time, channels and attachments

The rule tester can now simulate channel count, attachment count, message count, cadence and repeated bursts instead of evaluating one lonely message in a vacuum. This gives spam, raid, attachment and pacing rules enough context to behave like the rules administrators actually configured.

AutoMod warning actions use the same warning-duration policy as manual moderation. A rule can request warning parameters, but the guild default overrides an unauthorised custom expiry. Custom durations are honoured only when the guild explicitly allows them, preserving one warning lifecycle instead of creating a faster, less supervised copy inside AutoMod.

AutoMod log messages have been rewritten around rule, member, location, reason and concrete outcomes. Rules can provide a custom description where permitted, while standard reason and outcome labels remain localised and structured. The old embed sounded as if a language model had been asked to explain a boolean and paid by the adjective.

Roles and permissions are readable before saving

The guild Roles & Permissions page now uses a searchable master-detail workspace. Permissions are grouped by product area, selected one at a time for focused editing, and described in human terms. Technical permission keys and raw role IDs are removed from the normal interface, because administrators should not need to reverse-engineer our internal vocabulary before deciding who may ban someone.

Discord roles appear as coloured mention-style chips, managed roles are hidden by default with a reversible reveal control, and assignment counts, direct mapping semantics, dirty state and save availability are explicit. The mobile layout turns the master list into a bounded selector above the detail panel instead of compressing both columns until neither admits responsibility.

High-impact permissions now carry a danger classification with an orange treatment, icon and plain explanation of the permanent or large-scale harm they can enable. The permission catalogue is more granular across moderation, warning lifecycle, reviews, Sentinel submission, member notes, configuration transfer and other sensitive actions.

Labels such as executor, server administrator and owner no longer imply a hidden universal role. The executor is the actor performing the operation; owners and Discord managers retain only the explicit platform-defined override boundaries; every Orbit action still resolves through dynamic permission keys and server-side policy. If access cannot be explained by an effective permission, it is not access.

Configuration changes now arrive with fewer trapdoors

Guild configuration export has been repaired, and import is now preview-first. Selecting a file validates its signature and schema, compares the source and target, sanitises known guild-specific channel and role references, and shows the planned changes without mutating the guild. Only an explicit confirmation applies the import. File selection has been relieved of its former side job as a destructive action.

Guild timezone changes now have a 24-hour cooldown. This prevents repeated timezone edits from shifting storage and deletion schedules around their intended boundary. The timezone remains editable; it simply no longer doubles as a retention-policy time machine.

Core Tool actions can now be forced on or off at global, owner and guild scope through the shared policy control plane. Concrete actions and capability limits resolve independently, so a higher-authority restriction can disable one AI moderation action or content category without switching off an unrelated tool. Guild controls show the effective lock and cannot override it locally.

The Dashboard stopped treating density as a design system

Navigation, account pages, guild overview, module workspaces, settings, forms, public pages and shared controls now use a quieter and more consistent surface system. Related navigation is grouped, narrow layouts respond to their actual container, and important state is placed near the action it governs. We removed enough nested cards that several pages can now be viewed without geological equipment.

Loading, empty, unavailable, degraded, failed and stale states are presented separately, with safe retry behaviour and request references where supported. Retained data is identified as retained rather than silently presented as current, and destructive guild reset now relies on an authoritative server-side preview, revision and confirmation boundary.

The authenticated Dashboard also has a configurable capacity-admission boundary. In observe mode it measures pressure without delaying users; when enforcement is enabled, protected access follows a FIFO queue and shows each user only their own place plus aggregate queue state. Live pseudonymous membership expires after five minutes without a heartbeat, while durable history contains aggregate counts and latency histograms rather than an account-level attendance register.

Template placeholders now use one shared composer across supported editors. Tokens appear as typed inline chips inside the text field, resource and time selectors open in context, semantic colours distinguish value kinds, live previews resolve best effort, and the saved value remains the raw stable token. Copying a placeholder from a documentation page into a textbox is no longer the flagship editing experience.

Support and Trust & Safety requests are easier to follow

Signed-in participants can see their own support and Trust & Safety request history, open authorised details, read public outcomes and continue the correct participant thread. Internal notes, evidence, staff-only findings and other participants' data remain excluded. Submission confirmation is clearer, and redundant Help Center navigation has been removed.

Recognised failures can include a short-lived request reference for support without exposing raw internal diagnostics to the requester. The reference is not an ownership credential, secrets are excluded, and technical detail remains separately permission-protected and audited. Users get something more actionable than 'internal error'; support gets something more actionable than a screenshot of 'internal error'.

Discord is now the ordinary account identity

A normal Orbit account can now sign in with Discord without creating or contacting a gamingForFun account. Existing links remain available, gamingForFun-first sign-in still requires a verified Discord identity, and System Team authority remains derived from the configured external identity model. Discord-only users do not inherit privileged access by omission.

