diff --git a/.changeset/about-release-version.md b/.changeset/about-release-version.md
deleted file mode 100644
index 5dbd40e67..000000000
--- a/.changeset/about-release-version.md
+++ /dev/null
@@ -1,20 +0,0 @@
----
-"@checkstack/backend": minor
-"@checkstack/about-frontend": minor
----
-
-Show the platform release version on the About page
-
-The About page showed only `@checkstack/backend`'s package version, which cannot
-be matched to a GitHub release, a Docker tag or a changelog entry - those all
-carry `@checkstack/release`'s version, which advances on every release while the
-core package's does not.
-
-Both are now shown, explicitly labelled, with the release version leading and
-linked to its GitHub tag.
-
-The release version is baked in at version time by a new
-`generate:release-version` script (checked in CI, mirroring the docs index)
-rather than read at runtime: `@checkstack/release` is private and therefore
-absent from `node_modules` in an npm install, so a relative-path read would work
-in the monorepo and Docker image and silently fail everywhere else.
diff --git a/.changeset/auth-role-editor-ergonomics.md b/.changeset/auth-role-editor-ergonomics.md
deleted file mode 100644
index 6ba8ffe4d..000000000
--- a/.changeset/auth-role-editor-ergonomics.md
+++ /dev/null
@@ -1,23 +0,0 @@
----
-"@checkstack/auth-frontend": minor
-"@checkstack/common": minor
----
-
-Role editor: alphabetised categories, bulk select, and role cloning
-
-Access-rule categories in the role dialog are now sorted alphabetically (by their
-rendered label, at both the category and the rule level) instead of following
-plugin registration order, so a category can be found by scanning rather than by
-reading the whole list.
-
-Each category gained **Select all** / **Clear** actions. They respect the same
-guards the individual checkboxes do - the anonymous role still cannot be granted
-rules no public endpoint uses, and a locked role stays read-only.
-
-Roles can be **cloned**: a new role seeded from an existing one's access rules,
-saved as a create. The dialog now takes an explicit `mode` rather than inferring
-"editing" from the presence of a role, which is what made the third state
-expressible at all.
-
-Adds a shared `buildClonedName` helper to `@checkstack/common` so every clone
-affordance in the product produces the same name shape.
diff --git a/.changeset/authz-doc-generation-and-notes.md b/.changeset/authz-doc-generation-and-notes.md
deleted file mode 100644
index d52c851ec..000000000
--- a/.changeset/authz-doc-generation-and-notes.md
+++ /dev/null
@@ -1,51 +0,0 @@
----
-"@checkstack/common": minor
-"@checkstack/backend": patch
-"@checkstack/healthcheck-common": patch
-"@checkstack/auth-common": patch
-"@checkstack/status-page-common": patch
-"@checkstack/incident-common": patch
-"@checkstack/maintenance-common": patch
-"@checkstack/metricstream-common": patch
-"@checkstack/tracestream-common": patch
-"@checkstack/logstream-common": patch
-"@checkstack/automation-common": patch
-"@checkstack/api-docs-frontend": patch
----
-
-Make endpoint authorization self-documenting in the generated API docs
-
-Every procedure's authorization is now derived from its contract metadata (its
-`access` rules + `instanceAccess` mode) via a shared mode-descriptor registry and
-emitted into the OpenAPI spec - both structurally (`x-orpc-meta.authorization`)
-and as a human `**Authorization.**` sentence folded into the operation
-description. Previously the docs surfaced only a flat list of global rule ids, so
-an integrator (an API-key/application principal that CAN hold team grants) never
-saw the team-grant / per-object dimension, and endpoints gated purely in the
-handler showed no restriction at all.
-
-For authorization that no declarative mode can express and is therefore enforced
-in the handler (a compound OR, a graded verdict, a DB-derived id set), a new
-optional `accessNote` on the procedure metadata surfaces the real rule in the
-docs as an explicitly handler-enforced addendum. The note is documentation, not a
-guarantee: per `.claude/rules/rlac.md` the drift guard for such authz is
-behavioral tests over an extracted pure decision function, and the note must
-state exactly what those tests pin.
-
-Every handler-enforced authorization endpoint now carries such a note so the docs
-are complete: the team read/scoping and team-management endpoints
-(`@checkstack/auth-common`), the health-check assignment/history reads
-(`@checkstack/healthcheck-common`), the audience-graded incident/maintenance
-reads (`@checkstack/incident-common`, `@checkstack/maintenance-common`), status
--page publish's bound-resource check (`@checkstack/status-page-common`), the
-stream `setSystemLinks` readable-additions check
-(`@checkstack/{metricstream,tracestream,logstream}-common`), and the automation
-`runAs` escalation guard (`@checkstack/automation-common`). These are
-metadata-only additions - no runtime behavior changed. The notes describe the
-rule for API-doc readers only; the drift guard is behavioral tests over the
-check's decision function (per `.claude/rules/rlac.md`), so the notes name no
-internal test files.
-
-The API docs viewer (`@checkstack/api-docs-frontend`) now renders each
-operation's description as Markdown, so the `**Authorization.**` block (and any
-inline `code`) formats correctly instead of showing raw markdown.
diff --git a/.changeset/auto-security-remediation.md b/.changeset/auto-security-remediation.md
deleted file mode 100644
index fa5456dae..000000000
--- a/.changeset/auto-security-remediation.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-"@checkstack/backend": patch
-"@checkstack/scripts": patch
----
-
-Security: auto-remediated fixable vulnerabilities flagged by the daily scan.
-
-- `tar` 7.5.20 → 7.5.21 (GHSA-r292-9mhp-454m)
-- `brace-expansion` 5.0.7 → 5.0.8 (CVE-2026-14257)
diff --git a/.changeset/auto-theme-option.md b/.changeset/auto-theme-option.md
deleted file mode 100644
index 2136f1dab..000000000
--- a/.changeset/auto-theme-option.md
+++ /dev/null
@@ -1,23 +0,0 @@
----
-"@checkstack/ui": minor
-"@checkstack/theme-frontend": minor
----
-
-Auto theme option, and fix Auto never updating
-
-The theme control is now a three-way Light / Dark / **Auto** selector. Auto
-persists `system` and follows the operating system's preference.
-
-This fixes two related bugs:
-
-- **Auto was a one-way door.** The backend, schema and `ThemeProvider` had always
-  supported `system`, but both toggles were binary and could only ever write
-  `light` or `dark`. Touching the control once destroyed a user's Auto
-  preference permanently, with nothing able to write it back.
-- **Auto did not react.** `ThemeProvider` read `matchMedia(...).matches` during
-  render with no listener, so a live OS light/dark switch did not repaint until
-  something unrelated re-rendered. It now subscribes and repaints immediately.
-
-Theme resolution is extracted into a pure `resolveTheme` (exported from
-`@checkstack/ui`), and a value read from `localStorage` is now narrowed rather
-than cast - a hand-edited value can no longer put a bogus class on `<html>`.
diff --git a/.changeset/catalog-clone-systems-environments.md b/.changeset/catalog-clone-systems-environments.md
deleted file mode 100644
index 622e093fe..000000000
--- a/.changeset/catalog-clone-systems-environments.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-"@checkstack/catalog-frontend": minor
----
-
-Clone systems and environments
-
-Systems and environments gained a **Clone** row action, which opens the editor
-pre-seeded from the source record and saves as a create.
-
-The clone is deliberately SHALLOW: name (suffixed), description and custom
-fields only. Group and environment memberships, tags, contacts, links, team
-grants and health-check assignments are NOT copied, and the dialog says so.
-Duplicating health-check assignments in particular would silently multiply probe
-volume and notification noise with every clone.
-
-Cloning is gated on CREATE, not on manage of the source, and a GitOps lock on
-the source does not block it - the copy is a new, unmanaged record.
diff --git a/.changeset/command-palette-team-scoped.md b/.changeset/command-palette-team-scoped.md
deleted file mode 100644
index a6fbf85a8..000000000
--- a/.changeset/command-palette-team-scoped.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-"@checkstack/command-common": minor
-"@checkstack/command-backend": minor
-"@checkstack/command-frontend": minor
-"@checkstack/incident-backend": patch
-"@checkstack/maintenance-backend": patch
----
-
-Show command-palette actions to team-scoped users
-
-The palette filtered commands against the caller's GLOBAL access rules only, so a
-user whose team holds a create-capability grant - but who holds no global
-`incident.incident.manage` / `maintenance.maintenance.manage` rule - never saw
-"Create Incident" or "Create Maintenance", nor their keyboard shortcuts. The
-palette hid the actions from exactly the people authorized to run them.
-
-Commands can now declare a `manageCapability` (mirroring the gate routes and nav
-already use). `filterByAccessRules` shows an item when the caller holds the
-global rules OR can create/manage the declared type through a team grant, and the
-command backend resolves that per request via `hasAnyTypeGrant` (with
-`includeCreator`, so a team member who may CREATE the type qualifies before
-owning an instance). It fails closed: an auth error leaves pure global gating.
-The incident and maintenance commands declare their types.
-
-`useGlobalShortcuts` no longer takes `userAccessRules` and no longer re-checks
-access: the server-filtered list is authoritative. That re-check tested the
-global rules only and would have dropped team-scoped users' shortcuts - both call
-sites already defeated it by passing `["*"]`.
diff --git a/.changeset/cover-untested-features.md b/.changeset/cover-untested-features.md
deleted file mode 100644
index b200492e7..000000000
--- a/.changeset/cover-untested-features.md
+++ /dev/null
@@ -1,35 +0,0 @@
----
-"@checkstack/healthcheck-http-backend": patch
-"@checkstack/ui": patch
-"@checkstack/catalog-frontend": patch
-"@checkstack/satellite-backend": patch
----
-
-Cover the features that shipped on logic-only tests
-
-Inline mentions shipped completely inert while ~90 unit tests passed, because
-those tests proved the pure functions and nothing proved the render path. Four
-features carried exactly the same shape of coverage. Each now has a guard that
-was VERIFIED to fail when the thing it guards is broken.
-
-- **HTTP proxy.** `fetch({ proxy })` had never run: every test covered the URL
-  we build, the SSRF host we guard and the field contracts, but no test routed a
-  request through an actual proxy. A real proxy server now proves the request
-  arrives there, that credentials are sent, that a 407 is a COMPLETED request
-  (not a transport failure), that an unreachable proxy IS a transport failure,
-  and that an empty templated proxy falls back to a direct connection.
-- **Status-coloured timeline dots.** The feature was `StatusUpdateTimeline`
-  forwarding a caller's `renderDot`; the colour helpers were tested but the
-  one-line forward was not. Now pinned, including per-item independence and the
-  newest-first ordering a dot renderer must not assume away.
-- **System custom-field preview.** `SystemPreviewPicker` had no render coverage
-  at all. Now covers the empty case, that the SELECTION is displayed, and that
-  "No system" reports `null` rather than leaking the internal sentinel.
-- **Per-satellite offline threshold.** `computeStatus` is called from five
-  places and a site that forgets the per-satellite value silently falls back to
-  the global default, so the admin list, the entity read and the monitor
-  disagree about the same satellite. A behavioural drift guard now drives the
-  real reads with a heartbeat stale by the global default but fresh by the
-  satellite's own threshold - and the shorter-threshold direction too.
-
-Tests only; no runtime behaviour changes.
diff --git a/.changeset/create-from-system-overview.md b/.changeset/create-from-system-overview.md
deleted file mode 100644
index 70559572f..000000000
--- a/.changeset/create-from-system-overview.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-"@checkstack/incident-frontend": minor
-"@checkstack/maintenance-frontend": minor
----
-
-Report an incident or schedule maintenance straight from a system
-
-The system overview showed a system's incidents and maintenances but offered no
-way to open one for it - you had to navigate to the incidents/maintenance page
-and re-pick the system by hand.
-
-Both panels now carry an action ("Report incident" / "Schedule maintenance")
-that deep-links to the editor with the system already selected, via
-`?action=create&systemId=<id>`. The pages consume both params and clear them, so
-a refresh doesn't reopen the dialog.
-
-The action is gated on `useProcedureAccess` over the CREATE procedure's
-contract, so it appears for a global manager AND for someone who can manage this
-system through a team (the `create.parent` gate) - exactly who the backend
-accepts. Gating on the bare global rule would have hidden it from the
-team-scoped users it is most useful to.
-
-The editors' unsaved-changes baseline accounts for the pre-selection, so opening
-a pre-scoped form and closing it again doesn't falsely prompt to discard.
diff --git a/.changeset/cross-entity-mentions.md b/.changeset/cross-entity-mentions.md
deleted file mode 100644
index 2900c0cf3..000000000
--- a/.changeset/cross-entity-mentions.md
+++ /dev/null
@@ -1,46 +0,0 @@
----
-"@checkstack/common": minor
-"@checkstack/frontend-api": minor
-"@checkstack/ui": minor
-"@checkstack/incident-frontend": minor
-"@checkstack/maintenance-frontend": minor
----
-
-Link incidents and maintenances with `#` mentions
-
-Typing `#` in a markdown field now opens a picker over every mentionable record
-and inserts a reference. Referencing another record previously meant pasting a
-URL, which cannot be right everywhere: an admin URL is meaningless on a public
-status page, a status-page URL is meaningless in the admin UI, and neither works
-in an email.
-
-A mention therefore stores WHAT it points at, never where:
-`[Database upgrade](checkstack:maintenance/<id>)`. That is an ordinary markdown
-link - readable in the raw source, parsed unchanged by existing tooling - and
-only the href is resolved per render context.
-
-Resolution may REFUSE: a resolver returning nothing renders the label as plain
-text rather than a link. That is a confidentiality property, not a nicety - an
-internal-only incident referenced from a public status update must not become a
-link that confirms it exists. A renderer given no resolver links nothing.
-
-Incident and maintenance detail pages gained a **Referenced items** section,
-derived by scanning the authored markdown on each render. Nothing is stored
-twice, so an edit that drops a reference drops it from the list too.
-
-The platform owns the contract (`registerMentionRoutes` / `setMentionSearch` in
-`@checkstack/frontend-api`); each owning plugin registers its own type, so no
-plugin imports another. Search only ever offers records the caller may read.
-
-Scope: resolution is wired for the admin UI. Public status pages and notification
-bodies do not resolve mentions yet, so a mention renders there as plain text -
-the safe default above, not a broken link.
-
-Precisely: the admin resolver maps a well-formed reference to a route WITHOUT
-checking that the target still exists or that this viewer may read it, so a
-mention to a deleted or unreadable record links to a not-found or an access gate.
-That is deliberate - gating on the provider's fetched list would silently
-downgrade valid references to plain text (the incident search excludes resolved
-incidents by default), and silently dropping a valid link is worse than one that
-lands on a gate the backend already enforces. The confidentiality property is
-carried by the public renderers, which resolve nothing.
diff --git a/.changeset/fix-inline-mention-rendering.md b/.changeset/fix-inline-mention-rendering.md
deleted file mode 100644
index 1f2821be7..000000000
--- a/.changeset/fix-inline-mention-rendering.md
+++ /dev/null
@@ -1,31 +0,0 @@
----
-"@checkstack/ui": minor
----
-
-Fix cross-entity mentions rendering as dead text everywhere
-
-Inline `#` mentions never became links - not in the admin UI, not on incident or
-maintenance detail pages, not anywhere. `react-markdown` blanks any `href` whose
-protocol is outside its safe list BEFORE the rehype plugins run, so
-`checkstack:maintenance/<id>` reached the anchor renderer as `""`. The renderer
-then saw no mention, took the ordinary-link branch, and emitted an `<a>` with no
-href.
-
-The failure was invisible: the label still rendered, nothing threw, and the page
-looked correct - only the link was missing. Two filters had to be widened, since
-either one alone still drops the href:
-
-- `urlTransform` now passes the mention scheme through and defers everything
-  else to `defaultUrlTransform`, so `javascript:`/`data:` stay blocked.
-- The sanitizer's URL-protocol allow-list gains the same scheme, so it does not
-  strip the href immediately afterwards.
-
-The mention href is never emitted to the DOM either way: the anchor renderer
-replaces it with a resolved in-app URL or renders plain text.
-
-`Markdown.mentions.test.tsx` pins the whole path from authored markdown to a
-rendered anchor, including that an unresolved mention stays plain text and that
-`javascript:` is still refused. The e2e that appeared to cover this asserted
-`getByRole("link", …).first()`, which matched the "Referenced items" chip - a
-plain router link that renders whether or not the inline mention works - so it
-passed throughout. It now asserts both links and their hrefs.
diff --git a/.changeset/fix-mention-redos.md b/.changeset/fix-mention-redos.md
deleted file mode 100644
index 027e5fed8..000000000
--- a/.changeset/fix-mention-redos.md
+++ /dev/null
@@ -1,18 +0,0 @@
----
-"@checkstack/common": patch
----
-
-Fix polynomial ReDoS in mention scanning
-
-The mention link pattern allowed a raw `[` inside the label, so a run of `[[[[`
-started a label scan at every bracket that could only fail at the closing `](` -
-quadratic in the input length (CodeQL `js/polynomial-redos`, HIGH). The
-documents scanned are operator-authored incident and maintenance update text, so
-the input is genuinely uncontrolled.
-
-Excluding a raw `[` costs nothing: `buildMentionMarkdown` escapes brackets, so a
-legitimate mention never contains one - a bracketed title arrives as `\[`, which
-the escape branch already matches.
-
-Guarded by a timing regression test. A quadratic pattern still returns the right
-answer, just far too slowly, so no correctness test could have caught this.
diff --git a/.changeset/healthcheck-system-template-preview.md b/.changeset/healthcheck-system-template-preview.md
deleted file mode 100644
index 2c46dec2e..000000000
--- a/.changeset/healthcheck-system-template-preview.md
+++ /dev/null
@@ -1,19 +0,0 @@
----
-"@checkstack/catalog-frontend": minor
-"@checkstack/healthcheck-frontend": minor
----
-
-Preview system custom fields in the health-check editor
-
-The editor gained a **System** picker beside the existing "Preview as"
-environment picker, so `{{ system.metadata.<key> }}` resolves in the preview line
-and offers `{{ }}` autocomplete.
-
-Previously system templating could only be previewed when the editor happened to
-be opened FROM a system: a shared-config authoring flow and every edit-mode
-session got no preview and no completions at all, because the systems list was
-not even fetched in edit mode.
-
-Selecting only a system is now enough to preview - an environment is no longer
-required, since `system.metadata.*` is fully resolvable without one. Both pickers
-only offer resources the caller may read.
diff --git a/.changeset/http-healthcheck-proxy.md b/.changeset/http-healthcheck-proxy.md
deleted file mode 100644
index e82e5a973..000000000
--- a/.changeset/http-healthcheck-proxy.md
+++ /dev/null
@@ -1,40 +0,0 @@
----
-"@checkstack/healthcheck-http-backend": minor
----
-
-Route HTTP health checks through a proxy
-
-HTTP checks gained optional **Proxy URL**, username and password settings, so a
-network that requires an outbound proxy (a filtering proxy, an audited egress
-gateway) can be monitored through the same path its users take. The proxy URL is
-templatable, so one check can use a different proxy per environment, and proxy
-credentials are stored as secrets.
-
-Two deliberate consequences, both documented in the field description:
-
-- **The proxy becomes the egress policy boundary for that check.** The SSRF
-  denylist is applied to the PROXY host, because that is the only host Checkstack
-  connects to, and the target is left for the proxy to resolve. A filtering proxy
-  is frequently the only thing that CAN resolve the target (split-horizon DNS),
-  so pre-resolving locally would reject valid checks while proving nothing about
-  the real egress. A proxy pointed at a denied range is still refused.
-- **Connect/TLS timings are omitted for proxied checks.** The probe that measures
-  them opens a raw socket to the resolved target, which is a path a proxied
-  request never takes; missing data is honest, a direct-connection timing
-  reported for a proxied request is not.
-
-A proxy that answers with an error is a COMPLETED request: 407 and 502 surface as
-an assertable `statusCode`, not as a transport failure. Only failing to reach the
-proxy at all is a transport failure.
-
-**Credentials.** The proxy password is a secret field - encrypted at rest,
-redacted in the UI, resolvable as `${{ secrets.NAME }}`, and delivered to a
-satellite just in time per run. It is deliberately NOT `{{ }}`-templatable:
-secret and template fields are resolved in separate ordered passes and marking a
-field both is rejected at plugin load. So the proxy URL can vary per environment
-while the credential cannot - documented, and pinned by tests so the
-boot-breaking combination cannot be introduced.
-
-**An empty rendered proxy URL means no proxy**, and the target is guarded as
-usual. Worth knowing when templating a mandatory proxy: an environment missing
-the field degrades to a direct connection rather than to an error.
diff --git a/.changeset/maintenance-notification-detail.md b/.changeset/maintenance-notification-detail.md
deleted file mode 100644
index eaf432f76..000000000
--- a/.changeset/maintenance-notification-detail.md
+++ /dev/null
@@ -1,18 +0,0 @@
----
-"@checkstack/maintenance-backend": minor
----
-
-Include the window and description in maintenance notifications
-
-A maintenance notification said only `Maintenance "<title>" has been scheduled`,
-which told a subscriber nothing about WHAT was planned or WHEN - every recipient
-had to open the app to learn anything at all.
-
-The body now carries the scheduled window and the maintenance description, both
-of which the operator had already written.
-
-The window renders in **UTC with an explicit suffix**: the notification pipeline
-has no per-recipient timezone, so a server-local time would be silently wrong for
-most subscribers and an unlabelled one would be unfalsifiable. The description is
-normalised through the same sanitiser as update messages, so authored markdown
-survives while control characters and blank-line padding do not.
diff --git a/.changeset/markdown-editor-preview.md b/.changeset/markdown-editor-preview.md
deleted file mode 100644
index 5bfcc1287..000000000
--- a/.changeset/markdown-editor-preview.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-"@checkstack/ui": minor
-"@checkstack/incident-frontend": minor
-"@checkstack/maintenance-frontend": minor
-"@checkstack/announcement-frontend": minor
----
-
-Markdown editor with a live preview tab and formatting toolbar
-
-Markdown fields were plain textareas with a "Markdown supported" hint, so an
-author found out how their text rendered only after saving - or, for a
-notification, after it had already been delivered.
-
-New `MarkdownEditor` in `@checkstack/ui`: Write / Preview tabs plus a toolbar
-(bold, italic, link, code, lists, quote). Adopted by the incident and maintenance
-update forms and descriptions, and the announcement message.
-
-The preview renders through `MarkdownBlock` - the same component, remark/rehype
-chain and sanitiser used for the saved content. A second renderer here would be
-free to drift, and a preview that disagrees with the real render is worse than no
-preview.
-
-Toolbar marks toggle rather than only adding, and mark lengths are matched
-exactly so italic (`*`) never claims bold's (`**`) delimiters and silently
-downgrades an author's emphasis.
-
-Note for adopters: `MarkdownEditor` wraps its textarea, so `required` on it does
-nothing - gate submission explicitly instead.
diff --git a/.changeset/mentions-viewability-and-public-resolution.md b/.changeset/mentions-viewability-and-public-resolution.md
deleted file mode 100644
index 149e39d00..000000000
--- a/.changeset/mentions-viewability-and-public-resolution.md
+++ /dev/null
@@ -1,57 +0,0 @@
----
-"@checkstack/common": minor
-"@checkstack/frontend-api": minor
-"@checkstack/incident-common": minor
-"@checkstack/incident-backend": minor
-"@checkstack/incident-frontend": minor
-"@checkstack/maintenance-common": minor
-"@checkstack/maintenance-backend": minor
-"@checkstack/maintenance-frontend": minor
-"@checkstack/status-page-common": minor
-"@checkstack/status-page-backend": minor
-"@checkstack/status-page-frontend": minor
-"@checkstack/notification-common": minor
-"@checkstack/frontend": minor
-"@checkstack/ai-backend": patch
----
-
-Resolve `#` mentions on public status pages, and check viewability in the admin UI
-
-Cross-entity mentions previously resolved only in the admin UI, and did so
-without asking whether the reader could actually open the target. Public
-surfaces resolved nothing at all. Three changes, one per delivery context.
-
-**The admin UI now checks viewability.** `useMentionResolution({ documents })`
-collects the references a page is about to render and asks each owning plugin -
-in ONE batched request - which of them this viewer may read. A mention to a
-deleted or unreadable record now renders as plain text instead of a link to a
-not-found page or an access gate. Backed by new `resolveIncidentRefs` /
-`resolveMaintenanceRefs` procedures, which return ids only (so an unreadable
-record is indistinguishable from a deleted one) and carry the same `listKey`
-read post-filter as their list procedures. They are deliberately not a filter
-over the authoring search list, which hides resolved incidents and would
-silently downgrade valid references.
-
-**Public status pages now resolve mentions.** A reference becomes a link to the
-target's public detail page when - and only when - the same page publishes that
-target, which is exactly the anti-enumeration gate the detail pages already
-apply. So an operator writing "caused by #Database upgrade" in a public update
-gets a working link, while a mention of an internal-only incident stays plain
-text rather than becoming a link that confirms it exists. Widgets opt in by
-declaring a `mentionType`, so the status-page packages take no dependency on any
-domain plugin.
-
-**BREAKING CHANGE (behavioural, no API change):** the in-app public status page
-at `/statuspage/view/<slug>` now builds detail-page hrefs. Previously it passed
-none, so incident and maintenance titles rendered as plain text there while the
-same page on a custom domain linked them. Both now behave identically.
-
-**Notification bodies no longer leak the internal scheme.** `checkstack:` is
-meaningless outside a Checkstack renderer, and channels leaked it differently:
-the email sanitiser stripped the href and left a dead anchor, while Slack's
-mrkdwn emitted `<checkstack:maintenance/9f1c-abc|Database upgrade>` straight to
-the recipient (Discord, Telegram and Teams render markdown natively and would
-have passed it through too). `sanitizeUpdateMessage` now flattens every mention
-to its label before the body reaches any channel, so no channel has to know the
-scheme exists. Flattening also happens before the length bound, so the excerpt
-budget is spent on visible text rather than on an internal URI.
