Prepare v0.7.8 release

Author: awksedgreep

CHANGELOG.md

@@ -10,10 +10,12 @@ capability document remains authoritative for a particular binary pairing.
 See the [compatibility statement](docs/COMPATIBILITY.md) and
 [upgrade guide](docs/UPGRADE.md).
 
-<!-- release-target: 0.7.7 -->
+<!-- release-target: 0.7.8 -->
 
 ## [Unreleased]
 
+## [0.7.8] — 2026-08-30
+
 ### Changed
 
 - **All three signal servers now bound the WAL with the same embedded
@@ -38,6 +40,34 @@ See the [compatibility statement](docs/COMPATIBILITY.md) and
   no plane truncated the WAL outside the backup and shutdown paths. Server
   behavior only; no extension, SQL, or data-ABI change. GUIDE §8 now
   documents the recommended embedded WAL profile and checkpoint cadence.
+- Storage virtual tables and raw table-valued functions now push a plain SQL
+  `LIMIT` down as a scan bound when no offset or residual filter can require
+  more rows. Small exploratory queries no longer decode an entire matching
+  range merely to discard it above the virtual-table boundary.
+- Authentication route classification is explicit, including read scope for
+  both live-tail POST routes, and admin keys supplied in query parameters are
+  decoded before comparison.
+- The extension FFI panic policy is documented: exported callbacks contain
+  Rust panics at the SQLite boundary, while invariant-only internals remain
+  fail-fast during development.
+
+### Fixed
+
+- Hardened untrusted-input paths: batch reservations and string decoding are
+  allocation-bounded, batch byte arithmetic is checked on 32-bit targets,
+  and batch result ordering is validated in release builds before results are
+  associated with requests.
+- Log virtual tables now reject the wrong shadow-table module reliably, and
+  trace attribute filtering handles stored JSON `null` without confusing it
+  with a missing key.
+- Dropping storage pins now reclaims retired blocks promptly instead of
+  waiting for unrelated later work.
+- Legacy schemas are upgraded through explicit supported transitions rather
+  than being silently accepted by newer code.
+- Spike shadow-table identifiers are quoted safely, and dbhealth maintenance
+  has a single scheduler owner with canonical database-path matching.
+- CI actions are pinned to immutable revisions, and new Rust compiler
+  warnings in the batch path have been removed.
 
 ## [0.7.7] — 2026-08-23
 

Cargo.lock

@@ -17,7 +17,7 @@ default-members = [
 resolver = "2"
 
 [workspace.package]
-version = "0.7.7"
+version = "0.7.8"
 edition = "2021"
 license = "MIT"
 

Cargo.toml

@@ -64,14 +64,14 @@ The project is on the pre-1.0 `0.7.x` compatibility line. Extension and Rust
 signal-server versions move together and negotiate capabilities at startup;
 matching version strings alone are not sufficient.
 
-`v0.7.7` is the current release, and it is what makes the compression numbers
+`v0.7.8` is the current release, and it is what makes the compression numbers
 above honest: every signal now exports data-block payload, index, and WAL
 bytes as separate series, with a raw comparator, so a ratio is raw versus
 storage and never quietly folds in index or file overhead. Its tag-triggered
 artifact run built, identity-checked, and install/remove-drilled all four
 native Linux/macOS archives, verified the complete outer checksum set, and
 published the
-[`v0.7.7` GitHub Release](https://github.com/awksedgreep/timeless-libsql/releases/tag/v0.7.7)
+[`v0.7.8` GitHub Release](https://github.com/awksedgreep/timeless-libsql/releases/tag/v0.7.8)
 with the archives plus `SHA256SUMS` as permanent assets. Download and
 verification steps are in [the artifact guide](docs/ARTIFACTS.md).
 

README.md

@@ -15,8 +15,8 @@ constants that enforce the handshake.
 
 | Contract key | Current value | Meaning |
 |---|---:|---|
-| `extension_workspace` | `0.7.7` | Current extension/core/dbhealth source line. |
-| `server_workspace` | `0.7.7` | Current metrics/logs/traces server source line. |
+| `extension_workspace` | `0.7.8` | Current extension/core/dbhealth source line. |
+| `server_workspace` | `0.7.8` | Current metrics/logs/traces server source line. |
 | `extension_data_abi` | `1` | Stored/public telemetry data compatibility generation. |
 | `sql_surface_version` | `1` | Advertised public SQL inventory generation. |
 | `extension_minimum_server` | `0.7.0` | Oldest server accepted by the current extension document. |

docs/COMPATIBILITY.md

@@ -14,8 +14,9 @@ than the exact tree being tagged verifies nothing.
 
 1. **Version bump**: both workspaces move together (`Cargo.toml`,
    `servers/Cargo.toml`), per the pairing policy in
-   [COMPATIBILITY.md](COMPATIBILITY.md). Line changes (0.x → 0.y) also move
-   the capability document, both floors, and their guard tests.
+   [COMPATIBILITY.md](COMPATIBILITY.md), whose two current workspace values
+   move with every release. Line changes (0.x → 0.y) also move the capability
+   document, both floors, and their guard tests.
 2. **Lockfiles**: `cargo check --workspace --locked` in the root AND
    `servers/` (and `tools/query-harness/`). The release workflow builds with
    `--locked`; a bump without a lock refresh fails every platform job.
@@ -24,7 +25,7 @@ than the exact tree being tagged verifies nothing.
 4. **CLI suite**: `./tests/cli.sh` — all sections.
 5. **Correctness suites**: `./tests/correctness.sh` for each section
    (`r1 r2 r3 r4 r8 logs-rich`), plus `./tests/dbhealth.sh` and
-   `./tests/crash.sh`.
+   `./tests/crash.sh target/release/libtimeless_ext.so`.
 6. **Query contracts + oracles** (the `query-contracts` gate, runnable
    locally):
    `cargo test --manifest-path tools/query-harness/Cargo.toml --locked`,

docs/RELEASING.md

@@ -9,7 +9,7 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "0.7.7"
+version = "0.7.8"
 edition = "2021"
 license = "MIT"