Creator Notifications readiness and polling now isolate provider failures, recover from missed wake-up hints through durable work, and verify the required storage before promoting a candidate. One upstream account can fail without abandoning every other configured creator, which is the sort of basic courtesy distributed systems occasionally make us earn twice.

Terms and Privacy Policy move to version 3.2

The English and German Terms of Service and Privacy Policy have been updated for Discord-first accounts, member profiles and internal notes, moderation warning and deletion lifecycles, support and request diagnostics, protected recovery copies, and the complete Sentinel reporting, assessment, visibility, retention, enforcement, subject-access and appeal model.

Technical change inventory

Everything below is the compact part: public behaviour, contracts, migrations and operator-relevant fixes that were too small for another chapter but too real for 'miscellaneous improvements'. Short SHAs identify the introducing release commit; a later commit may refine the same path. This is the list where the changelog removes its jacket and starts naming tables.

Sentinel and member safety

• [f3db891] Added the `sentinel` tRPC router with public, subject, guild and authorised review projections.
• [f3db891] Added one subject dossier across contributions from multiple guilds.
• [f3db891] Rejects duplicate guild contributions for the same Discord subject.
• [f3db891] Rejects new submissions while the subject already has an active registry entry.
• [f3db891] Captures every related non-note guild moderation case, not only the submitted anchor case.
• [f3db891] Persists versioned submission-term acceptance for every report.
• [f3db891] Requires the dedicated Sentinel submission permission server-side.
• [f3db891] Separately restricts guild submission and guild enforcement eligibility.
• [f3db891] Adds deterministic decline, manual-review and admission-candidate assessment outcomes.
• [f3db891] Allows only unattended decline to close automatically after 48 hours.
• [f3db891] Requires a human decision before admission, publication or global enforcement.
• [f3db891] Deduplicates terminal result notifications for the guild owner and submitting moderator.
• [f3db891] Adds public, masked and private registry modes.
• [f3db891] Separates identity, avatar and public-reason visibility controls.
• [f3db891] Compiles `[redact]` ranges into public segments without shipping hidden text.
• [f3db891] Keeps internal evidence, reporter identity and staff discussion out of public/self DTOs.
• [f3db891] Adds direct subject-safe lookup and explanation for an affected account.
• [f3db891] Keeps direct subject access available independently of passive self-lookup presentation.
• [f3db891] Adds subject appeals without exposing the internal dossier.
• [f3db891] Defaults accepted entries to a maximum two-year duration.
• [f3db891] Requires explicit override authority and audit reason for exceptional duration.
• [f3db891] Projects accepted entries to guild enforcement on a 24-hour schedule.
• [f3db891] Adds per-guild Discord-ID bypasses and optional moderator notification.
• [f3db891] Tracks Sentinel-origin bans separately from pre-existing guild bans.
• [f3db891] Makes guild opt-out a retryable disabling workflow until reconciliation completes.
• [f3db891] Preserves independent guild bans during Sentinel opt-out cleanup.
• [f3db891] Integrates Sentinel status into the existing Orbit Standing projection.
• [f3db891] Restricts active listed owners from operating Orbit in their owned guilds.
• [f3db891] Adds public indexing contracts for the Sentinel registry route.
• [f3db891] Adds periodic removal, expiry, enforcement and reconciliation worker jobs.

Member profiles and internal notes

• [f3db891] Added guild-bounded member search without an arbitrary global Discord-ID resolver.
• [f3db891] Added staff member profiles with Discord identity, membership and account-age facts.
• [f3db891] Added moderation-case and active-warning summaries to member profiles.
• [f3db891] Moved internal notes into separate guild-scoped staff records.
• [f3db891] Added note authorship, lifecycle status, timestamps and audit facts.
• [f3db891] Added a restricted self-profile projection for authenticated members.
• [f3db891] Excludes internal note bodies from the self projection.
• [f3db891] Excludes private case comments, evidence and unrelated actor metadata from self access.
• [f3db891] Preserves the guild navigation shell for moderators with profile access.
• [f3db891] Uses a focused navigation-free profile layout for member self access.
• [f3db891] Added dedicated member-profile read and note permissions.
• [f3db891] Enforces guild tenancy on every member-profile and note operation.