diff --git a/.changeset/objectref-instance-access-mode.md b/.changeset/objectref-instance-access-mode.md
deleted file mode 100644
index a4d3024fc..000000000
--- a/.changeset/objectref-instance-access-mode.md
+++ /dev/null
@@ -1,26 +0,0 @@
----
-"@checkstack/common": minor
-"@checkstack/backend-api": minor
-"@checkstack/backend": patch
-"@checkstack/auth-common": minor
-"@checkstack/auth-backend": minor
----
-
-Add the `objectRef` instanceAccess mode and move the relation-write authz onto it
-
-The relation-tuple writes (`writeRelation` / `removeRelation` / `setObjectPublic`)
-administer team access on ANY resource type, so their authorization could not be
-expressed by the existing `instanceAccess` modes (which all assume a fixed
-resource type) and was enforced by hand in the auth handlers with `access: []` -
-leaving the contract unable to declare the rule and the API docs showing no
-restriction.
-
-A new `objectRef` mode reads the object's TYPE and id from the request body
-(`typeParam` / `idParam`) and authorizes via the same engine native scoping uses:
-the endpoint's own access rule (`auth.teams.manage`) is the global admin
-OR-override, otherwise the caller must be able to manage the referenced object
-(its own `<type>.manage` rule on a non-private object, or a team editor/owner
-grant on it). `autoAuthMiddleware` enforces it, the boot validator recognises it
-(input paths cross-checked), and the auth handlers drop their hand-rolled checks.
-Behaviour is unchanged; the authorization is now contract-declared and enforced
-by the middleware rather than the handler.
diff --git a/.changeset/react-router-v8.md b/.changeset/react-router-v8.md
deleted file mode 100644
index 2c774129d..000000000
--- a/.changeset/react-router-v8.md
+++ /dev/null
@@ -1,61 +0,0 @@
----
-"@checkstack/about-frontend": minor
-"@checkstack/ai-frontend": minor
-"@checkstack/announcement-frontend": minor
-"@checkstack/anomaly-frontend": minor
-"@checkstack/api-docs-frontend": minor
-"@checkstack/auth-frontend": minor
-"@checkstack/automation-frontend": minor
-"@checkstack/catalog-frontend": minor
-"@checkstack/command-frontend": minor
-"@checkstack/dashboard-frontend": minor
-"@checkstack/dependency-frontend": minor
-"@checkstack/frontend": minor
-"@checkstack/gitops-frontend": minor
-"@checkstack/healthcheck-frontend": minor
-"@checkstack/incident-frontend": minor
-"@checkstack/infrastructure-frontend": minor
-"@checkstack/integration-frontend": minor
-"@checkstack/logstream-frontend": minor
-"@checkstack/maintenance-frontend": minor
-"@checkstack/metricstream-frontend": minor
-"@checkstack/notification-frontend": minor
-"@checkstack/pluginmanager-frontend": minor
-"@checkstack/queue-frontend": minor
-"@checkstack/satellite-frontend": minor
-"@checkstack/script-packages-frontend": minor
-"@checkstack/secrets-frontend": minor
-"@checkstack/slo-frontend": minor
-"@checkstack/status-page-frontend": minor
-"@checkstack/telemetry-frontend": minor
-"@checkstack/tracestream-frontend": minor
-"@checkstack/ui": minor
-"@checkstack/ai-backend": patch
----
-
-Migrate the frontend from react-router-dom v7 to react-router v8
-
-Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
-CSRF bypass that lets an action execute before the 400 response. Checkstack runs
-a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
-was not exploitable through it - but the advisory kept the dependency-graph
-security gate red on every pull request, and the fix is only available in the 8.x
-line, which the auto-remediation deliberately will not reach (it refuses major
-bumps).
-
-`react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
-ships as `react-router` only. So this is a package swap rather than a range bump:
-
-- 31 packages now depend on `react-router@^8.3.0` instead of
-  `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
-- The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
-  `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
-  shared the router, so the remote contract is unchanged.
-- The syncpack unified-range group tracks `react-router`, keeping the enforced
-  single-range guarantee that a past four-range regression motivated.
-
-The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
-`MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
-`useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
-same signatures - so no routing code changed beyond the import specifier. v8
-requires React >= 19.2.7, which the workspace already pins.
diff --git a/.changeset/satellite-offline-visibility.md b/.changeset/satellite-offline-visibility.md
deleted file mode 100644
index eee171c07..000000000
--- a/.changeset/satellite-offline-visibility.md
+++ /dev/null
@@ -1,57 +0,0 @@
----
-"@checkstack/satellite-backend": minor
-"@checkstack/satellite-common": minor
-"@checkstack/satellite-frontend": minor
-"@checkstack/healthcheck-backend": minor
-"@checkstack/healthcheck-frontend": minor
----
-
-Per-satellite offline threshold, connectivity notifications, and stop satellite-only checks going silent
-
-**A satellite going offline was invisible, and so were its checks.** Three
-related changes:
-
-**Per-satellite offline threshold.** The 45-second global constant is now a
-per-satellite override (**Offline after**, 2 minutes to 24 hours), because
-tolerance is a property of the link, not of the platform: a satellite on a flaky
-uplink needs grace that should not be forced on every other satellite. The
-threshold is carried on every row read by `computeStatus`, so the entity read,
-the admin list and the heartbeat monitor cannot disagree about the same
-satellite. Additive, nullable column - existing satellites keep the default.
-
-**Connectivity notifications.** Satellites are now a notification target with a
-**Satellite connectivity** subscription: a warning when a satellite stops
-heartbeating, informational when it returns. A reconnect only notifies if the
-satellite was actually offline, so a redeploy is not an event. (The same
-transitions remain available as `satellite.heartbeat_lost` / `.connected`
-automation triggers for anyone wanting different routing.)
-
-**Satellite-only checks no longer go silent.** BUG FIX: a check with
-`includeLocal: false` whose satellites were all offline recorded NOTHING, so it
-displayed its last known status indefinitely - a dead probe was indistinguishable
-from a passing one. The core now records a `degraded` run with a clear message.
-Degraded rather than unhealthy because the target may be fine; what failed is our
-ability to observe it. Liveness that cannot be resolved is treated as "executing"
-so a transient lookup failure cannot mark the whole fleet degraded at once.
-
-Checks also surface staleness: a last run older than five intervals (minimum ten
-minutes) is highlighted, so an ageing status is visible even with no run to
-explain it. Paused checks are never stale, and neither is a RETIRED slice - one
-whose environment was removed or whose satellite was unassigned - because
-warning about something you retired on purpose trains operators to ignore the
-badge.
-
-The unobservable run does NOT notify subscribers. One offline satellite degrades
-every check assigned to it in the same tick, and `healthy -> degraded` is an
-escalation, so notifying per check would turn a single root cause into one alert
-per check. The satellite's own connectivity subscription reports the cause once;
-the runs are still recorded, so health and the UI stay honest.
-
-Satellite liveness is cached on the shared platform cache with a 5s TTL. The
-executor asks per tick of every satellite-only check and the read is a full
-scan, so the uncached version scaled with the number of such checks. The TTL is
-well below the smallest offline threshold the schema allows, so a cached answer
-can lag a transition by one tick but never span one.
-
-Corrects the user guide, which claimed offline satellites produced failed runs -
-they produced nothing at all.
diff --git a/.changeset/system-panel-single-item-titles.md b/.changeset/system-panel-single-item-titles.md
deleted file mode 100644
index e32243fc0..000000000
--- a/.changeset/system-panel-single-item-titles.md
+++ /dev/null
@@ -1,13 +0,0 @@
----
-"@checkstack/maintenance-frontend": minor
-"@checkstack/incident-frontend": minor
----
-
-Name the single maintenance or incident on the system overview cards
-
-When a system has exactly one leading maintenance window (or one active
-incident), its card now shows the TITLE, linked to the record, instead of the
-count. A bare "1" told the reader nothing they could not already infer from the
-card being there, and forced a second click to learn anything.
-
-With two or more there is no single thing to name, so the count remains.
diff --git a/.changeset/team-access-editor-clarity.md b/.changeset/team-access-editor-clarity.md
deleted file mode 100644
index 6eb7dcd3f..000000000
--- a/.changeset/team-access-editor-clarity.md
+++ /dev/null
@@ -1,27 +0,0 @@
----
-"@checkstack/auth-frontend": minor
----
-
-Clarify the team-access editor and guard against locking yourself out
-
-Four fixes to the "Who can change this" editor and the team member picker, from
-user feedback:
-
-- **The "Manage" checkbox read as "manage the team".** It sets the selected
-  team's grant on THIS resource, but the label plus a gear icon suggested it
-  would open the team itself. It is now labelled **"Can edit"** (with no gear),
-  naming its effect on the resource.
-- **The team name is now a link** to that team (`/teams?team=<id>`), which opens
-  its members dialog directly. That gives "take me to the team" its own
-  affordance instead of overloading the checkbox. The Teams page consumes the
-  `team` query param once and then clears it.
-- **Revoking your own team's access now asks first.** A team-scoped user could
-  remove (or downgrade) their own team's only edit grant and afterwards be unable
-  to change the resource *or* restore the permission. That case now shows a
-  confirmation explaining the consequence. Global `auth.teams.manage` admins are
-  not warned - they can always restore it. The decision is a pure, unit-tested
-  `isSelfRevokingChange`.
-- **The add-member field explained.** Its placeholder ("Add a user by name or
-  email") and new helper text state that it adds a NEW member from the whole
-  directory rather than filtering current members, and that a user is only
-  findable after their first sign-in (SSO/LDAP accounts materialise on login).
diff --git a/.changeset/telemetry-test-connection-split.md b/.changeset/telemetry-test-connection-split.md
deleted file mode 100644
index 01cf67fbf..000000000
--- a/.changeset/telemetry-test-connection-split.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-"@checkstack/telemetry-common": minor
-"@checkstack/telemetry-backend": minor
-"@checkstack/telemetry-frontend": patch
----
-
-Split telemetry "Test connection" so its authorization is contract-declared
-
-`testSourceConfig` used to accept an optional `sourceId` (to reuse an existing
-source's stored secrets) and verified MANAGE on that source with a hand-rolled
-check in the handler - the one telemetry endpoint whose authorization was not
-declared on the contract. It is now split into two procedures, each fully
-declared:
-
-- `testSourceConfig` - the fresh-editor dry run (no stored secrets), `typeScoped`
-  at manage level, as before but with `sourceId` removed from its input.
-- `testExistingSource` - the secret-reuse dry run, `sourceId` required and
-  authorized by the `idParam` instanceAccess mode (MANAGE on that source),
-  enforced by the middleware. The hand-rolled `assertCanManageSource` handler
-  check is deleted.
-
-The "Test connection" button calls whichever procedure fits (it has a `sourceId`
-or not), so the UI is unchanged.
-
-BREAKING CHANGE: `testSourceConfig` no longer accepts a `sourceId` - callers that
-reused stored secrets by passing one must call the new `testExistingSource`
-instead. Authorization behaviour is unchanged (still MANAGE on the referenced
-source), only the endpoint split.
diff --git a/.changeset/timeline-status-dots.md b/.changeset/timeline-status-dots.md
deleted file mode 100644
index 35a157cc2..000000000
--- a/.changeset/timeline-status-dots.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-"@checkstack/ui": minor
-"@checkstack/maintenance-frontend": minor
-"@checkstack/incident-frontend": minor
-"@checkstack/status-page-frontend": minor
-"@checkstack/logstream-frontend": patch
-"@checkstack/metricstream-frontend": patch
-"@checkstack/tracestream-frontend": patch
----
-
-Colour timeline dots, and fix the rail they hang from
-
-Status-update timeline dots were uniformly grey, so the rail carried no
-information. They are now toned:
-
-- **Maintenance** dots take the update's own status. Maintenance has no severity,
-  so its lifecycle is the one coloured dimension and nothing competes with it.
-- **Incident** dots take the incident's SEVERITY, keeping status on a neutral
-  pill. Incidents carry both an urgency and a lifecycle, and `status-tone.ts`
-  gives the hue to the urgency - colouring both would put two competing scales on
-  one row.
-- **Public status pages** now tone the dot to match the status label already
-  rendered beside it.
-
-An update that changes nothing stays neutral, so a coloured dot always means "the
-status moved here".
-
-Also fixes the rail itself: it anchored its left EDGE at `left-4`, putting its
-centre at 16.25px while every dot centres at 16px, so each dot sat a hair off the
-line. The rail is now centred on the same axis, and a new exported `TimelineDot`
-owns the positioning so the four separate copies of that maths cannot diverge
-again.
diff --git a/bun.lock b/bun.lock
index 189ed15c2..71b8b1141 100644
--- a/bun.lock
+++ b/bun.lock
@@ -28,7 +28,7 @@
     },
     "core/about-common": {
       "name": "@checkstack/about-common",
-      "version": "0.3.9",
+      "version": "0.3.10",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/frontend-api": "workspace:*",
@@ -41,7 +41,7 @@
     },
     "core/about-frontend": {
       "name": "@checkstack/about-frontend",
-      "version": "0.5.9",
+      "version": "0.6.0",
       "dependencies": {
         "@checkstack/about-common": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -60,7 +60,7 @@
     },
     "core/ai-backend": {
       "name": "@checkstack/ai-backend",
-      "version": "0.11.4",
+      "version": "0.11.5",
       "dependencies": {
         "@ai-sdk/openai-compatible": "^2.0.48",
         "@checkstack/ai-common": "workspace:*",
@@ -91,7 +91,7 @@
     },
     "core/ai-common": {
       "name": "@checkstack/ai-common",
-      "version": "0.6.7",
+      "version": "0.6.8",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@orpc/contract": "^1.14.4",
@@ -105,7 +105,7 @@
     },
     "core/ai-frontend": {
       "name": "@checkstack/ai-frontend",
-      "version": "0.6.10",
+      "version": "0.7.0",
       "dependencies": {
         "@checkstack/ai-common": "workspace:*",
         "@checkstack/catalog-common": "workspace:*",
@@ -126,7 +126,7 @@
     },
     "core/announcement-backend": {
       "name": "@checkstack/announcement-backend",
-      "version": "0.6.7",
+      "version": "0.6.8",
       "dependencies": {
         "@checkstack/announcement-common": "workspace:*",
         "@checkstack/auth-backend": "workspace:*",
@@ -153,7 +153,7 @@
     },
     "core/announcement-common": {
       "name": "@checkstack/announcement-common",
-      "version": "0.7.2",
+      "version": "0.7.3",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/signal-common": "workspace:*",
@@ -168,7 +168,7 @@
     },
     "core/announcement-frontend": {
       "name": "@checkstack/announcement-frontend",
-      "version": "0.10.0",
+      "version": "0.11.0",
       "dependencies": {
         "@checkstack/announcement-common": "workspace:*",
         "@checkstack/auth-frontend": "workspace:*",
@@ -197,7 +197,7 @@
     },
     "core/anomaly-backend": {
       "name": "@checkstack/anomaly-backend",
-      "version": "1.5.6",
+      "version": "1.5.7",
       "dependencies": {
         "@checkstack/ai-backend": "workspace:*",
         "@checkstack/anomaly-common": "workspace:*",
@@ -233,7 +233,7 @@
     },
     "core/anomaly-common": {
       "name": "@checkstack/anomaly-common",
-      "version": "1.8.3",
+      "version": "1.8.4",
       "dependencies": {
         "@checkstack/catalog-common": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -250,7 +250,7 @@
     },
     "core/anomaly-frontend": {
       "name": "@checkstack/anomaly-frontend",
-      "version": "0.6.16",
+      "version": "0.7.0",
       "dependencies": {
         "@checkstack/anomaly-common": "workspace:*",
         "@checkstack/catalog-common": "workspace:*",
@@ -277,7 +277,7 @@
     },
     "core/api-docs-common": {
       "name": "@checkstack/api-docs-common",
-      "version": "0.1.28",
+      "version": "0.1.29",
       "dependencies": {
         "@checkstack/common": "workspace:*",
       },
@@ -289,7 +289,7 @@
     },
     "core/api-docs-frontend": {
       "name": "@checkstack/api-docs-frontend",
-      "version": "0.5.9",
+      "version": "0.6.0",
       "dependencies": {
         "@checkstack/api-docs-common": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -308,7 +308,7 @@
     },
     "core/auth-backend": {
       "name": "@checkstack/auth-backend",
-      "version": "0.13.0",
+      "version": "0.14.0",
       "dependencies": {
         "@checkstack/auth-common": "workspace:*",
         "@checkstack/backend-api": "workspace:*",
@@ -338,7 +338,7 @@
     },
     "core/auth-common": {
       "name": "@checkstack/auth-common",
-      "version": "0.16.0",
+      "version": "0.17.0",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@orpc/contract": "^1.14.4",
@@ -352,7 +352,7 @@
     },
     "core/auth-frontend": {
       "name": "@checkstack/auth-frontend",
-      "version": "0.15.0",
+      "version": "0.16.0",
       "dependencies": {
         "@checkstack/auth-common": "workspace:*",
         "@checkstack/catalog-common": "workspace:*",
@@ -378,7 +378,7 @@
     },
     "core/automation-backend": {
       "name": "@checkstack/automation-backend",
-      "version": "0.11.8",
+      "version": "0.11.9",
       "dependencies": {
         "@checkstack/ai-backend": "workspace:*",
         "@checkstack/ai-common": "workspace:*",
@@ -421,7 +421,7 @@
     },
     "core/automation-common": {
       "name": "@checkstack/automation-common",
-      "version": "0.10.2",
+      "version": "0.10.3",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/signal-common": "workspace:*",
@@ -437,7 +437,7 @@
     },
     "core/automation-frontend": {
       "name": "@checkstack/automation-frontend",
-      "version": "0.12.8",
+      "version": "0.13.0",
       "dependencies": {
         "@checkstack/ai-common": "workspace:*",
         "@checkstack/auth-common": "workspace:*",
@@ -471,7 +471,7 @@
     },
     "core/backend": {
       "name": "@checkstack/backend",
-      "version": "0.25.7",
+      "version": "0.26.0",
       "dependencies": {
         "@checkstack/api-docs-common": "workspace:*",
         "@checkstack/auth-common": "workspace:*",
@@ -516,7 +516,7 @@
     },
     "core/backend-api": {
       "name": "@checkstack/backend-api",
-      "version": "0.34.1",
+      "version": "0.35.0",
       "dependencies": {
         "@checkstack/cache-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -553,7 +553,7 @@
     },
     "core/cache-api": {
       "name": "@checkstack/cache-api",
-      "version": "0.3.20",
+      "version": "0.3.21",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "zod": "^4.0.0",
@@ -565,7 +565,7 @@
     },
     "core/cache-backend": {
       "name": "@checkstack/cache-backend",
-      "version": "0.4.27",
+      "version": "0.4.28",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/cache-api": "workspace:*",
@@ -582,7 +582,7 @@
     },
     "core/cache-common": {
       "name": "@checkstack/cache-common",
-      "version": "0.5.12",
+      "version": "0.5.13",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@orpc/contract": "^1.14.4",
@@ -596,7 +596,7 @@
     },
     "core/cache-frontend": {
       "name": "@checkstack/cache-frontend",
-      "version": "0.6.9",
+      "version": "0.6.10",
       "dependencies": {
         "@checkstack/cache-common": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -615,7 +615,7 @@
     },
     "core/cache-utils": {
       "name": "@checkstack/cache-utils",
-      "version": "0.3.1",
+      "version": "0.3.2",
       "dependencies": {
         "@checkstack/cache-api": "workspace:*",
       },
@@ -628,7 +628,7 @@
     },
     "core/catalog-backend": {
       "name": "@checkstack/catalog-backend",
-      "version": "1.10.1",
+      "version": "1.10.2",
       "dependencies": {
         "@checkstack/ai-backend": "workspace:*",
         "@checkstack/ai-common": "workspace:*",
@@ -665,7 +665,7 @@
     },
     "core/catalog-common": {
       "name": "@checkstack/catalog-common",
-      "version": "2.8.1",
+      "version": "2.8.2",
       "dependencies": {
         "@checkstack/auth-common": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -683,7 +683,7 @@
     },
     "core/catalog-frontend": {
       "name": "@checkstack/catalog-frontend",
-      "version": "0.21.2",
+      "version": "0.22.0",
       "dependencies": {
         "@checkstack/auth-common": "workspace:*",
         "@checkstack/auth-frontend": "workspace:*",
@@ -713,7 +713,7 @@
     },
     "core/command-backend": {
       "name": "@checkstack/command-backend",
-      "version": "0.2.27",
+      "version": "0.3.0",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/command-common": "workspace:*",
@@ -731,7 +731,7 @@
     },
     "core/command-common": {
       "name": "@checkstack/command-common",
-      "version": "0.3.12",
+      "version": "0.4.0",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@orpc/contract": "^1.14.4",
@@ -745,7 +745,7 @@
     },
     "core/command-frontend": {
       "name": "@checkstack/command-frontend",
-      "version": "0.5.15",
+      "version": "0.6.0",
       "dependencies": {
         "@checkstack/command-common": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -764,7 +764,7 @@
     },
     "core/common": {
       "name": "@checkstack/common",
-      "version": "0.23.0",
+      "version": "0.24.0",
       "dependencies": {
         "@orpc/contract": "^1.14.4",
         "lucide-react": "^1.17.0",
@@ -778,7 +778,7 @@
     },
     "core/create-checkstack-plugin": {
       "name": "create-checkstack-plugin",
-      "version": "0.1.17",
+      "version": "0.1.18",
       "bin": {
         "create-checkstack-plugin": "./src/cli.ts",
       },
@@ -796,7 +796,7 @@
     },
     "core/dashboard-frontend": {
       "name": "@checkstack/dashboard-frontend",
-      "version": "0.11.2",
+      "version": "0.12.0",
       "dependencies": {
         "@checkstack/catalog-common": "workspace:*",
         "@checkstack/catalog-frontend": "workspace:*",
@@ -826,7 +826,7 @@
     },
     "core/dependency-backend": {
       "name": "@checkstack/dependency-backend",
-      "version": "1.7.6",
+      "version": "1.7.7",
       "dependencies": {
         "@checkstack/ai-backend": "workspace:*",
         "@checkstack/automation-backend": "workspace:*",
@@ -861,7 +861,7 @@
     },
     "core/dependency-common": {
       "name": "@checkstack/dependency-common",
-      "version": "1.7.7",
+      "version": "1.7.8",
       "dependencies": {
         "@checkstack/catalog-common": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -879,7 +879,7 @@
     },
     "core/dependency-frontend": {
       "name": "@checkstack/dependency-frontend",
-      "version": "0.8.10",
+      "version": "0.9.0",
       "dependencies": {
         "@checkstack/catalog-common": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -907,7 +907,7 @@
     },
     "core/dev-server": {
       "name": "@checkstack/dev-server",
-      "version": "2.2.10",
+      "version": "2.2.11",
       "bin": {
         "checkstack-dev": "./src/dev-server.ts",
       },
@@ -961,7 +961,7 @@
     },
     "core/frontend": {
       "name": "@checkstack/frontend",
-      "version": "0.16.0",
+      "version": "0.17.0",
       "dependencies": {
         "@checkstack/about-frontend": "workspace:*",
         "@checkstack/announcement-frontend": "workspace:*",
@@ -1007,7 +1007,7 @@
     },
     "core/frontend-api": {
       "name": "@checkstack/frontend-api",
-      "version": "0.17.0",
+      "version": "0.18.0",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/signal-common": "workspace:*",
@@ -1029,7 +1029,7 @@
     },
     "core/gitops-backend": {
       "name": "@checkstack/gitops-backend",
-      "version": "0.5.27",
+      "version": "0.5.28",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/command-backend": "workspace:*",
@@ -1056,7 +1056,7 @@
     },
     "core/gitops-common": {
       "name": "@checkstack/gitops-common",
-      "version": "0.7.4",
+      "version": "0.7.5",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/secrets-common": "workspace:*",
@@ -1071,7 +1071,7 @@
     },
     "core/gitops-frontend": {
       "name": "@checkstack/gitops-frontend",
-      "version": "0.7.9",
+      "version": "0.8.0",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/frontend-api": "workspace:*",
@@ -1091,7 +1091,7 @@
     },
     "core/healthcheck-backend": {
       "name": "@checkstack/healthcheck-backend",
-      "version": "1.22.0",
+      "version": "1.23.0",
       "dependencies": {
         "@checkstack/ai-backend": "workspace:*",
         "@checkstack/ai-common": "workspace:*",
@@ -1146,7 +1146,7 @@
     },
     "core/healthcheck-common": {
       "name": "@checkstack/healthcheck-common",
-      "version": "1.19.0",
+      "version": "1.19.1",
       "dependencies": {
         "@checkstack/catalog-common": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -1164,7 +1164,7 @@
     },
     "core/healthcheck-execution": {
       "name": "@checkstack/healthcheck-execution",
-      "version": "0.35.0",
+      "version": "0.35.1",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -1180,7 +1180,7 @@
     },
     "core/healthcheck-frontend": {
       "name": "@checkstack/healthcheck-frontend",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "dependencies": {
         "@checkstack/anomaly-common": "workspace:*",
         "@checkstack/auth-frontend": "workspace:*",
@@ -1215,7 +1215,7 @@
     },
     "core/incident-backend": {
       "name": "@checkstack/incident-backend",
-      "version": "1.13.6",
+      "version": "1.14.0",
       "dependencies": {
         "@checkstack/ai-backend": "workspace:*",
         "@checkstack/ai-common": "workspace:*",
@@ -1255,7 +1255,7 @@
     },
     "core/incident-common": {
       "name": "@checkstack/incident-common",
-      "version": "1.10.5",
+      "version": "1.11.0",
       "dependencies": {
         "@checkstack/catalog-common": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -1273,7 +1273,7 @@
     },
     "core/incident-frontend": {
       "name": "@checkstack/incident-frontend",
-      "version": "0.16.5",
+      "version": "0.17.0",
       "dependencies": {
         "@checkstack/auth-frontend": "workspace:*",
         "@checkstack/catalog-common": "workspace:*",
@@ -1300,7 +1300,7 @@
     },
     "core/infrastructure-common": {
       "name": "@checkstack/infrastructure-common",
-      "version": "0.3.23",
+      "version": "0.3.24",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/frontend-api": "workspace:*",
@@ -1315,7 +1315,7 @@
     },
     "core/infrastructure-frontend": {
       "name": "@checkstack/infrastructure-frontend",
-      "version": "0.5.9",
+      "version": "0.6.0",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/frontend-api": "workspace:*",
@@ -1334,7 +1334,7 @@
     },
     "core/ingest-utils": {
       "name": "@checkstack/ingest-utils",
-      "version": "0.2.0",
+      "version": "0.2.1",
       "dependencies": {
         "@checkstack/cache-api": "workspace:*",
         "@checkstack/cache-utils": "workspace:*",
@@ -1349,7 +1349,7 @@
     },
     "core/integration-backend": {
       "name": "@checkstack/integration-backend",
-      "version": "0.7.9",
+      "version": "0.7.10",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/command-backend": "workspace:*",
@@ -1375,7 +1375,7 @@
     },
     "core/integration-common": {
       "name": "@checkstack/integration-common",
-      "version": "0.9.10",
