diff --git a/changelog/cli/0.10.36.md b/changelog/cli/0.10.36.md
new file mode 100644
index 00000000..5ddcdb14
--- /dev/null
+++ b/changelog/cli/0.10.36.md
@@ -0,0 +1,17 @@
+---
+package: "@webjsdev/cli"
+version: 0.10.36
+date: 2026-07-09T14:00:00.000Z
+commit_count: 4
+---
+## Features
+
+- **close coverage-gate deferred gaps with real scaffold demos** ([#870](https://github.com/webjsdev/webjs/pull/870)) [`e62d7e41`](https://github.com/webjsdev/webjs/commit/e62d7e41)
+- **add a tier-2 scaffold teaching-coverage gate for core exports** ([#861](https://github.com/webjsdev/webjs/pull/861)) [`35d180d2`](https://github.com/webjsdev/webjs/commit/35d180d2)
+- **add a boundaries gallery demo and harden the scaffold-sync skill** ([#854](https://github.com/webjsdev/webjs/pull/854)) [`5f7bd1f0`](https://github.com/webjsdev/webjs/commit/5f7bd1f0)
+
+## Fixes
+
+- **fresh saas scaffold passes typecheck and axe out of the box (#877, #878)** ([#879](https://github.com/webjsdev/webjs/pull/879)) [`72bb3611`](https://github.com/webjsdev/webjs/commit/72bb3611)
+  * Rewrite the `onBeforeCache` import to `#lib/utils/dom.ts` (it kept a registry-relative `../lib/dom.ts` and failed TS2307), and resolve `AUTH_SECRET` through a typed const with a production fail-fast guard (it was assigned as `string | undefined` to a required `string`).
+  * Give every generated page exactly one `<h1>`, raise the gallery label text to full `text-muted-foreground` contrast, and add accessible names to the file-upload and ref-focus inputs, so a fresh app returns zero axe violations.
diff --git a/changelog/server/0.8.46.md b/changelog/server/0.8.46.md
new file mode 100644
index 00000000..6c4e50bc
--- /dev/null
+++ b/changelog/server/0.8.46.md
@@ -0,0 +1,11 @@
+---
+package: "@webjsdev/server"
+version: 0.8.46
+date: 2026-07-09T14:00:00.000Z
+commit_count: 1
+---
+## Fixes
+
+- **route(module) auto-applies an action's declared middleware and validate (#876)** ([#879](https://github.com/webjsdev/webjs/pull/879)) [`72bb3611`](https://github.com/webjsdev/webjs/commit/72bb3611)
+  * The `route()` REST adapter only ran the `middleware` / `validate` passed via its `opts`, so an action's declared `export const middleware` protected the RPC boundary but not the REST one (a function reference cannot reach its sibling config exports).
+  * `route()` now also accepts the action's module namespace (`import * as postActions from '...'; export const POST = route(postActions)`) and auto-applies the declared `middleware` and `validate`, so a guard declared once beside the action protects both boundaries. The bare-function form is unchanged, and an explicit `opts` value still overrides the declared config.
diff --git a/package-lock.json b/package-lock.json
index f7b7b6a8..dc1efd0d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6975,7 +6975,7 @@
     },
     "packages/cli": {
       "name": "@webjsdev/cli",
-      "version": "0.10.33",
+      "version": "0.10.36",
       "license": "MIT",
       "dependencies": {
         "@webjsdev/mcp": "^0.1.0",
@@ -6991,7 +6991,7 @@
     },
     "packages/core": {
       "name": "@webjsdev/core",
-      "version": "0.7.30",
+      "version": "0.7.32",
       "license": "MIT",
       "devDependencies": {
         "esbuild": "^0.25.0"
@@ -7039,7 +7039,7 @@
     },
     "packages/server": {
       "name": "@webjsdev/server",
-      "version": "0.8.43",
+      "version": "0.8.46",
       "license": "MIT",
       "dependencies": {
         "@webjsdev/core": "^0.7.1",
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 19686931..93cb6eee 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/cli",
-  "version": "0.10.35",
+  "version": "0.10.36",
   "type": "module",
   "description": "webjs CLI - dev, start, create, db",
   "bin": {
diff --git a/packages/server/package.json b/packages/server/package.json
index 7a1b300a..8d8c8f10 100644
--- a/packages/server/package.json
+++ b/packages/server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/server",
-  "version": "0.8.45",
+  "version": "0.8.46",
   "type": "module",
   "description": "webjs dev/prod server: SSR, router, API, server actions, live reload",
   "main": "index.js",