Moderation, warnings and appeals

• [d324801] Consolidated the moderation page into one filter region.
• [d324801] Rebuilt the case drawer with wider responsive facts, actions and review layout.
• [d324801] Moved moderation settings into a two-column responsive workspace.
• [f3db891] Added a dedicated moderation settings subroute.
• [f3db891] Replaced the buried page action with a fixed floating moderation-action button.
• [f3db891] Hides the floating action while drawers or dialogs are open.
• [f3db891] Separates succeeded, failed, voided and deleted case colour semantics.
• [f3db891] Highlights Discord/API execution errors inside failed cases.
• [f3db891] Suppresses review controls for failed moderation actions.
• [f3db891] Adds a guild-wide switch for the Orbit moderation review system.
• [f3db891] Applies review-system disablement in server-side eligibility checks.
• [1663deb] Added signed, expiring moderation appeal links.
• [1663deb] Added appeal revocation and replacement semantics.
• [aa3d73f] Refined appeal placeholders and moderation message state handling.
• [f3db891] Removes stale Discord components when a case is voided.
• [f3db891] Removes stale Discord components before permanent case deletion.
• [f3db891] Stops destructive deletion when a known Discord message cannot be cleaned safely.
• [f3db891] Records retryable operational issues for failed moderation-message cleanup.
• [f3db891] Removes deleted cases from ordinary queues, search, counts and member history.
• [f3db891] Adds a direct-link-only deleted-case tombstone for authorised guild staff.
• [f3db891] Limits tombstones to case metadata and deleting-operator accountability fields.
• [f3db891] Excludes subject identity, reason, evidence, comments and appeal text from tombstones.
• [f3db891] Added active and inactive warning states.
• [f3db891] Added finite, unlimited and default warning expiry modes.
• [f3db891] Requires a new expiry decision when an inactive warning is reactivated.
• [f3db891] Keeps expired warnings in history while removing active enforcement weight.
• [f3db891] Added optional active-warning kick thresholds.
• [f3db891] Added count-specific warning notification templates.
• [f3db891] Records warning DM and automatic kick execution outcomes separately.
• [f3db891] Applies guild warning-duration policy to manual and AutoMod warnings.
• [f3db891] Added granular warning, review, deletion and note permissions.
• [f3db891] Added system-level warning message and threshold limits.

Event Logging and AutoMod

• [d324801] Added real Event Logging delivery tests for member events.
• [d324801] Added real Event Logging delivery tests for message events.
• [d324801] Added real Event Logging delivery tests for voice events.
• [d324801] Added real Event Logging delivery tests for moderation events.
• [d324801] Routes tests through the guild's configured destination and effective locale.
• [d324801] Disables mentions in every diagnostic notification.
• [d324801] Requires `orbit.logs.manage` for delivery tests.
• [d324801] Validates tool activation, category policy, route and Discord permissions before sending.
• [d324801] Records delivery telemetry for successful and failed test attempts.
• [d324801] Keeps diagnostic messages out of durable guild source-event history.
• [d324801] Added migration 0140 to reassert Event Logging source and delivery storage.
• [f3db891] Isolates invalid Core Tool configuration to the offending tool.
• [f3db891] Prevents malformed unrelated configuration from starving Event Logging runtime state.
• [f3db891] Caches base, category and concrete-action policy decisions together.
• [f3db891] Includes policy-override expiry in runtime cache deadlines.
• [f3db891] Expands AutoMod simulation with channel count.
• [f3db891] Expands AutoMod simulation with attachment count.
• [f3db891] Expands AutoMod simulation with message count and cadence.
• [f3db891] Expands AutoMod simulation with repeated burst behaviour.
• [f3db891] Adds warning-action parameters to AutoMod rules.
• [f3db891] Normalises AutoMod warning expiry through the guild moderation policy.
• [f3db891] Adds optional custom descriptions to supported AutoMod log output.
• [f3db891] Rewrites AutoMod log fields around rule, member, location, reason and outcome.
• [f3db891] Localises standard AutoMod reasons and execution outcomes.
• [f3db891] Keeps rule-test simulation side-effect free.

Permissions, policy and configuration

• [03b5a28] Introduced the guild permission master-detail workspace.
• [1663deb] Categorised guild permissions into readable product groups.
• [1663deb] Removed normal-interface exposure of permission keys and raw role IDs.
• [1663deb] Added Discord-coloured role mention chips.
• [1663deb] Hides managed Discord roles by default with a reversible reveal control.
• [1663deb] Added explicit direct-mapping, assignment-count and dirty-state copy.
• [f3db891] Added danger metadata for high-impact permissions.
• [f3db891] Uses colour, icon and explanatory text for dangerous permissions.
• [f3db891] Expanded moderation, warning, review, note and Sentinel permission granularity.
• [f3db891] Added configurable per-permission and total role-assignment limits.
• [03b5a28] Makes retained permission data visibly stale instead of silently current.
• [03b5a28] Keeps permission saves fail-closed when authoritative reads fail.
• [03b5a28] Added server-authoritative preview and revision checks to destructive guild reset.
• [03b5a28] Added configuration-import preview without immediate mutation.
• [f3db891] Repaired configuration export projection and validation.
• [f3db891] Added separate configuration export and import permissions.
• [f3db891] Revalidates signed configuration bundles before preview and application.
• [f3db891] Sanitises recognised cross-guild Discord channel and role references.
• [f3db891] Added a 24-hour guild timezone-change cooldown.
• [f3db891] Added shared policy decisions at global, owner and guild scope.
• [f3db891] Added concrete Core Tool action locks independent of base tool state.
• [f3db891] Added shared capability-limit resolution for registered features.
• [f3db891] Prevents guild-local switches from overriding higher-authority action policy.
• [1663deb] Gives administratively disabled modules a distinct authoritative presentation.