+      "version": "0.9.11",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/signal-common": "workspace:*",
@@ -1390,7 +1390,7 @@
     },
     "core/integration-frontend": {
       "name": "@checkstack/integration-frontend",
-      "version": "0.8.9",
+      "version": "0.9.0",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/frontend-api": "workspace:*",
@@ -1411,7 +1411,7 @@
     },
     "core/k8s-events-common": {
       "name": "@checkstack/k8s-events-common",
-      "version": "0.1.1",
+      "version": "0.1.2",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/telemetry-common": "workspace:*",
@@ -1424,7 +1424,7 @@
     },
     "core/logstream-backend": {
       "name": "@checkstack/logstream-backend",
-      "version": "0.4.1",
+      "version": "0.4.2",
       "dependencies": {
         "@checkstack/ai-backend": "workspace:*",
         "@checkstack/auth-common": "workspace:*",
@@ -1458,7 +1458,7 @@
     },
     "core/logstream-common": {
       "name": "@checkstack/logstream-common",
-      "version": "0.4.1",
+      "version": "0.4.2",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/frontend-api": "workspace:*",
@@ -1475,7 +1475,7 @@
     },
     "core/logstream-frontend": {
       "name": "@checkstack/logstream-frontend",
-      "version": "0.3.2",
+      "version": "0.4.0",
       "dependencies": {
         "@checkstack/auth-frontend": "workspace:*",
         "@checkstack/catalog-common": "workspace:*",
@@ -1503,7 +1503,7 @@
     },
     "core/maintenance-backend": {
       "name": "@checkstack/maintenance-backend",
-      "version": "1.11.6",
+      "version": "1.12.0",
       "dependencies": {
         "@checkstack/ai-backend": "workspace:*",
         "@checkstack/ai-common": "workspace:*",
@@ -1541,7 +1541,7 @@
     },
     "core/maintenance-common": {
       "name": "@checkstack/maintenance-common",
-      "version": "1.10.5",
+      "version": "1.11.0",
       "dependencies": {
         "@checkstack/catalog-common": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -1559,7 +1559,7 @@
     },
     "core/maintenance-frontend": {
       "name": "@checkstack/maintenance-frontend",
-      "version": "0.17.0",
+      "version": "0.18.0",
       "dependencies": {
         "@checkstack/auth-frontend": "workspace:*",
         "@checkstack/catalog-common": "workspace:*",
@@ -1586,7 +1586,7 @@
     },
     "core/metricstream-backend": {
       "name": "@checkstack/metricstream-backend",
-      "version": "0.2.1",
+      "version": "0.2.2",
       "dependencies": {
         "@checkstack/ai-backend": "workspace:*",
         "@checkstack/auth-common": "workspace:*",
@@ -1623,7 +1623,7 @@
     },
     "core/metricstream-common": {
       "name": "@checkstack/metricstream-common",
-      "version": "0.2.1",
+      "version": "0.2.2",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/otlp-wire": "workspace:*",
@@ -1639,7 +1639,7 @@
     },
     "core/metricstream-frontend": {
       "name": "@checkstack/metricstream-frontend",
-      "version": "0.2.2",
+      "version": "0.3.0",
       "dependencies": {
         "@checkstack/auth-frontend": "workspace:*",
         "@checkstack/catalog-common": "workspace:*",
@@ -1667,7 +1667,7 @@
     },
     "core/notification-backend": {
       "name": "@checkstack/notification-backend",
-      "version": "1.8.6",
+      "version": "1.8.7",
       "dependencies": {
         "@checkstack/auth-backend": "workspace:*",
         "@checkstack/auth-common": "workspace:*",
@@ -1696,7 +1696,7 @@
     },
     "core/notification-common": {
       "name": "@checkstack/notification-common",
-      "version": "1.8.0",
+      "version": "1.9.0",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/signal-common": "workspace:*",
@@ -1711,7 +1711,7 @@
     },
     "core/notification-frontend": {
       "name": "@checkstack/notification-frontend",
-      "version": "0.9.7",
+      "version": "0.10.0",
       "dependencies": {
         "@checkstack/auth-frontend": "workspace:*",
         "@checkstack/catalog-common": "workspace:*",
@@ -1744,7 +1744,7 @@
     },
     "core/pluginmanager-common": {
       "name": "@checkstack/pluginmanager-common",
-      "version": "0.2.17",
+      "version": "0.2.18",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "zod": "^4.0.0",
@@ -1757,7 +1757,7 @@
     },
     "core/pluginmanager-frontend": {
       "name": "@checkstack/pluginmanager-frontend",
-      "version": "0.6.9",
+      "version": "0.7.0",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/frontend-api": "workspace:*",
@@ -1777,7 +1777,7 @@
     },
     "core/queue-api": {
       "name": "@checkstack/queue-api",
-      "version": "0.4.0",
+      "version": "0.4.1",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "zod": "^4.0.0",
@@ -1789,7 +1789,7 @@
     },
     "core/queue-backend": {
       "name": "@checkstack/queue-backend",
-      "version": "0.4.27",
+      "version": "0.4.28",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -1808,7 +1808,7 @@
     },
     "core/queue-common": {
       "name": "@checkstack/queue-common",
-      "version": "0.6.13",
+      "version": "0.6.14",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/signal-common": "workspace:*",
@@ -1823,7 +1823,7 @@
     },
     "core/queue-frontend": {
       "name": "@checkstack/queue-frontend",
-      "version": "0.7.9",
+      "version": "0.8.0",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/frontend-api": "workspace:*",
@@ -1847,11 +1847,11 @@
     },
     "core/release": {
       "name": "@checkstack/release",
-      "version": "0.136.0",
+      "version": "0.137.0",
     },
     "core/satellite": {
       "name": "@checkstack/satellite",
-      "version": "0.9.0",
+      "version": "0.9.1",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -1878,7 +1878,7 @@
     },
     "core/satellite-backend": {
       "name": "@checkstack/satellite-backend",
-      "version": "0.9.4",
+      "version": "0.10.0",
       "dependencies": {
         "@checkstack/automation-backend": "workspace:*",
         "@checkstack/automation-common": "workspace:*",
@@ -1917,7 +1917,7 @@
     },
     "core/satellite-common": {
       "name": "@checkstack/satellite-common",
-      "version": "0.11.0",
+      "version": "0.12.0",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/healthcheck-common": "workspace:*",
@@ -1934,7 +1934,7 @@
     },
     "core/satellite-frontend": {
       "name": "@checkstack/satellite-frontend",
-      "version": "0.8.4",
+      "version": "0.9.0",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/frontend-api": "workspace:*",
@@ -1957,7 +1957,7 @@
     },
     "core/screenshots": {
       "name": "@checkstack/screenshots",
-      "version": "0.0.10",
+      "version": "0.0.11",
       "dependencies": {
         "@checkstack/ai-backend": "workspace:*",
         "@checkstack/anomaly-backend": "workspace:*",
@@ -1980,7 +1980,7 @@
     },
     "core/script-packages-backend": {
       "name": "@checkstack/script-packages-backend",
-      "version": "0.4.6",
+      "version": "0.4.7",
       "dependencies": {
         "@checkstack/auth-common": "workspace:*",
         "@checkstack/backend-api": "workspace:*",
@@ -2004,7 +2004,7 @@
     },
     "core/script-packages-common": {
       "name": "@checkstack/script-packages-common",
-      "version": "0.4.2",
+      "version": "0.4.3",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/signal-common": "workspace:*",
@@ -2019,7 +2019,7 @@
     },
     "core/script-packages-frontend": {
       "name": "@checkstack/script-packages-frontend",
-      "version": "0.4.18",
+      "version": "0.5.0",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/frontend-api": "workspace:*",
@@ -2040,7 +2040,7 @@
     },
     "core/script-packages-store-postgres": {
       "name": "@checkstack/script-packages-store-postgres",
-      "version": "0.2.33",
+      "version": "0.2.34",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -2058,7 +2058,7 @@
     },
     "core/script-packages-store-s3": {
       "name": "@checkstack/script-packages-store-s3",
-      "version": "0.2.33",
+      "version": "0.2.34",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -2074,7 +2074,7 @@
     },
     "core/scripts": {
       "name": "@checkstack/scripts",
-      "version": "0.7.6",
+      "version": "0.7.7",
       "bin": {
         "checkstack-scripts": "./src/cli.ts",
       },
@@ -2099,7 +2099,7 @@
     },
     "core/sdk": {
       "name": "@checkstack/sdk",
-      "version": "0.136.0",
+      "version": "0.136.1",
       "dependencies": {
         "@checkstack/announcement-common": "workspace:*",
         "@checkstack/anomaly-common": "workspace:*",
@@ -2135,7 +2135,7 @@
     },
     "core/secrets-backend": {
       "name": "@checkstack/secrets-backend",
-      "version": "0.3.9",
+      "version": "0.3.10",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/command-backend": "workspace:*",
@@ -2161,7 +2161,7 @@
     },
     "core/secrets-backend-local": {
       "name": "@checkstack/secrets-backend-local",
-      "version": "0.1.29",
+      "version": "0.1.30",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -2185,7 +2185,7 @@
     },
     "core/secrets-backend-vault": {
       "name": "@checkstack/secrets-backend-vault",
-      "version": "0.1.29",
+      "version": "0.1.30",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -2210,7 +2210,7 @@
     },
     "core/secrets-common": {
       "name": "@checkstack/secrets-common",
-      "version": "0.3.3",
+      "version": "0.3.4",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@orpc/contract": "^1.14.4",
@@ -2225,7 +2225,7 @@
     },
     "core/secrets-frontend": {
       "name": "@checkstack/secrets-frontend",
-      "version": "0.3.17",
+      "version": "0.4.0",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/frontend-api": "workspace:*",
@@ -2244,7 +2244,7 @@
     },
     "core/signal-backend": {
       "name": "@checkstack/signal-backend",
-      "version": "0.3.27",
+      "version": "0.3.28",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -2260,7 +2260,7 @@
     },
     "core/signal-common": {
       "name": "@checkstack/signal-common",
-      "version": "0.3.1",
+      "version": "0.3.2",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "zod": "^4.0.0",
@@ -2273,7 +2273,7 @@
     },
     "core/signal-frontend": {
       "name": "@checkstack/signal-frontend",
-      "version": "0.3.7",
+      "version": "0.3.8",
       "dependencies": {
         "@checkstack/signal-common": "workspace:*",
       },
@@ -2289,7 +2289,7 @@
     },
     "core/slo-backend": {
       "name": "@checkstack/slo-backend",
-      "version": "0.12.6",
+      "version": "0.12.7",
       "dependencies": {
         "@checkstack/ai-backend": "workspace:*",
         "@checkstack/automation-backend": "workspace:*",
@@ -2327,7 +2327,7 @@
     },
     "core/slo-common": {
       "name": "@checkstack/slo-common",
-      "version": "0.9.5",
+      "version": "0.9.6",
       "dependencies": {
         "@checkstack/catalog-common": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -2344,7 +2344,7 @@
     },
     "core/slo-frontend": {
       "name": "@checkstack/slo-frontend",
-      "version": "0.11.8",
+      "version": "0.12.0",
       "dependencies": {
         "@checkstack/auth-frontend": "workspace:*",
         "@checkstack/catalog-common": "workspace:*",
@@ -2372,7 +2372,7 @@
     },
     "core/status-page-backend": {
       "name": "@checkstack/status-page-backend",
-      "version": "0.6.6",
+      "version": "0.7.0",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/command-backend": "workspace:*",
@@ -2399,7 +2399,7 @@
     },
     "core/status-page-common": {
       "name": "@checkstack/status-page-common",
-      "version": "0.6.5",
+      "version": "0.7.0",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/frontend-api": "workspace:*",
@@ -2416,7 +2416,7 @@
     },
     "core/status-page-frontend": {
       "name": "@checkstack/status-page-frontend",
-      "version": "0.8.0",
+      "version": "0.9.0",
       "dependencies": {
         "@checkstack/auth-frontend": "workspace:*",
         "@checkstack/catalog-common": "workspace:*",
@@ -2439,7 +2439,7 @@
     },
     "core/telemetry-backend": {
       "name": "@checkstack/telemetry-backend",
-      "version": "0.1.1",
+      "version": "0.2.0",
       "dependencies": {
         "@checkstack/auth-common": "workspace:*",
         "@checkstack/backend-api": "workspace:*",
@@ -2472,7 +2472,7 @@
     },
     "core/telemetry-common": {
       "name": "@checkstack/telemetry-common",
-      "version": "0.1.1",
+      "version": "0.2.0",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/frontend-api": "workspace:*",
@@ -2487,7 +2487,7 @@
     },
     "core/telemetry-frontend": {
       "name": "@checkstack/telemetry-frontend",
-      "version": "0.1.1",
+      "version": "0.2.0",
       "dependencies": {
         "@checkstack/auth-frontend": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -2514,7 +2514,7 @@
     },
     "core/template-engine": {
       "name": "@checkstack/template-engine",
-      "version": "0.4.12",
+      "version": "0.4.13",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "zod": "^4.0.0",
@@ -2527,7 +2527,7 @@
     },
     "core/test-utils-backend": {
       "name": "@checkstack/test-utils-backend",
-      "version": "0.1.61",
+      "version": "0.1.62",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -2566,7 +2566,7 @@
     },
     "core/theme-backend": {
       "name": "@checkstack/theme-backend",
-      "version": "0.2.27",
+      "version": "0.2.28",
       "dependencies": {
         "@checkstack/auth-backend": "workspace:*",
         "@checkstack/backend-api": "workspace:*",
@@ -2588,7 +2588,7 @@
     },
     "core/theme-common": {
       "name": "@checkstack/theme-common",
-      "version": "0.2.12",
+      "version": "0.2.13",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@orpc/contract": "^1.14.4",
@@ -2602,7 +2602,7 @@
     },
     "core/theme-frontend": {
       "name": "@checkstack/theme-frontend",
-      "version": "0.3.18",
+      "version": "0.4.0",
       "dependencies": {
         "@checkstack/auth-frontend": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -2621,7 +2621,7 @@
     },
     "core/tips-backend": {
       "name": "@checkstack/tips-backend",
-      "version": "0.3.27",
+      "version": "0.3.28",
       "dependencies": {
         "@checkstack/auth-backend": "workspace:*",
         "@checkstack/backend-api": "workspace:*",
@@ -2643,7 +2643,7 @@
     },
     "core/tips-common": {
       "name": "@checkstack/tips-common",
-      "version": "0.3.12",
+      "version": "0.3.13",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@orpc/contract": "^1.14.4",
@@ -2657,7 +2657,7 @@
     },
     "core/tips-frontend": {
       "name": "@checkstack/tips-frontend",
-      "version": "0.5.5",
+      "version": "0.5.6",
       "dependencies": {
         "@checkstack/auth-frontend": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -2677,7 +2677,7 @@
     },
     "core/tracestream-backend": {
       "name": "@checkstack/tracestream-backend",
-      "version": "0.1.1",
+      "version": "0.1.2",
       "dependencies": {
         "@checkstack/ai-backend": "workspace:*",
         "@checkstack/auth-common": "workspace:*",
@@ -2711,7 +2711,7 @@
     },
     "core/tracestream-common": {
       "name": "@checkstack/tracestream-common",
-      "version": "0.1.1",
+      "version": "0.1.2",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/frontend-api": "workspace:*",
@@ -2728,7 +2728,7 @@
     },
     "core/tracestream-frontend": {
       "name": "@checkstack/tracestream-frontend",
-      "version": "0.1.2",
+      "version": "0.2.0",
       "dependencies": {
         "@checkstack/auth-frontend": "workspace:*",
         "@checkstack/catalog-common": "workspace:*",
@@ -2772,7 +2772,7 @@
     },
     "core/ui": {
       "name": "@checkstack/ui",
-      "version": "1.30.0",
+      "version": "1.31.0",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "@checkstack/frontend-api": "workspace:*",
@@ -2857,7 +2857,7 @@
     },
     "plugins/auth-credential-backend": {
       "name": "@checkstack/auth-credential-backend",
-      "version": "0.0.70",
+      "version": "0.0.71",
       "dependencies": {
         "@checkstack/auth-backend": "workspace:*",
         "@checkstack/backend-api": "workspace:*",
@@ -2871,7 +2871,7 @@
     },
     "plugins/auth-github-backend": {
       "name": "@checkstack/auth-github-backend",
-      "version": "0.0.70",
+      "version": "0.0.71",
       "dependencies": {
         "@checkstack/auth-backend": "workspace:*",
         "@checkstack/backend-api": "workspace:*",
@@ -2885,7 +2885,7 @@
     },
     "plugins/auth-ldap-backend": {
       "name": "@checkstack/auth-ldap-backend",
-      "version": "0.2.27",
+      "version": "0.2.28",
       "dependencies": {
         "@checkstack/auth-backend": "workspace:*",
         "@checkstack/auth-common": "workspace:*",
@@ -2904,7 +2904,7 @@
     },
     "plugins/auth-saml-backend": {
       "name": "@checkstack/auth-saml-backend",
-      "version": "0.2.27",
+      "version": "0.2.28",
       "dependencies": {
         "@checkstack/auth-backend": "workspace:*",
         "@checkstack/auth-common": "workspace:*",
@@ -2922,7 +2922,7 @@
     },
     "plugins/cache-memory-backend": {
       "name": "@checkstack/cache-memory-backend",
-      "version": "0.3.36",
+      "version": "0.3.37",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/cache-api": "workspace:*",
@@ -2938,7 +2938,7 @@
     },
     "plugins/cache-memory-common": {
       "name": "@checkstack/cache-memory-common",
-      "version": "0.2.18",
+      "version": "0.2.19",
       "dependencies": {
         "@checkstack/common": "workspace:*",
       },
@@ -2949,7 +2949,7 @@
     },
     "plugins/cache-redis-backend": {
       "name": "@checkstack/cache-redis-backend",
-      "version": "0.1.4",
+      "version": "0.1.5",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/cache-api": "workspace:*",
@@ -2966,7 +2966,7 @@
     },
     "plugins/cache-redis-common": {
       "name": "@checkstack/cache-redis-common",
-      "version": "0.1.1",
+      "version": "0.1.2",
       "dependencies": {
         "@checkstack/common": "workspace:*",
       },
@@ -2977,7 +2977,7 @@
     },
     "plugins/collector-hardware-backend": {
       "name": "@checkstack/collector-hardware-backend",
-      "version": "0.1.66",
+      "version": "0.1.67",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -2993,7 +2993,7 @@
     },
     "plugins/healthcheck-container-backend": {
       "name": "@checkstack/healthcheck-container-backend",
-      "version": "0.2.5",
+      "version": "0.2.6",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3009,7 +3009,7 @@
     },
     "plugins/healthcheck-container-common": {
       "name": "@checkstack/healthcheck-container-common",
-      "version": "0.1.2",
+      "version": "0.1.3",
       "dependencies": {
         "@checkstack/common": "workspace:*",
       },
@@ -3022,7 +3022,7 @@
     },
     "plugins/healthcheck-dns-backend": {
       "name": "@checkstack/healthcheck-dns-backend",
-      "version": "0.5.5",
+      "version": "0.5.6",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3037,7 +3037,7 @@
     },
     "plugins/healthcheck-grpc-backend": {
       "name": "@checkstack/healthcheck-grpc-backend",
-      "version": "0.4.5",
+      "version": "0.4.6",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3053,7 +3053,7 @@
     },
     "plugins/healthcheck-http-backend": {
       "name": "@checkstack/healthcheck-http-backend",
-      "version": "0.8.1",
+      "version": "0.9.0",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3069,7 +3069,7 @@
     },
     "plugins/healthcheck-jenkins-backend": {
       "name": "@checkstack/healthcheck-jenkins-backend",
-      "version": "0.6.5",
+      "version": "0.6.6",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3084,7 +3084,7 @@
     },
     "plugins/healthcheck-mysql-backend": {
       "name": "@checkstack/healthcheck-mysql-backend",
-      "version": "0.5.5",
+      "version": "0.5.6",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3100,7 +3100,7 @@
     },
     "plugins/healthcheck-ping-backend": {
       "name": "@checkstack/healthcheck-ping-backend",
-      "version": "0.4.5",
+      "version": "0.4.6",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3115,7 +3115,7 @@
     },
     "plugins/healthcheck-postgres-backend": {
       "name": "@checkstack/healthcheck-postgres-backend",
-      "version": "0.5.5",
+      "version": "0.5.6",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3132,7 +3132,7 @@
     },
     "plugins/healthcheck-rcon-backend": {
       "name": "@checkstack/healthcheck-rcon-backend",
-      "version": "0.6.5",
+      "version": "0.6.6",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3149,7 +3149,7 @@
     },
     "plugins/healthcheck-rcon-common": {
       "name": "@checkstack/healthcheck-rcon-common",
-      "version": "0.2.28",
+      "version": "0.2.29",
       "dependencies": {
         "@checkstack/common": "workspace:*",
       },
@@ -3162,7 +3162,7 @@
     },
     "plugins/healthcheck-redis-backend": {
       "name": "@checkstack/healthcheck-redis-backend",
-      "version": "0.5.5",
+      "version": "0.5.6",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3178,7 +3178,7 @@
     },
     "plugins/healthcheck-script-backend": {
       "name": "@checkstack/healthcheck-script-backend",
-      "version": "0.10.2",
+      "version": "0.10.3",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3195,7 +3195,7 @@
     },
     "plugins/healthcheck-snmp-backend": {
       "name": "@checkstack/healthcheck-snmp-backend",
-      "version": "0.1.5",
+      "version": "0.1.6",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3211,7 +3211,7 @@
     },
     "plugins/healthcheck-ssh-backend": {
       "name": "@checkstack/healthcheck-ssh-backend",
-      "version": "0.5.5",
+      "version": "0.5.6",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3229,7 +3229,7 @@
     },
     "plugins/healthcheck-ssh-common": {
       "name": "@checkstack/healthcheck-ssh-common",
-      "version": "0.1.30",
+      "version": "0.1.31",
       "dependencies": {
         "@checkstack/common": "workspace:*",
       },
@@ -3242,7 +3242,7 @@
     },
     "plugins/healthcheck-tcp-backend": {
       "name": "@checkstack/healthcheck-tcp-backend",
-      "version": "0.5.5",
+      "version": "0.5.6",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3257,7 +3257,7 @@
     },
     "plugins/healthcheck-tls-backend": {
       "name": "@checkstack/healthcheck-tls-backend",
-      "version": "0.4.5",
+      "version": "0.4.6",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3272,7 +3272,7 @@
     },
     "plugins/integration-jira-backend": {
       "name": "@checkstack/integration-jira-backend",
-      "version": "0.7.19",
+      "version": "0.7.20",
       "dependencies": {
         "@checkstack/automation-backend": "workspace:*",
         "@checkstack/backend-api": "workspace:*",
@@ -3293,7 +3293,7 @@
     },
     "plugins/integration-jira-common": {
       "name": "@checkstack/integration-jira-common",
-      "version": "0.2.10",
+      "version": "0.2.11",
       "dependencies": {
         "@checkstack/common": "workspace:*",
         "zod": "^4.2.1",
@@ -3307,7 +3307,7 @@
     },
     "plugins/integration-script-backend": {
       "name": "@checkstack/integration-script-backend",
-      "version": "0.6.36",
+      "version": "0.6.37",
       "dependencies": {
         "@checkstack/automation-backend": "workspace:*",
         "@checkstack/automation-common": "workspace:*",
@@ -3329,7 +3329,7 @@
     },
     "plugins/integration-teams-backend": {
       "name": "@checkstack/integration-teams-backend",
-      "version": "0.2.26",
+      "version": "0.2.27",
       "dependencies": {
         "@checkstack/automation-backend": "workspace:*",
         "@checkstack/backend-api": "workspace:*",
@@ -3346,7 +3346,7 @@
     },
     "plugins/integration-webex-backend": {
       "name": "@checkstack/integration-webex-backend",
-      "version": "0.2.26",
+      "version": "0.2.27",
       "dependencies": {
         "@checkstack/automation-backend": "workspace:*",
         "@checkstack/backend-api": "workspace:*",
@@ -3363,7 +3363,7 @@
     },
     "plugins/integration-webhook-backend": {
       "name": "@checkstack/integration-webhook-backend",
-      "version": "0.1.39",
+      "version": "0.1.40",
       "dependencies": {
         "@checkstack/automation-backend": "workspace:*",
         "@checkstack/backend-api": "workspace:*",
@@ -3380,7 +3380,7 @@
     },
     "plugins/k8s-events-backend": {
       "name": "@checkstack/k8s-events-backend",
-      "version": "0.1.1",
+      "version": "0.1.2",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3396,7 +3396,7 @@
     },
     "plugins/notification-backstage-backend": {
       "name": "@checkstack/notification-backstage-backend",
-      "version": "0.2.7",
+      "version": "0.2.8",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3410,7 +3410,7 @@
     },
     "plugins/notification-discord-backend": {
       "name": "@checkstack/notification-discord-backend",
-      "version": "0.2.7",
+      "version": "0.2.8",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3424,7 +3424,7 @@
     },
     "plugins/notification-gotify-backend": {
       "name": "@checkstack/notification-gotify-backend",
-      "version": "0.2.7",
+      "version": "0.2.8",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3438,7 +3438,7 @@
     },
     "plugins/notification-pushover-backend": {
       "name": "@checkstack/notification-pushover-backend",
-      "version": "0.1.71",
+      "version": "0.1.72",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3452,7 +3452,7 @@
     },
     "plugins/notification-slack-backend": {
       "name": "@checkstack/notification-slack-backend",
-      "version": "0.2.7",
+      "version": "0.2.8",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3466,7 +3466,7 @@
     },
     "plugins/notification-smtp-backend": {
       "name": "@checkstack/notification-smtp-backend",
-      "version": "0.0.80",
+      "version": "0.0.81",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3482,7 +3482,7 @@
     },
     "plugins/notification-teams-backend": {
       "name": "@checkstack/notification-teams-backend",
-      "version": "0.0.79",
+      "version": "0.0.80",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3496,7 +3496,7 @@
     },
     "plugins/notification-telegram-backend": {
       "name": "@checkstack/notification-telegram-backend",
-      "version": "0.0.79",
+      "version": "0.0.80",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3512,7 +3512,7 @@
     },
     "plugins/notification-webex-backend": {
       "name": "@checkstack/notification-webex-backend",
-      "version": "0.0.79",
+      "version": "0.0.80",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3526,7 +3526,7 @@
     },
     "plugins/notification-webhook-backend": {
       "name": "@checkstack/notification-webhook-backend",
-      "version": "0.1.7",
+      "version": "0.1.8",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3540,7 +3540,7 @@
     },
     "plugins/queue-bullmq-backend": {
       "name": "@checkstack/queue-bullmq-backend",
-      "version": "0.5.12",
+      "version": "0.5.13",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3557,7 +3557,7 @@
     },
     "plugins/queue-bullmq-common": {
       "name": "@checkstack/queue-bullmq-common",
-      "version": "0.1.28",
+      "version": "0.1.29",
       "dependencies": {
         "@checkstack/common": "workspace:*",
       },
@@ -3569,7 +3569,7 @@
     },
     "plugins/queue-memory-backend": {
       "name": "@checkstack/queue-memory-backend",
-      "version": "0.4.36",
+      "version": "0.4.37",
       "dependencies": {
         "@checkstack/backend-api": "workspace:*",
         "@checkstack/common": "workspace:*",
@@ -3586,7 +3586,7 @@
     },
     "plugins/queue-memory-common": {
       "name": "@checkstack/queue-memory-common",
-      "version": "0.1.28",
+      "version": "0.1.29",
       "dependencies": {
         "@checkstack/common": "workspace:*",
       },
diff --git a/core/about-common/CHANGELOG.md b/core/about-common/CHANGELOG.md
index c8efaa991..fb1224dde 100644
--- a/core/about-common/CHANGELOG.md
+++ b/core/about-common/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @checkstack/about-common
 
+## 0.3.10
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/frontend-api@0.18.0
+
 ## 0.3.9
 
 ### Patch Changes
diff --git a/core/about-common/package.json b/core/about-common/package.json
index 4cae0e2fb..37dfe04f7 100644
--- a/core/about-common/package.json
+++ b/core/about-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/about-common",
-  "version": "0.3.9",
+  "version": "0.3.10",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/about-frontend/CHANGELOG.md b/core/about-frontend/CHANGELOG.md
index c790af36f..2697d7a86 100644
--- a/core/about-frontend/CHANGELOG.md
+++ b/core/about-frontend/CHANGELOG.md
@@ -1,5 +1,71 @@
 # @checkstack/about-frontend
 
+## 0.6.0
+
+### Minor Changes
+
+- 88f4333: Show the platform release version on the About page
+
+  The About page showed only `@checkstack/backend`'s package version, which cannot
+  be matched to a GitHub release, a Docker tag or a changelog entry - those all
+  carry `@checkstack/release`'s version, which advances on every release while the
+  core package's does not.
+
+  Both are now shown, explicitly labelled, with the release version leading and
+  linked to its GitHub tag.
+
+  The release version is baked in at version time by a new
+  `generate:release-version` script (checked in CI, mirroring the docs index)
+  rather than read at runtime: `@checkstack/release` is private and therefore
+  absent from `node_modules` in an npm install, so a relative-path read would work
+  in the monorepo and Docker image and silently fail everywhere else.
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/about-common@0.3.10
+
 ## 0.5.9
 