Dashboard, templates and support

• [03b5a28] Reworked shared Dashboard surfaces, spacing, hierarchy and responsive behaviour.
• [03b5a28] Grouped account, guild, module and workspace navigation by user task.
• [03b5a28] Split Account into focused identity, session, privacy, language, wallet and notification workspaces.
• [03b5a28] Rebuilt guild overview around readiness, live state, modules, identity and capacity.
• [03b5a28] Added distinct loading, empty, stale, degraded, failed and unavailable query states.
• [03b5a28] Added safe retry and recognised-error presentation across shared API surfaces.
• [03b5a28] Prevents background refresh from replacing active local drafts.
• [03b5a28] Defers expensive command inventory reads until the command palette opens.
• [03b5a28] Deduplicates shared guild shell reads through scoped resource caching.
• [03b5a28] Prevents changelog query changes from reloading unrelated account receipt state.
• [03b5a28] Repairs responsive overflow across tables, forms, chips and workspace navigation.
• [03b5a28] Keeps keyboard focus, labels and forced-colour states visible on shared controls.
• [6dbb1d7] Adds configurable authenticated Dashboard capacity admission.
• [6dbb1d7] Separates observe mode from queue enforcement.
• [6dbb1d7] Preserves FIFO position through pseudonymous account and session fingerprints.
• [6dbb1d7] Expires live queue membership after five minutes without a heartbeat.
• [6dbb1d7] Stores only aggregate minute and hour capacity history.
• [6dbb1d7] Exposes a permission-backed capacity bypass without revealing other queued identities.
• [1663deb] Added the shared inline `PlaceholderComposer`.
• [1663deb] Renders placeholders as semantic typed chips inside supported text fields.
• [1663deb] Opens contextual resource and time selectors from the active token.
• [aa3d73f] Refined placeholder parsing, selection and moderation-template integration.
• [aa3d73f] Keeps raw token persistence separate from best-effort preview resolution.
• [9fc2600] Added participant-safe support and Trust & Safety request history.
• [9fc2600] Added participant-safe request details and public outcome presentation.
• [9fc2600] Removed redundant Help Center navigation paths.
• [9fc2600] Added short-lived request references for recognised server failures.
• [9fc2600] Excludes cookies, authorisation headers, tokens and provider secrets from diagnostic records.
• [9fc2600] Keeps technical request detail behind a stronger audited permission.
• [9fc2600] Expanded support routing eligibility without bypassing explicit grants or denies.

Identity, notifications and release readiness

• [079f1bc] Makes Discord sufficient for ordinary Orbit account creation and sign-in.
• [079f1bc] Stops ordinary Discord login from contacting gamingForFun.
• [079f1bc] Reuses an existing gamingForFun link when one is already present.
• [079f1bc] Requires verified Discord continuation for gamingForFun-first sign-in.
• [079f1bc] Keeps System Team authority external-IDP-derived and fail-closed.
• [079f1bc] Preserves server-side OAuth state, PKCE, conflict and restricted-session checks.
• [9fc2600] Makes Creator Notifications provider work best effort after durable persistence.
• [9fc2600] Continues polling other creator accounts after one upstream failure.
• [9fc2600] Recovers missed wake-up hints through slower durable polling.
• [f3db891] Adds migration 0141 for Creator Notifications readiness storage repair.
• [f3db891] Verifies required notification schemas before promoting provider candidates.
• [f3db891] Repairs Trust & Safety identity reconciliation Date handling.
• [f3db891] Repairs hourly Dashboard capacity roll-up Date binding.
• [f3db891] Keeps invalid tool configuration from aborting the complete Bot capability refresh.
• [f3db891] Adds migration 0142 for moderation governance and timezone state.
• [f3db891] Adds migration 0143 for Sentinel, member profiles, submissions, decisions and enforcement.
• [9fc2600] Adds migration 0136 for short-lived request diagnostics.
• [9fc2600] Adds migration 0137 for participant support and Trust & Safety workspace records.
• [1663deb] Adds migration 0138 for runtime storage repair.
• [1663deb] Adds migration 0139 for signed moderation appeals.
• [f3db891] Regenerates the public API contract for Sentinel, profiles, moderation and policy controls.
• [f3db891] Adds public route discovery for Sentinel through sitemap, robots and `llms.txt` contracts.
• [f3db891] Updates English and German Terms and Privacy metadata to version 3.2.