 ### Patch Changes
diff --git a/core/about-frontend/package.json b/core/about-frontend/package.json
index a87397c0c..2599e4aea 100644
--- a/core/about-frontend/package.json
+++ b/core/about-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/about-frontend",
-  "version": "0.5.9",
+  "version": "0.6.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/ai-backend/CHANGELOG.md b/core/ai-backend/CHANGELOG.md
index 0c64ebbb8..e1afce7d7 100644
--- a/core/ai-backend/CHANGELOG.md
+++ b/core/ai-backend/CHANGELOG.md
@@ -1,5 +1,91 @@
 # @checkstack/ai-backend
 
+## 0.11.5
+
+### Patch Changes
+
+- 88f4333: Resolve `#` mentions on public status pages, and check viewability in the admin UI
+
+  Cross-entity mentions previously resolved only in the admin UI, and did so
+  without asking whether the reader could actually open the target. Public
+  surfaces resolved nothing at all. Three changes, one per delivery context.
+
+  **The admin UI now checks viewability.** `useMentionResolution({ documents })`
+  collects the references a page is about to render and asks each owning plugin -
+  in ONE batched request - which of them this viewer may read. A mention to a
+  deleted or unreadable record now renders as plain text instead of a link to a
+  not-found page or an access gate. Backed by new `resolveIncidentRefs` /
+  `resolveMaintenanceRefs` procedures, which return ids only (so an unreadable
+  record is indistinguishable from a deleted one) and carry the same `listKey`
+  read post-filter as their list procedures. They are deliberately not a filter
+  over the authoring search list, which hides resolved incidents and would
+  silently downgrade valid references.
+
+  **Public status pages now resolve mentions.** A reference becomes a link to the
+  target's public detail page when - and only when - the same page publishes that
+  target, which is exactly the anti-enumeration gate the detail pages already
+  apply. So an operator writing "caused by #Database upgrade" in a public update
+  gets a working link, while a mention of an internal-only incident stays plain
+  text rather than becoming a link that confirms it exists. Widgets opt in by
+  declaring a `mentionType`, so the status-page packages take no dependency on any
+  domain plugin.
+
+  **BREAKING CHANGE (behavioural, no API change):** the in-app public status page
+  at `/statuspage/view/<slug>` now builds detail-page hrefs. Previously it passed
+  none, so incident and maintenance titles rendered as plain text there while the
+  same page on a custom domain linked them. Both now behave identically.
+
+  **Notification bodies no longer leak the internal scheme.** `checkstack:` is
+  meaningless outside a Checkstack renderer, and channels leaked it differently:
+  the email sanitiser stripped the href and left a dead anchor, while Slack's
+  mrkdwn emitted `<checkstack:maintenance/9f1c-abc|Database upgrade>` straight to
+  the recipient (Discord, Telegram and Teams render markdown natively and would
+  have passed it through too). `sanitizeUpdateMessage` now flattens every mention
+  to its label before the body reaches any channel, so no channel has to know the
+  scheme exists. Flattening also happens before the length bound, so the excerpt
+  budget is spent on visible text rather than on an internal URI.
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/auth-common@0.17.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/ai-common@0.6.8
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/integration-backend@0.7.10
+  - @checkstack/sdk@0.136.1
+
 ## 0.11.4
 
 ### Patch Changes
diff --git a/core/ai-backend/package.json b/core/ai-backend/package.json
index e457b7dbb..945332220 100644
--- a/core/ai-backend/package.json
+++ b/core/ai-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/ai-backend",
-  "version": "0.11.4",
+  "version": "0.11.5",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/ai-common/CHANGELOG.md b/core/ai-common/CHANGELOG.md
index b46c1dd38..5dc1667d0 100644
--- a/core/ai-common/CHANGELOG.md
+++ b/core/ai-common/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @checkstack/ai-common
 
+## 0.6.8
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+
 ## 0.6.7
 
 ### Patch Changes
diff --git a/core/ai-common/package.json b/core/ai-common/package.json
index b0ac60b97..d6cf2ad80 100644
--- a/core/ai-common/package.json
+++ b/core/ai-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/ai-common",
-  "version": "0.6.7",
+  "version": "0.6.8",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/ai-frontend/CHANGELOG.md b/core/ai-frontend/CHANGELOG.md
index b373a6b3d..dd02b3ed4 100644
--- a/core/ai-frontend/CHANGELOG.md
+++ b/core/ai-frontend/CHANGELOG.md
@@ -1,5 +1,57 @@
 # @checkstack/ai-frontend
 
+## 0.7.0
+
+### Minor Changes
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/ai-common@0.6.8
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/integration-common@0.9.11
+
 ## 0.6.10
 
 ### Patch Changes
diff --git a/core/ai-frontend/package.json b/core/ai-frontend/package.json
index d37f6326f..a0caf8661 100644
--- a/core/ai-frontend/package.json
+++ b/core/ai-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/ai-frontend",
-  "version": "0.6.10",
+  "version": "0.7.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/announcement-backend/CHANGELOG.md b/core/announcement-backend/CHANGELOG.md
index b6a2c8738..6617905b9 100644
--- a/core/announcement-backend/CHANGELOG.md
+++ b/core/announcement-backend/CHANGELOG.md
@@ -1,5 +1,26 @@
 # @checkstack/announcement-backend
 
+## 0.6.8
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/command-backend@0.3.0
+  - @checkstack/status-page-backend@0.7.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/auth-backend@0.14.0
+  - @checkstack/announcement-common@0.7.3
+  - @checkstack/cache-api@0.3.21
+  - @checkstack/signal-common@0.3.2
+  - @checkstack/cache-utils@0.3.2
+
 ## 0.6.7
 
 ### Patch Changes
diff --git a/core/announcement-backend/package.json b/core/announcement-backend/package.json
index c849b1bcb..8ed3f413d 100644
--- a/core/announcement-backend/package.json
+++ b/core/announcement-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/announcement-backend",
-  "version": "0.6.7",
+  "version": "0.6.8",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/announcement-common/CHANGELOG.md b/core/announcement-common/CHANGELOG.md
index 67b4ef3f0..beab891ca 100644
--- a/core/announcement-common/CHANGELOG.md
+++ b/core/announcement-common/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @checkstack/announcement-common
 
+## 0.7.3
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/signal-common@0.3.2
+
 ## 0.7.2
 
 ### Patch Changes
diff --git a/core/announcement-common/package.json b/core/announcement-common/package.json
index 88f91f666..efca18546 100644
--- a/core/announcement-common/package.json
+++ b/core/announcement-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/announcement-common",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/announcement-frontend/CHANGELOG.md b/core/announcement-frontend/CHANGELOG.md
index 4c4546c35..dd16c6fc3 100644
--- a/core/announcement-frontend/CHANGELOG.md
+++ b/core/announcement-frontend/CHANGELOG.md
@@ -1,5 +1,82 @@
 # @checkstack/announcement-frontend
 
+## 0.11.0
+
+### Minor Changes
+
+- 88f4333: Markdown editor with a live preview tab and formatting toolbar
+
+  Markdown fields were plain textareas with a "Markdown supported" hint, so an
+  author found out how their text rendered only after saving - or, for a
+  notification, after it had already been delivered.
+
+  New `MarkdownEditor` in `@checkstack/ui`: Write / Preview tabs plus a toolbar
+  (bold, italic, link, code, lists, quote). Adopted by the incident and maintenance
+  update forms and descriptions, and the announcement message.
+
+  The preview renders through `MarkdownBlock` - the same component, remark/rehype
+  chain and sanitiser used for the saved content. A second renderer here would be
+  free to drift, and a preview that disagrees with the real render is worse than no
+  preview.
+
+  Toolbar marks toggle rather than only adding, and mark lengths are matched
+  exactly so italic (`*`) never claims bold's (`**`) delimiters and silently
+  downgrades an author's emphasis.
+
+  Note for adopters: `MarkdownEditor` wraps its textarea, so `required` on it does
+  nothing - gate submission explicitly instead.
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+  - @checkstack/auth-frontend@0.16.0
+  - @checkstack/common@0.24.0
+  - @checkstack/status-page-common@0.7.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/tips-frontend@0.5.6
+  - @checkstack/announcement-common@0.7.3
+  - @checkstack/signal-frontend@0.3.8
+
 ## 0.10.0
 
 ### Minor Changes
diff --git a/core/announcement-frontend/package.json b/core/announcement-frontend/package.json
index e6b53488c..57c53f6b5 100644
--- a/core/announcement-frontend/package.json
+++ b/core/announcement-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/announcement-frontend",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/anomaly-backend/CHANGELOG.md b/core/anomaly-backend/CHANGELOG.md
index 960befbac..e794e45f0 100644
--- a/core/anomaly-backend/CHANGELOG.md
+++ b/core/anomaly-backend/CHANGELOG.md
@@ -1,5 +1,33 @@
 # @checkstack/anomaly-backend
 
+## 1.5.7
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/ai-backend@0.11.5
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/healthcheck-backend@1.23.0
+  - @checkstack/anomaly-common@1.8.4
+  - @checkstack/cache-api@0.3.21
+  - @checkstack/catalog-backend@1.10.2
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/gitops-backend@0.5.28
+  - @checkstack/gitops-common@0.7.5
+  - @checkstack/queue-api@0.4.1
+  - @checkstack/signal-common@0.3.2
+  - @checkstack/cache-utils@0.3.2
+
 ## 1.5.6
 
 ### Patch Changes
diff --git a/core/anomaly-backend/package.json b/core/anomaly-backend/package.json
index b5586c6d1..d90c251f8 100644
--- a/core/anomaly-backend/package.json
+++ b/core/anomaly-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/anomaly-backend",
-  "version": "1.5.6",
+  "version": "1.5.7",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/anomaly-common/CHANGELOG.md b/core/anomaly-common/CHANGELOG.md
index 75ae3c37e..00e32b683 100644
--- a/core/anomaly-common/CHANGELOG.md
+++ b/core/anomaly-common/CHANGELOG.md
@@ -1,5 +1,21 @@
 # @checkstack/anomaly-common
 
+## 1.8.4
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/signal-common@0.3.2
+
 ## 1.8.3
 
 ### Patch Changes
diff --git a/core/anomaly-common/package.json b/core/anomaly-common/package.json
index 509706189..e2b758759 100644
--- a/core/anomaly-common/package.json
+++ b/core/anomaly-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/anomaly-common",
-  "version": "1.8.3",
+  "version": "1.8.4",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/anomaly-frontend/CHANGELOG.md b/core/anomaly-frontend/CHANGELOG.md
index 22e344703..51b8c622e 100644
--- a/core/anomaly-frontend/CHANGELOG.md
+++ b/core/anomaly-frontend/CHANGELOG.md
@@ -1,5 +1,63 @@
 # @checkstack/anomaly-frontend
 
+## 0.7.0
+
+### Minor Changes
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/healthcheck-frontend@0.39.0
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/notification-frontend@0.10.0
+  - @checkstack/anomaly-common@1.8.4
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/signal-frontend@0.3.8
+
 ## 0.6.16
 
 ### Patch Changes
diff --git a/core/anomaly-frontend/package.json b/core/anomaly-frontend/package.json
index 47940d9f8..31c43a3ba 100644
--- a/core/anomaly-frontend/package.json
+++ b/core/anomaly-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/anomaly-frontend",
-  "version": "0.6.16",
+  "version": "0.7.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/api-docs-common/CHANGELOG.md b/core/api-docs-common/CHANGELOG.md
index 958a71402..98a518606 100644
--- a/core/api-docs-common/CHANGELOG.md
+++ b/core/api-docs-common/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @checkstack/api-docs-common
 
+## 0.1.29
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+
 ## 0.1.28
 
 ### Patch Changes
diff --git a/core/api-docs-common/package.json b/core/api-docs-common/package.json
index 52796b84e..890116f1d 100644
--- a/core/api-docs-common/package.json
+++ b/core/api-docs-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/api-docs-common",
-  "version": "0.1.28",
+  "version": "0.1.29",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/api-docs-frontend/CHANGELOG.md b/core/api-docs-frontend/CHANGELOG.md
index 06599cacf..921e97a0e 100644
--- a/core/api-docs-frontend/CHANGELOG.md
+++ b/core/api-docs-frontend/CHANGELOG.md
@@ -1,5 +1,92 @@
 # @checkstack/api-docs-frontend
 
+## 0.6.0
+
+### Minor Changes
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- 1deaac5: Make endpoint authorization self-documenting in the generated API docs
+
+  Every procedure's authorization is now derived from its contract metadata (its
+  `access` rules + `instanceAccess` mode) via a shared mode-descriptor registry and
+  emitted into the OpenAPI spec - both structurally (`x-orpc-meta.authorization`)
+  and as a human `**Authorization.**` sentence folded into the operation
+  description. Previously the docs surfaced only a flat list of global rule ids, so
+  an integrator (an API-key/application principal that CAN hold team grants) never
+  saw the team-grant / per-object dimension, and endpoints gated purely in the
+  handler showed no restriction at all.
+
+  For authorization that no declarative mode can express and is therefore enforced
+  in the handler (a compound OR, a graded verdict, a DB-derived id set), a new
+  optional `accessNote` on the procedure metadata surfaces the real rule in the
+  docs as an explicitly handler-enforced addendum. The note is documentation, not a
+  guarantee: per `.claude/rules/rlac.md` the drift guard for such authz is
+  behavioral tests over an extracted pure decision function, and the note must
+  state exactly what those tests pin.
+
+  Every handler-enforced authorization endpoint now carries such a note so the docs
+  are complete: the team read/scoping and team-management endpoints
+  (`@checkstack/auth-common`), the health-check assignment/history reads
+  (`@checkstack/healthcheck-common`), the audience-graded incident/maintenance
+  reads (`@checkstack/incident-common`, `@checkstack/maintenance-common`), status
+  -page publish's bound-resource check (`@checkstack/status-page-common`), the
+  stream `setSystemLinks` readable-additions check
+  (`@checkstack/{metricstream,tracestream,logstream}-common`), and the automation
+  `runAs` escalation guard (`@checkstack/automation-common`). These are
+  metadata-only additions - no runtime behavior changed. The notes describe the
+  rule for API-doc readers only; the drift guard is behavioral tests over the
+  check's decision function (per `.claude/rules/rlac.md`), so the notes name no
+  internal test files.
+
+  The API docs viewer (`@checkstack/api-docs-frontend`) now renders each
+  operation's description as Markdown, so the `**Authorization.**` block (and any
+  inline `code`) formats correctly instead of showing raw markdown.
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/api-docs-common@0.1.29
+
 ## 0.5.9
 
 ### Patch Changes
diff --git a/core/api-docs-frontend/package.json b/core/api-docs-frontend/package.json
index 40eefcad7..1f69a9a77 100644
--- a/core/api-docs-frontend/package.json
+++ b/core/api-docs-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/api-docs-frontend",
-  "version": "0.5.9",
+  "version": "0.6.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/auth-backend/CHANGELOG.md b/core/auth-backend/CHANGELOG.md
index 855d968eb..0e2439d7c 100644
--- a/core/auth-backend/CHANGELOG.md
+++ b/core/auth-backend/CHANGELOG.md
@@ -1,5 +1,45 @@
 # @checkstack/auth-backend
 
+## 0.14.0
+
+### Minor Changes
+
+- 1deaac5: Add the `objectRef` instanceAccess mode and move the relation-write authz onto it
+
+  The relation-tuple writes (`writeRelation` / `removeRelation` / `setObjectPublic`)
+  administer team access on ANY resource type, so their authorization could not be
+  expressed by the existing `instanceAccess` modes (which all assume a fixed
+  resource type) and was enforced by hand in the auth handlers with `access: []` -
+  leaving the contract unable to declare the rule and the API docs showing no
+  restriction.
+
+  A new `objectRef` mode reads the object's TYPE and id from the request body
+  (`typeParam` / `idParam`) and authorizes via the same engine native scoping uses:
+  the endpoint's own access rule (`auth.teams.manage`) is the global admin
+  OR-override, otherwise the caller must be able to manage the referenced object
+  (its own `<type>.manage` rule on a non-private object, or a team editor/owner
+  grant on it). `autoAuthMiddleware` enforces it, the boot validator recognises it
+  (input paths cross-checked), and the auth handlers drop their hand-rolled checks.
+  Behaviour is unchanged; the authorization is now contract-declared and enforced
+  by the middleware rather than the handler.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/auth-common@0.17.0
+  - @checkstack/command-backend@0.3.0
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/cache-api@0.3.21
+  - @checkstack/cache-utils@0.3.2
+
 ## 0.13.0
 
 ### Minor Changes
diff --git a/core/auth-backend/package.json b/core/auth-backend/package.json
index a346527f1..c3b1cc43d 100644
--- a/core/auth-backend/package.json
+++ b/core/auth-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/auth-backend",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/auth-common/CHANGELOG.md b/core/auth-common/CHANGELOG.md
index 72be5ef01..f62b34732 100644
--- a/core/auth-common/CHANGELOG.md
+++ b/core/auth-common/CHANGELOG.md
@@ -1,5 +1,75 @@
 # @checkstack/auth-common
 
+## 0.17.0
+
+### Minor Changes
+
+- 1deaac5: Add the `objectRef` instanceAccess mode and move the relation-write authz onto it
+
+  The relation-tuple writes (`writeRelation` / `removeRelation` / `setObjectPublic`)
+  administer team access on ANY resource type, so their authorization could not be
+  expressed by the existing `instanceAccess` modes (which all assume a fixed
+  resource type) and was enforced by hand in the auth handlers with `access: []` -
+  leaving the contract unable to declare the rule and the API docs showing no
+  restriction.
+
+  A new `objectRef` mode reads the object's TYPE and id from the request body
+  (`typeParam` / `idParam`) and authorizes via the same engine native scoping uses:
+  the endpoint's own access rule (`auth.teams.manage`) is the global admin
+  OR-override, otherwise the caller must be able to manage the referenced object
+  (its own `<type>.manage` rule on a non-private object, or a team editor/owner
+  grant on it). `autoAuthMiddleware` enforces it, the boot validator recognises it
+  (input paths cross-checked), and the auth handlers drop their hand-rolled checks.
+  Behaviour is unchanged; the authorization is now contract-declared and enforced
+  by the middleware rather than the handler.
+
+### Patch Changes
+
+- 1deaac5: Make endpoint authorization self-documenting in the generated API docs
+
+  Every procedure's authorization is now derived from its contract metadata (its
+  `access` rules + `instanceAccess` mode) via a shared mode-descriptor registry and
+  emitted into the OpenAPI spec - both structurally (`x-orpc-meta.authorization`)
+  and as a human `**Authorization.**` sentence folded into the operation
+  description. Previously the docs surfaced only a flat list of global rule ids, so
+  an integrator (an API-key/application principal that CAN hold team grants) never
+  saw the team-grant / per-object dimension, and endpoints gated purely in the
+  handler showed no restriction at all.
+
+  For authorization that no declarative mode can express and is therefore enforced
+  in the handler (a compound OR, a graded verdict, a DB-derived id set), a new
+  optional `accessNote` on the procedure metadata surfaces the real rule in the
+  docs as an explicitly handler-enforced addendum. The note is documentation, not a
+  guarantee: per `.claude/rules/rlac.md` the drift guard for such authz is
+  behavioral tests over an extracted pure decision function, and the note must
+  state exactly what those tests pin.
+
+  Every handler-enforced authorization endpoint now carries such a note so the docs
+  are complete: the team read/scoping and team-management endpoints
+  (`@checkstack/auth-common`), the health-check assignment/history reads
+  (`@checkstack/healthcheck-common`), the audience-graded incident/maintenance
+  reads (`@checkstack/incident-common`, `@checkstack/maintenance-common`), status
+  -page publish's bound-resource check (`@checkstack/status-page-common`), the
+  stream `setSystemLinks` readable-additions check
+  (`@checkstack/{metricstream,tracestream,logstream}-common`), and the automation
+  `runAs` escalation guard (`@checkstack/automation-common`). These are
+  metadata-only additions - no runtime behavior changed. The notes describe the
+  rule for API-doc readers only; the drift guard is behavioral tests over the
+  check's decision function (per `.claude/rules/rlac.md`), so the notes name no
+  internal test files.
+
+  The API docs viewer (`@checkstack/api-docs-frontend`) now renders each
+  operation's description as Markdown, so the `**Authorization.**` block (and any
+  inline `code`) formats correctly instead of showing raw markdown.
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+
 ## 0.16.0
 
 ### Minor Changes
diff --git a/core/auth-common/package.json b/core/auth-common/package.json
index 3a09c3772..ebd2c43e1 100644
--- a/core/auth-common/package.json
+++ b/core/auth-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/auth-common",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/auth-frontend/CHANGELOG.md b/core/auth-frontend/CHANGELOG.md
index 585dd09c6..d7c5f0df3 100644
--- a/core/auth-frontend/CHANGELOG.md
+++ b/core/auth-frontend/CHANGELOG.md
@@ -1,5 +1,102 @@
 # @checkstack/auth-frontend
 
+## 0.16.0
+
+### Minor Changes
+
+- 88f4333: Role editor: alphabetised categories, bulk select, and role cloning
+
+  Access-rule categories in the role dialog are now sorted alphabetically (by their
+  rendered label, at both the category and the rule level) instead of following
+  plugin registration order, so a category can be found by scanning rather than by
+  reading the whole list.
+
+  Each category gained **Select all** / **Clear** actions. They respect the same
+  guards the individual checkboxes do - the anonymous role still cannot be granted
+  rules no public endpoint uses, and a locked role stays read-only.
+
+  Roles can be **cloned**: a new role seeded from an existing one's access rules,
+  saved as a create. The dialog now takes an explicit `mode` rather than inferring
+  "editing" from the presence of a role, which is what made the third state
+  expressible at all.
+
+  Adds a shared `buildClonedName` helper to `@checkstack/common` so every clone
+  affordance in the product produces the same name shape.
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+- 88f4333: Clarify the team-access editor and guard against locking yourself out
+
+  Four fixes to the "Who can change this" editor and the team member picker, from
+  user feedback:
+
+  - **The "Manage" checkbox read as "manage the team".** It sets the selected
+    team's grant on THIS resource, but the label plus a gear icon suggested it
+    would open the team itself. It is now labelled **"Can edit"** (with no gear),
+    naming its effect on the resource.
+  - **The team name is now a link** to that team (`/teams?team=<id>`), which opens
+    its members dialog directly. That gives "take me to the team" its own
+    affordance instead of overloading the checkbox. The Teams page consumes the
+    `team` query param once and then clears it.
+  - **Revoking your own team's access now asks first.** A team-scoped user could
+    remove (or downgrade) their own team's only edit grant and afterwards be unable
+    to change the resource _or_ restore the permission. That case now shows a
+    confirmation explaining the consequence. Global `auth.teams.manage` admins are
+    not warned - they can always restore it. The decision is a pure, unit-tested
+    `isSelfRevokingChange`.
+  - **The add-member field explained.** Its placeholder ("Add a user by name or
+    email") and new helper text state that it adds a NEW member from the whole
+    directory rather than filtering current members, and that a user is only
+    findable after their first sign-in (SSO/LDAP accounts materialise on login).
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/auth-common@0.17.0
+  - @checkstack/incident-common@1.11.0
+  - @checkstack/maintenance-common@1.11.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/catalog-common@2.8.2
+
 ## 0.15.0
 
 ### Minor Changes
diff --git a/core/auth-frontend/package.json b/core/auth-frontend/package.json
index 8ce94b5ec..26a1629d4 100644
--- a/core/auth-frontend/package.json
+++ b/core/auth-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/auth-frontend",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/automation-backend/CHANGELOG.md b/core/automation-backend/CHANGELOG.md
index 283a6930b..3548b0760 100644
--- a/core/automation-backend/CHANGELOG.md
+++ b/core/automation-backend/CHANGELOG.md
@@ -1,5 +1,36 @@
 # @checkstack/automation-backend
 
+## 0.11.9
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/auth-common@0.17.0
+  - @checkstack/automation-common@0.10.3
+  - @checkstack/command-backend@0.3.0
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/ai-backend@0.11.5
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/ai-common@0.6.8
+  - @checkstack/gitops-backend@0.5.28
+  - @checkstack/gitops-common@0.7.5
+  - @checkstack/integration-common@0.9.11
+  - @checkstack/queue-api@0.4.1
+  - @checkstack/script-packages-backend@0.4.7
+  - @checkstack/sdk@0.136.1
+  - @checkstack/secrets-common@0.3.4
+  - @checkstack/signal-common@0.3.2
+  - @checkstack/template-engine@0.4.13
+
 ## 0.11.8
 
 ### Patch Changes
diff --git a/core/automation-backend/package.json b/core/automation-backend/package.json
index 70609c85d..bb26f92a7 100644
--- a/core/automation-backend/package.json
+++ b/core/automation-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/automation-backend",
-  "version": "0.11.8",
+  "version": "0.11.9",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/automation-common/CHANGELOG.md b/core/automation-common/CHANGELOG.md
index 838e63fcd..c951f4ebe 100644
--- a/core/automation-common/CHANGELOG.md
+++ b/core/automation-common/CHANGELOG.md
@@ -1,5 +1,56 @@
 # @checkstack/automation-common
 
+## 0.10.3
+
+### Patch Changes
+
+- 1deaac5: Make endpoint authorization self-documenting in the generated API docs
+
+  Every procedure's authorization is now derived from its contract metadata (its
+  `access` rules + `instanceAccess` mode) via a shared mode-descriptor registry and
+  emitted into the OpenAPI spec - both structurally (`x-orpc-meta.authorization`)
+  and as a human `**Authorization.**` sentence folded into the operation
+  description. Previously the docs surfaced only a flat list of global rule ids, so
+  an integrator (an API-key/application principal that CAN hold team grants) never
+  saw the team-grant / per-object dimension, and endpoints gated purely in the
+  handler showed no restriction at all.
+
+  For authorization that no declarative mode can express and is therefore enforced
+  in the handler (a compound OR, a graded verdict, a DB-derived id set), a new
+  optional `accessNote` on the procedure metadata surfaces the real rule in the
+  docs as an explicitly handler-enforced addendum. The note is documentation, not a
+  guarantee: per `.claude/rules/rlac.md` the drift guard for such authz is
+  behavioral tests over an extracted pure decision function, and the note must
+  state exactly what those tests pin.
+
+  Every handler-enforced authorization endpoint now carries such a note so the docs
+  are complete: the team read/scoping and team-management endpoints
+  (`@checkstack/auth-common`), the health-check assignment/history reads
+  (`@checkstack/healthcheck-common`), the audience-graded incident/maintenance
+  reads (`@checkstack/incident-common`, `@checkstack/maintenance-common`), status
+  -page publish's bound-resource check (`@checkstack/status-page-common`), the
+  stream `setSystemLinks` readable-additions check
+  (`@checkstack/{metricstream,tracestream,logstream}-common`), and the automation
+  `runAs` escalation guard (`@checkstack/automation-common`). These are
+  metadata-only additions - no runtime behavior changed. The notes describe the
+  rule for API-doc readers only; the drift guard is behavioral tests over the
+  check's decision function (per `.claude/rules/rlac.md`), so the notes name no
+  internal test files.
+
+  The API docs viewer (`@checkstack/api-docs-frontend`) now renders each
+  operation's description as Markdown, so the `**Authorization.**` block (and any
+  inline `code`) formats correctly instead of showing raw markdown.
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/signal-common@0.3.2
+  - @checkstack/template-engine@0.4.13
+
 ## 0.10.2
 
 ### Patch Changes
diff --git a/core/automation-common/package.json b/core/automation-common/package.json
index 74981e801..6fd8e7b8d 100644
--- a/core/automation-common/package.json
+++ b/core/automation-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/automation-common",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/automation-frontend/CHANGELOG.md b/core/automation-frontend/CHANGELOG.md
index 6fd2503ce..a14140659 100644
--- a/core/automation-frontend/CHANGELOG.md
+++ b/core/automation-frontend/CHANGELOG.md
@@ -1,5 +1,66 @@
 # @checkstack/automation-frontend
 
+## 0.13.0
+
+### Minor Changes
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+  - @checkstack/auth-frontend@0.16.0
+  - @checkstack/common@0.24.0
+  - @checkstack/auth-common@0.17.0
+  - @checkstack/automation-common@0.10.3
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/gitops-frontend@0.8.0
+  - @checkstack/script-packages-frontend@0.5.0
+  - @checkstack/secrets-frontend@0.4.0
+  - @checkstack/ai-common@0.6.8
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/integration-common@0.9.11
+  - @checkstack/template-engine@0.4.13
+  - @checkstack/signal-frontend@0.3.8
+
 ## 0.12.8
 
 ### Patch Changes
diff --git a/core/automation-frontend/package.json b/core/automation-frontend/package.json
index 4dd838fa4..ac2be8662 100644
--- a/core/automation-frontend/package.json
+++ b/core/automation-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/automation-frontend",
-  "version": "0.12.8",
+  "version": "0.13.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/backend-api/CHANGELOG.md b/core/backend-api/CHANGELOG.md
index 2a75e6224..6ff5707f4 100644
--- a/core/backend-api/CHANGELOG.md
+++ b/core/backend-api/CHANGELOG.md
@@ -1,5 +1,43 @@
 # @checkstack/backend-api
 
+## 0.35.0
+
+### Minor Changes
+
+- 1deaac5: Add the `objectRef` instanceAccess mode and move the relation-write authz onto it
+
+  The relation-tuple writes (`writeRelation` / `removeRelation` / `setObjectPublic`)
+  administer team access on ANY resource type, so their authorization could not be
+  expressed by the existing `instanceAccess` modes (which all assume a fixed
+  resource type) and was enforced by hand in the auth handlers with `access: []` -
+  leaving the contract unable to declare the rule and the API docs showing no
+  restriction.
+
+  A new `objectRef` mode reads the object's TYPE and id from the request body
+  (`typeParam` / `idParam`) and authorizes via the same engine native scoping uses:
+  the endpoint's own access rule (`auth.teams.manage`) is the global admin
+  OR-override, otherwise the caller must be able to manage the referenced object
+  (its own `<type>.manage` rule on a non-private object, or a team editor/owner
+  grant on it). `autoAuthMiddleware` enforces it, the boot validator recognises it
+  (input paths cross-checked), and the auth handlers drop their hand-rolled checks.
+  Behaviour is unchanged; the authorization is now contract-declared and enforced
+  by the middleware rather than the handler.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/cache-api@0.3.21
+  - @checkstack/queue-api@0.4.1
+  - @checkstack/signal-common@0.3.2
+  - @checkstack/template-engine@0.4.13
+
 ## 0.34.1
 
 ### Patch Changes
diff --git a/core/backend-api/package.json b/core/backend-api/package.json
index 83f415c1c..bdd64b799 100644
--- a/core/backend-api/package.json
+++ b/core/backend-api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/backend-api",
-  "version": "0.34.1",
+  "version": "0.35.0",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "./src/index.ts",
diff --git a/core/backend/CHANGELOG.md b/core/backend/CHANGELOG.md
index 6b71821ad..3f1ecf862 100644
--- a/core/backend/CHANGELOG.md
+++ b/core/backend/CHANGELOG.md
@@ -1,5 +1,104 @@
 # @checkstack/backend
 
+## 0.26.0
+
+### Minor Changes
+
+- 88f4333: Show the platform release version on the About page
+
+  The About page showed only `@checkstack/backend`'s package version, which cannot
+  be matched to a GitHub release, a Docker tag or a changelog entry - those all
+  carry `@checkstack/release`'s version, which advances on every release while the
+  core package's does not.
+
+  Both are now shown, explicitly labelled, with the release version leading and
+  linked to its GitHub tag.
+
+  The release version is baked in at version time by a new
+  `generate:release-version` script (checked in CI, mirroring the docs index)
+  rather than read at runtime: `@checkstack/release` is private and therefore
+  absent from `node_modules` in an npm install, so a relative-path read would work
+  in the monorepo and Docker image and silently fail everywhere else.
+
+### Patch Changes
+
+- 1deaac5: Make endpoint authorization self-documenting in the generated API docs
+
+  Every procedure's authorization is now derived from its contract metadata (its
+  `access` rules + `instanceAccess` mode) via a shared mode-descriptor registry and
+  emitted into the OpenAPI spec - both structurally (`x-orpc-meta.authorization`)
+  and as a human `**Authorization.**` sentence folded into the operation
+  description. Previously the docs surfaced only a flat list of global rule ids, so
+  an integrator (an API-key/application principal that CAN hold team grants) never
+  saw the team-grant / per-object dimension, and endpoints gated purely in the
+  handler showed no restriction at all.
+
+  For authorization that no declarative mode can express and is therefore enforced
+  in the handler (a compound OR, a graded verdict, a DB-derived id set), a new
+  optional `accessNote` on the procedure metadata surfaces the real rule in the
+  docs as an explicitly handler-enforced addendum. The note is documentation, not a
+  guarantee: per `.claude/rules/rlac.md` the drift guard for such authz is
+  behavioral tests over an extracted pure decision function, and the note must
+  state exactly what those tests pin.
+
+  Every handler-enforced authorization endpoint now carries such a note so the docs
+  are complete: the team read/scoping and team-management endpoints
+  (`@checkstack/auth-common`), the health-check assignment/history reads
+  (`@checkstack/healthcheck-common`), the audience-graded incident/maintenance
+  reads (`@checkstack/incident-common`, `@checkstack/maintenance-common`), status
+  -page publish's bound-resource check (`@checkstack/status-page-common`), the
+  stream `setSystemLinks` readable-additions check
+  (`@checkstack/{metricstream,tracestream,logstream}-common`), and the automation
+  `runAs` escalation guard (`@checkstack/automation-common`). These are
+  metadata-only additions - no runtime behavior changed. The notes describe the
+  rule for API-doc readers only; the drift guard is behavioral tests over the
+  check's decision function (per `.claude/rules/rlac.md`), so the notes name no
+  internal test files.
+
+  The API docs viewer (`@checkstack/api-docs-frontend`) now renders each
+  operation's description as Markdown, so the `**Authorization.**` block (and any
+  inline `code`) formats correctly instead of showing raw markdown.
+
+- bd60aff: Security: auto-remediated fixable vulnerabilities flagged by the daily scan.
+
+  - `tar` 7.5.20 → 7.5.21 (GHSA-r292-9mhp-454m)
+  - `brace-expansion` 5.0.7 → 5.0.8 (CVE-2026-14257)
+
+- 1deaac5: Add the `objectRef` instanceAccess mode and move the relation-write authz onto it
+
+  The relation-tuple writes (`writeRelation` / `removeRelation` / `setObjectPublic`)
+  administer team access on ANY resource type, so their authorization could not be
+  expressed by the existing `instanceAccess` modes (which all assume a fixed
+  resource type) and was enforced by hand in the auth handlers with `access: []` -
+  leaving the contract unable to declare the rule and the API docs showing no
+  restriction.
+
+  A new `objectRef` mode reads the object's TYPE and id from the request body
+  (`typeParam` / `idParam`) and authorizes via the same engine native scoping uses:
+  the endpoint's own access rule (`auth.teams.manage`) is the global admin
+  OR-override, otherwise the caller must be able to manage the referenced object
+  (its own `<type>.manage` rule on a non-private object, or a team editor/owner
+  grant on it). `autoAuthMiddleware` enforces it, the boot validator recognises it
+  (input paths cross-checked), and the auth handlers drop their hand-rolled checks.
+  Behaviour is unchanged; the authorization is now contract-declared and enforced
+  by the middleware rather than the handler.
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/auth-common@0.17.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/api-docs-common@0.1.29
+  - @checkstack/cache-api@0.3.21
+  - @checkstack/pluginmanager-common@0.2.18
+  - @checkstack/queue-api@0.4.1
+  - @checkstack/signal-backend@0.3.28
+  - @checkstack/signal-common@0.3.2
+
 ## 0.25.7
 
 ### Patch Changes
diff --git a/core/backend/package.json b/core/backend/package.json
index 061a8d0b8..e6d1f470f 100644
--- a/core/backend/package.json
+++ b/core/backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/backend",
-  "version": "0.25.7",
+  "version": "0.26.0",
   "license": "Elastic-2.0",
   "checkstack": {
     "type": "backend"
diff --git a/core/backend/src/generated/release-version.ts b/core/backend/src/generated/release-version.ts
index 09a233f60..2b4284ead 100644
--- a/core/backend/src/generated/release-version.ts
+++ b/core/backend/src/generated/release-version.ts
@@ -9,4 +9,4 @@
 // This is NOT the same as `@checkstack/backend`'s own package version, which
 // only moves when that package changes. The About page shows both.
 
-export const RELEASE_VERSION = "0.136.0";
+export const RELEASE_VERSION = "0.137.0";
diff --git a/core/cache-api/CHANGELOG.md b/core/cache-api/CHANGELOG.md
index c3eb8bcc3..0fc42b1c6 100644
--- a/core/cache-api/CHANGELOG.md
+++ b/core/cache-api/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @checkstack/cache-api
 
+## 0.3.21
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+
 ## 0.3.20
 
 ### Patch Changes
diff --git a/core/cache-api/package.json b/core/cache-api/package.json
index f7e67ba37..ec145f03d 100644
--- a/core/cache-api/package.json
+++ b/core/cache-api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/cache-api",
-  "version": "0.3.20",
+  "version": "0.3.21",
   "license": "Elastic-2.0",
   "checkstack": {
     "type": "tooling"
diff --git a/core/cache-backend/CHANGELOG.md b/core/cache-backend/CHANGELOG.md
index 7cb28e8c0..07d75278e 100644
--- a/core/cache-backend/CHANGELOG.md
+++ b/core/cache-backend/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @checkstack/cache-backend
 
+## 0.4.28
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/cache-api@0.3.21
+  - @checkstack/cache-common@0.5.13
+
 ## 0.4.27
 
 ### Patch Changes
diff --git a/core/cache-backend/package.json b/core/cache-backend/package.json
index 24c381fee..671863c57 100644
--- a/core/cache-backend/package.json
+++ b/core/cache-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/cache-backend",
-  "version": "0.4.27",
+  "version": "0.4.28",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/cache-common/CHANGELOG.md b/core/cache-common/CHANGELOG.md
index 42c521b1c..3f601d460 100644
--- a/core/cache-common/CHANGELOG.md
+++ b/core/cache-common/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @checkstack/cache-common
 
+## 0.5.13
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+
 ## 0.5.12
 
 ### Patch Changes
diff --git a/core/cache-common/package.json b/core/cache-common/package.json
index 7dfefd441..610a14d22 100644
--- a/core/cache-common/package.json
+++ b/core/cache-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/cache-common",
-  "version": "0.5.12",
+  "version": "0.5.13",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/cache-frontend/CHANGELOG.md b/core/cache-frontend/CHANGELOG.md
index 79b4fe71e..a643a8648 100644
--- a/core/cache-frontend/CHANGELOG.md
+++ b/core/cache-frontend/CHANGELOG.md
@@ -1,5 +1,27 @@
 # @checkstack/cache-frontend
 
+## 0.6.10
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/cache-common@0.5.13
+  - @checkstack/infrastructure-common@0.3.24
+
 ## 0.6.9
 
 ### Patch Changes
diff --git a/core/cache-frontend/package.json b/core/cache-frontend/package.json
index 99ff9d47f..d0322e569 100644
--- a/core/cache-frontend/package.json
+++ b/core/cache-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/cache-frontend",
-  "version": "0.6.9",
+  "version": "0.6.10",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/cache-utils/CHANGELOG.md b/core/cache-utils/CHANGELOG.md
index 510f83f7b..926c72a94 100644
--- a/core/cache-utils/CHANGELOG.md
+++ b/core/cache-utils/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @checkstack/cache-utils
 
+## 0.3.2
+
+### Patch Changes
+
+- @checkstack/cache-api@0.3.21
+
 ## 0.3.1
 
 ### Patch Changes
diff --git a/core/cache-utils/package.json b/core/cache-utils/package.json
index 4fe5bcd48..be68c57c7 100644
--- a/core/cache-utils/package.json
+++ b/core/cache-utils/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/cache-utils",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "license": "Elastic-2.0",
   "checkstack": {
     "type": "tooling"
diff --git a/core/catalog-backend/CHANGELOG.md b/core/catalog-backend/CHANGELOG.md
index a7c849915..8c9b59f4e 100644
--- a/core/catalog-backend/CHANGELOG.md
+++ b/core/catalog-backend/CHANGELOG.md
@@ -1,5 +1,33 @@
 # @checkstack/catalog-backend
 
+## 1.10.2
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+  - @checkstack/common@0.24.0
+  - @checkstack/auth-common@0.17.0
+  - @checkstack/command-backend@0.3.0
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/ai-backend@0.11.5
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/auth-backend@0.14.0
+  - @checkstack/automation-backend@0.11.9
+  - @checkstack/ai-common@0.6.8
+  - @checkstack/cache-api@0.3.21
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/gitops-backend@0.5.28
+  - @checkstack/gitops-common@0.7.5
+  - @checkstack/signal-common@0.3.2
+  - @checkstack/cache-utils@0.3.2
+
 ## 1.10.1
 
 ### Patch Changes
diff --git a/core/catalog-backend/package.json b/core/catalog-backend/package.json
index f4136f039..0d7562918 100644
--- a/core/catalog-backend/package.json
+++ b/core/catalog-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/catalog-backend",
-  "version": "1.10.1",
+  "version": "1.10.2",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/catalog-common/CHANGELOG.md b/core/catalog-common/CHANGELOG.md
index 436d1e5d3..f43bab06d 100644
--- a/core/catalog-common/CHANGELOG.md
+++ b/core/catalog-common/CHANGELOG.md
@@ -1,5 +1,21 @@
 # @checkstack/catalog-common
 
+## 2.8.2
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/auth-common@0.17.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/signal-common@0.3.2
+
 ## 2.8.1
 
 ### Patch Changes
diff --git a/core/catalog-common/package.json b/core/catalog-common/package.json
index f73f1f0b1..a990601ca 100644
--- a/core/catalog-common/package.json
+++ b/core/catalog-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/catalog-common",
-  "version": "2.8.1",
+  "version": "2.8.2",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/catalog-frontend/CHANGELOG.md b/core/catalog-frontend/CHANGELOG.md
index 877fd294a..2e78dd2b7 100644
--- a/core/catalog-frontend/CHANGELOG.md
+++ b/core/catalog-frontend/CHANGELOG.md
@@ -1,5 +1,120 @@
 # @checkstack/catalog-frontend
 
+## 0.22.0
+
+### Minor Changes
+
+- 88f4333: Clone systems and environments
+
+  Systems and environments gained a **Clone** row action, which opens the editor
+  pre-seeded from the source record and saves as a create.
+
+  The clone is deliberately SHALLOW: name (suffixed), description and custom
+  fields only. Group and environment memberships, tags, contacts, links, team
+  grants and health-check assignments are NOT copied, and the dialog says so.
+  Duplicating health-check assignments in particular would silently multiply probe
+  volume and notification noise with every clone.
+
+  Cloning is gated on CREATE, not on manage of the source, and a GitOps lock on
+  the source does not block it - the copy is a new, unmanaged record.
+
+- 88f4333: Preview system custom fields in the health-check editor
+
+  The editor gained a **System** picker beside the existing "Preview as"
+  environment picker, so `{{ system.metadata.<key> }}` resolves in the preview line
+  and offers `{{ }}` autocomplete.
+
+  Previously system templating could only be previewed when the editor happened to
+  be opened FROM a system: a shared-config authoring flow and every edit-mode
+  session got no preview and no completions at all, because the systems list was
+  not even fetched in edit mode.
+
+  Selecting only a system is now enough to preview - an environment is no longer
+  required, since `system.metadata.*` is fully resolvable without one. Both pickers
+  only offer resources the caller may read.
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- 88f4333: Cover the features that shipped on logic-only tests
+
+  Inline mentions shipped completely inert while ~90 unit tests passed, because
+  those tests proved the pure functions and nothing proved the render path. Four
+  features carried exactly the same shape of coverage. Each now has a guard that
+  was VERIFIED to fail when the thing it guards is broken.
+
+  - **HTTP proxy.** `fetch({ proxy })` had never run: every test covered the URL
+    we build, the SSRF host we guard and the field contracts, but no test routed a
+    request through an actual proxy. A real proxy server now proves the request
+    arrives there, that credentials are sent, that a 407 is a COMPLETED request
+    (not a transport failure), that an unreachable proxy IS a transport failure,
+    and that an empty templated proxy falls back to a direct connection.
+  - **Status-coloured timeline dots.** The feature was `StatusUpdateTimeline`
+    forwarding a caller's `renderDot`; the colour helpers were tested but the
+    one-line forward was not. Now pinned, including per-item independence and the
+    newest-first ordering a dot renderer must not assume away.
+  - **System custom-field preview.** `SystemPreviewPicker` had no render coverage
+    at all. Now covers the empty case, that the SELECTION is displayed, and that
+    "No system" reports `null` rather than leaking the internal sentinel.
+  - **Per-satellite offline threshold.** `computeStatus` is called from five
+    places and a site that forgets the per-satellite value silently falls back to
+    the global default, so the admin list, the entity read and the monitor
+    disagree about the same satellite. A behavioural drift guard now drives the
+    real reads with a heartbeat stale by the global default but fresh by the
+    satellite's own threshold - and the shorter-threshold direction too.
+
+  Tests only; no runtime behaviour changes.
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+  - @checkstack/auth-frontend@0.16.0
+  - @checkstack/common@0.24.0
+  - @checkstack/auth-common@0.17.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/gitops-frontend@0.8.0
+  - @checkstack/notification-frontend@0.10.0
+  - @checkstack/tips-frontend@0.5.6
+  - @checkstack/catalog-common@2.8.2
+
 ## 0.21.2
 
 ### Patch Changes
diff --git a/core/catalog-frontend/package.json b/core/catalog-frontend/package.json
index 85bf02ced..9f9e7026d 100644
--- a/core/catalog-frontend/package.json
+++ b/core/catalog-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/catalog-frontend",
-  "version": "0.21.2",
+  "version": "0.22.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/command-backend/CHANGELOG.md b/core/command-backend/CHANGELOG.md
index 0a67b1808..d4569b1a4 100644
--- a/core/command-backend/CHANGELOG.md
+++ b/core/command-backend/CHANGELOG.md
@@ -1,5 +1,43 @@
 # @checkstack/command-backend
 
+## 0.3.0
+
+### Minor Changes
+
+- 88f4333: Show command-palette actions to team-scoped users
+
+  The palette filtered commands against the caller's GLOBAL access rules only, so a
+  user whose team holds a create-capability grant - but who holds no global
+  `incident.incident.manage` / `maintenance.maintenance.manage` rule - never saw
+  "Create Incident" or "Create Maintenance", nor their keyboard shortcuts. The
+  palette hid the actions from exactly the people authorized to run them.
+
+  Commands can now declare a `manageCapability` (mirroring the gate routes and nav
+  already use). `filterByAccessRules` shows an item when the caller holds the
+  global rules OR can create/manage the declared type through a team grant, and the
+  command backend resolves that per request via `hasAnyTypeGrant` (with
+  `includeCreator`, so a team member who may CREATE the type qualifies before
+  owning an instance). It fails closed: an auth error leaves pure global gating.
+  The incident and maintenance commands declare their types.
+
+  `useGlobalShortcuts` no longer takes `userAccessRules` and no longer re-checks
+  access: the server-filtered list is authoritative. That re-check tested the
+  global rules only and would have dropped team-scoped users' shortcuts - both call
+  sites already defeated it by passing `["*"]`.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/command-common@0.4.0
+  - @checkstack/backend-api@0.35.0
+
 ## 0.2.27
 
 ### Patch Changes
diff --git a/core/command-backend/package.json b/core/command-backend/package.json
index f8855c502..c9b6ce40a 100644
--- a/core/command-backend/package.json
+++ b/core/command-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/command-backend",
-  "version": "0.2.27",
+  "version": "0.3.0",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/command-common/CHANGELOG.md b/core/command-common/CHANGELOG.md
index 18cf77c8a..8e3690b2c 100644
--- a/core/command-common/CHANGELOG.md
+++ b/core/command-common/CHANGELOG.md
@@ -1,5 +1,40 @@
 # @checkstack/command-common
 
+## 0.4.0
+
+### Minor Changes
+
+- 88f4333: Show command-palette actions to team-scoped users
+
+  The palette filtered commands against the caller's GLOBAL access rules only, so a
+  user whose team holds a create-capability grant - but who holds no global
+  `incident.incident.manage` / `maintenance.maintenance.manage` rule - never saw
+  "Create Incident" or "Create Maintenance", nor their keyboard shortcuts. The
+  palette hid the actions from exactly the people authorized to run them.
+
+  Commands can now declare a `manageCapability` (mirroring the gate routes and nav
+  already use). `filterByAccessRules` shows an item when the caller holds the
+  global rules OR can create/manage the declared type through a team grant, and the
+  command backend resolves that per request via `hasAnyTypeGrant` (with
+  `includeCreator`, so a team member who may CREATE the type qualifies before
+  owning an instance). It fails closed: an auth error leaves pure global gating.
+  The incident and maintenance commands declare their types.
+
+  `useGlobalShortcuts` no longer takes `userAccessRules` and no longer re-checks
+  access: the server-filtered list is authoritative. That re-check tested the
+  global rules only and would have dropped team-scoped users' shortcuts - both call
+  sites already defeated it by passing `["*"]`.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+
 ## 0.3.12
 
 ### Patch Changes
diff --git a/core/command-common/package.json b/core/command-common/package.json
index 39eb88f7a..1522edf7b 100644
--- a/core/command-common/package.json
+++ b/core/command-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/command-common",
-  "version": "0.3.12",
+  "version": "0.4.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/command-frontend/CHANGELOG.md b/core/command-frontend/CHANGELOG.md
index 753965950..4e557e5b5 100644
--- a/core/command-frontend/CHANGELOG.md
+++ b/core/command-frontend/CHANGELOG.md
@@ -1,5 +1,77 @@
 # @checkstack/command-frontend
 
+## 0.6.0
+
+### Minor Changes
+
+- 88f4333: Show command-palette actions to team-scoped users
+
+  The palette filtered commands against the caller's GLOBAL access rules only, so a
+  user whose team holds a create-capability grant - but who holds no global
+  `incident.incident.manage` / `maintenance.maintenance.manage` rule - never saw
+  "Create Incident" or "Create Maintenance", nor their keyboard shortcuts. The
+  palette hid the actions from exactly the people authorized to run them.
+
+  Commands can now declare a `manageCapability` (mirroring the gate routes and nav
+  already use). `filterByAccessRules` shows an item when the caller holds the
+  global rules OR can create/manage the declared type through a team grant, and the
+  command backend resolves that per request via `hasAnyTypeGrant` (with
+  `includeCreator`, so a team member who may CREATE the type qualifies before
+  owning an instance). It fails closed: an auth error leaves pure global gating.
+  The incident and maintenance commands declare their types.
+
+  `useGlobalShortcuts` no longer takes `userAccessRules` and no longer re-checks
+  access: the server-filtered list is authoritative. That re-check tested the
+  global rules only and would have dropped team-scoped users' shortcuts - both call
+  sites already defeated it by passing `["*"]`.
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/command-common@0.4.0
+  - @checkstack/frontend-api@0.18.0
+
 ## 0.5.15
 
 ### Patch Changes
diff --git a/core/command-frontend/package.json b/core/command-frontend/package.json
index b412ebf89..2d0c34de1 100644
--- a/core/command-frontend/package.json
+++ b/core/command-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/command-frontend",
-  "version": "0.5.15",
+  "version": "0.6.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/common/CHANGELOG.md b/core/common/CHANGELOG.md
index 117a7aa74..6f13c0016 100644
--- a/core/common/CHANGELOG.md
+++ b/core/common/CHANGELOG.md
@@ -1,5 +1,181 @@
 # @checkstack/common
 
+## 0.24.0
+
+### Minor Changes
+
+- 88f4333: Role editor: alphabetised categories, bulk select, and role cloning
+
+  Access-rule categories in the role dialog are now sorted alphabetically (by their
+  rendered label, at both the category and the rule level) instead of following
+  plugin registration order, so a category can be found by scanning rather than by
+  reading the whole list.
+
+  Each category gained **Select all** / **Clear** actions. They respect the same
+  guards the individual checkboxes do - the anonymous role still cannot be granted
+  rules no public endpoint uses, and a locked role stays read-only.
+
+  Roles can be **cloned**: a new role seeded from an existing one's access rules,
+  saved as a create. The dialog now takes an explicit `mode` rather than inferring
+  "editing" from the presence of a role, which is what made the third state
+  expressible at all.
+
+  Adds a shared `buildClonedName` helper to `@checkstack/common` so every clone
+  affordance in the product produces the same name shape.
+
+- 1deaac5: Make endpoint authorization self-documenting in the generated API docs
+
+  Every procedure's authorization is now derived from its contract metadata (its
+  `access` rules + `instanceAccess` mode) via a shared mode-descriptor registry and
+  emitted into the OpenAPI spec - both structurally (`x-orpc-meta.authorization`)
+  and as a human `**Authorization.**` sentence folded into the operation
+  description. Previously the docs surfaced only a flat list of global rule ids, so
+  an integrator (an API-key/application principal that CAN hold team grants) never
+  saw the team-grant / per-object dimension, and endpoints gated purely in the
+  handler showed no restriction at all.
+
+  For authorization that no declarative mode can express and is therefore enforced
+  in the handler (a compound OR, a graded verdict, a DB-derived id set), a new
+  optional `accessNote` on the procedure metadata surfaces the real rule in the
+  docs as an explicitly handler-enforced addendum. The note is documentation, not a
+  guarantee: per `.claude/rules/rlac.md` the drift guard for such authz is
+  behavioral tests over an extracted pure decision function, and the note must
+  state exactly what those tests pin.
+
+  Every handler-enforced authorization endpoint now carries such a note so the docs
+  are complete: the team read/scoping and team-management endpoints
+  (`@checkstack/auth-common`), the health-check assignment/history reads
+  (`@checkstack/healthcheck-common`), the audience-graded incident/maintenance
+  reads (`@checkstack/incident-common`, `@checkstack/maintenance-common`), status
+  -page publish's bound-resource check (`@checkstack/status-page-common`), the
+  stream `setSystemLinks` readable-additions check
+  (`@checkstack/{metricstream,tracestream,logstream}-common`), and the automation
+  `runAs` escalation guard (`@checkstack/automation-common`). These are
+  metadata-only additions - no runtime behavior changed. The notes describe the
+  rule for API-doc readers only; the drift guard is behavioral tests over the
+  check's decision function (per `.claude/rules/rlac.md`), so the notes name no
+  internal test files.
+
+  The API docs viewer (`@checkstack/api-docs-frontend`) now renders each
+  operation's description as Markdown, so the `**Authorization.**` block (and any
+  inline `code`) formats correctly instead of showing raw markdown.
+
+- 88f4333: Link incidents and maintenances with `#` mentions
+
+  Typing `#` in a markdown field now opens a picker over every mentionable record
+  and inserts a reference. Referencing another record previously meant pasting a
+  URL, which cannot be right everywhere: an admin URL is meaningless on a public
+  status page, a status-page URL is meaningless in the admin UI, and neither works
+  in an email.
+
+  A mention therefore stores WHAT it points at, never where:
+  `[Database upgrade](checkstack:maintenance/<id>)`. That is an ordinary markdown
+  link - readable in the raw source, parsed unchanged by existing tooling - and
+  only the href is resolved per render context.
+
+  Resolution may REFUSE: a resolver returning nothing renders the label as plain
+  text rather than a link. That is a confidentiality property, not a nicety - an
+  internal-only incident referenced from a public status update must not become a
+  link that confirms it exists. A renderer given no resolver links nothing.
+
+  Incident and maintenance detail pages gained a **Referenced items** section,
+  derived by scanning the authored markdown on each render. Nothing is stored
+  twice, so an edit that drops a reference drops it from the list too.
+
+  The platform owns the contract (`registerMentionRoutes` / `setMentionSearch` in
+  `@checkstack/frontend-api`); each owning plugin registers its own type, so no
+  plugin imports another. Search only ever offers records the caller may read.
+
+  Scope: resolution is wired for the admin UI. Public status pages and notification
+  bodies do not resolve mentions yet, so a mention renders there as plain text -
+  the safe default above, not a broken link.
+
+  Precisely: the admin resolver maps a well-formed reference to a route WITHOUT
+  checking that the target still exists or that this viewer may read it, so a
+  mention to a deleted or unreadable record links to a not-found or an access gate.
+  That is deliberate - gating on the provider's fetched list would silently
+  downgrade valid references to plain text (the incident search excludes resolved
+  incidents by default), and silently dropping a valid link is worse than one that
+  lands on a gate the backend already enforces. The confidentiality property is
+  carried by the public renderers, which resolve nothing.
+
+- 88f4333: Resolve `#` mentions on public status pages, and check viewability in the admin UI
+
+  Cross-entity mentions previously resolved only in the admin UI, and did so
+  without asking whether the reader could actually open the target. Public
+  surfaces resolved nothing at all. Three changes, one per delivery context.
+
+  **The admin UI now checks viewability.** `useMentionResolution({ documents })`
+  collects the references a page is about to render and asks each owning plugin -
+  in ONE batched request - which of them this viewer may read. A mention to a
+  deleted or unreadable record now renders as plain text instead of a link to a
+  not-found page or an access gate. Backed by new `resolveIncidentRefs` /
+  `resolveMaintenanceRefs` procedures, which return ids only (so an unreadable
+  record is indistinguishable from a deleted one) and carry the same `listKey`
+  read post-filter as their list procedures. They are deliberately not a filter
+  over the authoring search list, which hides resolved incidents and would
+  silently downgrade valid references.
+
+  **Public status pages now resolve mentions.** A reference becomes a link to the
+  target's public detail page when - and only when - the same page publishes that
+  target, which is exactly the anti-enumeration gate the detail pages already
+  apply. So an operator writing "caused by #Database upgrade" in a public update
+  gets a working link, while a mention of an internal-only incident stays plain
+  text rather than becoming a link that confirms it exists. Widgets opt in by
+  declaring a `mentionType`, so the status-page packages take no dependency on any
+  domain plugin.
+
+  **BREAKING CHANGE (behavioural, no API change):** the in-app public status page
+  at `/statuspage/view/<slug>` now builds detail-page hrefs. Previously it passed
+  none, so incident and maintenance titles rendered as plain text there while the
+  same page on a custom domain linked them. Both now behave identically.
+
+  **Notification bodies no longer leak the internal scheme.** `checkstack:` is
+  meaningless outside a Checkstack renderer, and channels leaked it differently:
+  the email sanitiser stripped the href and left a dead anchor, while Slack's
+  mrkdwn emitted `<checkstack:maintenance/9f1c-abc|Database upgrade>` straight to
+  the recipient (Discord, Telegram and Teams render markdown natively and would
+  have passed it through too). `sanitizeUpdateMessage` now flattens every mention
+  to its label before the body reaches any channel, so no channel has to know the
+  scheme exists. Flattening also happens before the length bound, so the excerpt
+  budget is spent on visible text rather than on an internal URI.
+
+- 1deaac5: Add the `objectRef` instanceAccess mode and move the relation-write authz onto it
+
+  The relation-tuple writes (`writeRelation` / `removeRelation` / `setObjectPublic`)
+  administer team access on ANY resource type, so their authorization could not be
+  expressed by the existing `instanceAccess` modes (which all assume a fixed
+  resource type) and was enforced by hand in the auth handlers with `access: []` -
+  leaving the contract unable to declare the rule and the API docs showing no
+  restriction.
+
+  A new `objectRef` mode reads the object's TYPE and id from the request body
+  (`typeParam` / `idParam`) and authorizes via the same engine native scoping uses:
+  the endpoint's own access rule (`auth.teams.manage`) is the global admin
+  OR-override, otherwise the caller must be able to manage the referenced object
+  (its own `<type>.manage` rule on a non-private object, or a team editor/owner
+  grant on it). `autoAuthMiddleware` enforces it, the boot validator recognises it
+  (input paths cross-checked), and the auth handlers drop their hand-rolled checks.
+  Behaviour is unchanged; the authorization is now contract-declared and enforced
+  by the middleware rather than the handler.
+
+### Patch Changes
+
+- 88f4333: Fix polynomial ReDoS in mention scanning
+
+  The mention link pattern allowed a raw `[` inside the label, so a run of `[[[[`
+  started a label scan at every bracket that could only fail at the closing `](` -
+  quadratic in the input length (CodeQL `js/polynomial-redos`, HIGH). The
+  documents scanned are operator-authored incident and maintenance update text, so
+  the input is genuinely uncontrolled.
+
+  Excluding a raw `[` costs nothing: `buildMentionMarkdown` escapes brackets, so a
+  legitimate mention never contains one - a bracketed title arrives as `\[`, which
+  the escape branch already matches.
+
+  Guarded by a timing regression test. A quadratic pattern still returns the right
+  answer, just far too slowly, so no correctness test could have caught this.
+
 ## 0.23.0
 
 ### Minor Changes
diff --git a/core/common/package.json b/core/common/package.json
index 6d2cc6edb..046910ebc 100644
--- a/core/common/package.json
+++ b/core/common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/common",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "./src/index.ts",
diff --git a/core/create-checkstack-plugin/CHANGELOG.md b/core/create-checkstack-plugin/CHANGELOG.md
index 83337c7c2..175daf058 100644
--- a/core/create-checkstack-plugin/CHANGELOG.md
+++ b/core/create-checkstack-plugin/CHANGELOG.md
@@ -1,5 +1,12 @@
 # create-checkstack-plugin
 
+## 0.1.18
+
+### Patch Changes
+
+- Updated dependencies [bd60aff]
+  - @checkstack/scripts@0.7.7
+
 ## 0.1.17
 
 ### Patch Changes
diff --git a/core/create-checkstack-plugin/package.json b/core/create-checkstack-plugin/package.json
index 258ce118e..07c9c4278 100644
--- a/core/create-checkstack-plugin/package.json
+++ b/core/create-checkstack-plugin/package.json
@@ -1,6 +1,6 @@
 {
   "name": "create-checkstack-plugin",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "description": "Scaffold a standalone Checkstack plugin workspace (common + backend + frontend) with concrete published versions, ready to `bun install && bun run dev`.",
   "license": "Elastic-2.0",
   "type": "module",
diff --git a/core/dashboard-frontend/CHANGELOG.md b/core/dashboard-frontend/CHANGELOG.md
index 6936a70b3..4ded119dc 100644
--- a/core/dashboard-frontend/CHANGELOG.md
+++ b/core/dashboard-frontend/CHANGELOG.md
@@ -1,5 +1,68 @@
 # @checkstack/dashboard-frontend
 
+## 0.12.0
+
+### Minor Changes
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/incident-common@1.11.0
+  - @checkstack/maintenance-common@1.11.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/catalog-frontend@0.22.0
+  - @checkstack/command-common@0.4.0
+  - @checkstack/command-frontend@0.6.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/queue-frontend@0.8.0
+  - @checkstack/tips-frontend@0.5.6
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/signal-frontend@0.3.8
+
 ## 0.11.2
 
 ### Patch Changes
diff --git a/core/dashboard-frontend/package.json b/core/dashboard-frontend/package.json
index e5ea0782e..8f7e576cf 100644
--- a/core/dashboard-frontend/package.json
+++ b/core/dashboard-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/dashboard-frontend",
-  "version": "0.11.2",
+  "version": "0.12.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/dependency-backend/CHANGELOG.md b/core/dependency-backend/CHANGELOG.md
index d43ea720b..e1e331fbd 100644
--- a/core/dependency-backend/CHANGELOG.md
+++ b/core/dependency-backend/CHANGELOG.md
@@ -1,5 +1,35 @@
 # @checkstack/dependency-backend
 
+## 1.7.7
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/incident-common@1.11.0
+  - @checkstack/maintenance-common@1.11.0
+  - @checkstack/command-backend@0.3.0
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/ai-backend@0.11.5
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/healthcheck-backend@1.23.0
+  - @checkstack/automation-backend@0.11.9
+  - @checkstack/catalog-backend@1.10.2
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/dependency-common@1.7.8
+  - @checkstack/gitops-backend@0.5.28
+  - @checkstack/gitops-common@0.7.5
+  - @checkstack/signal-common@0.3.2
+
 ## 1.7.6
 
 ### Patch Changes
diff --git a/core/dependency-backend/package.json b/core/dependency-backend/package.json
index 57666b550..6814157f8 100644
--- a/core/dependency-backend/package.json
+++ b/core/dependency-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/dependency-backend",
-  "version": "1.7.6",
+  "version": "1.7.7",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/dependency-common/CHANGELOG.md b/core/dependency-common/CHANGELOG.md
index efc0b9b47..e7d960b0f 100644
--- a/core/dependency-common/CHANGELOG.md
+++ b/core/dependency-common/CHANGELOG.md
@@ -1,5 +1,21 @@
 # @checkstack/dependency-common
 
+## 1.7.8
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/signal-common@0.3.2
+
 ## 1.7.7
 
 ### Patch Changes
diff --git a/core/dependency-common/package.json b/core/dependency-common/package.json
index d0441ac74..05081ed5e 100644
--- a/core/dependency-common/package.json
+++ b/core/dependency-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/dependency-common",
-  "version": "1.7.7",
+  "version": "1.7.8",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/dependency-frontend/CHANGELOG.md b/core/dependency-frontend/CHANGELOG.md
index 2d837c232..2bbff29c3 100644
--- a/core/dependency-frontend/CHANGELOG.md
+++ b/core/dependency-frontend/CHANGELOG.md
@@ -1,5 +1,61 @@
 # @checkstack/dependency-frontend
 
+## 0.9.0
+
+### Minor Changes
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/dashboard-frontend@0.12.0
+  - @checkstack/gitops-frontend@0.8.0
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/dependency-common@1.7.8
+  - @checkstack/gitops-common@0.7.5
+  - @checkstack/signal-frontend@0.3.8
+
 ## 0.8.10
 
 ### Patch Changes
diff --git a/core/dependency-frontend/package.json b/core/dependency-frontend/package.json
index 2054e99be..a8d41d9dc 100644
--- a/core/dependency-frontend/package.json
+++ b/core/dependency-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/dependency-frontend",
-  "version": "0.8.10",
+  "version": "0.9.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/dev-server/CHANGELOG.md b/core/dev-server/CHANGELOG.md
index 075306e0e..9fb2c3aaf 100644
--- a/core/dev-server/CHANGELOG.md
+++ b/core/dev-server/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @checkstack/dev-server
 
+## 2.2.11
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+
 ## 2.2.10
 
 ### Patch Changes
diff --git a/core/dev-server/package.json b/core/dev-server/package.json
index 6fe052513..f25ee81a5 100644
--- a/core/dev-server/package.json
+++ b/core/dev-server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/dev-server",
-  "version": "2.2.10",
+  "version": "2.2.11",
   "description": "Local Checkstack dev server for plugin authors. Spawns the platform backend with the cwd plugin loaded, runs Vite for the frontend, and reloads on save. Used as a devDependency in plugin repos (run via `bun run dev` → `checkstack-dev`).",
   "license": "Elastic-2.0",
   "type": "module",
diff --git a/core/frontend-api/CHANGELOG.md b/core/frontend-api/CHANGELOG.md
index 233635ced..12d9b9a69 100644
--- a/core/frontend-api/CHANGELOG.md
+++ b/core/frontend-api/CHANGELOG.md
@@ -1,5 +1,100 @@
 # @checkstack/frontend-api
 
+## 0.18.0
+
+### Minor Changes
+
+- 88f4333: Link incidents and maintenances with `#` mentions
+
+  Typing `#` in a markdown field now opens a picker over every mentionable record
+  and inserts a reference. Referencing another record previously meant pasting a
+  URL, which cannot be right everywhere: an admin URL is meaningless on a public
+  status page, a status-page URL is meaningless in the admin UI, and neither works
+  in an email.
+
+  A mention therefore stores WHAT it points at, never where:
+  `[Database upgrade](checkstack:maintenance/<id>)`. That is an ordinary markdown
+  link - readable in the raw source, parsed unchanged by existing tooling - and
+  only the href is resolved per render context.
+
+  Resolution may REFUSE: a resolver returning nothing renders the label as plain
+  text rather than a link. That is a confidentiality property, not a nicety - an
+  internal-only incident referenced from a public status update must not become a
+  link that confirms it exists. A renderer given no resolver links nothing.
+
+  Incident and maintenance detail pages gained a **Referenced items** section,
+  derived by scanning the authored markdown on each render. Nothing is stored
+  twice, so an edit that drops a reference drops it from the list too.
+
+  The platform owns the contract (`registerMentionRoutes` / `setMentionSearch` in
+  `@checkstack/frontend-api`); each owning plugin registers its own type, so no
+  plugin imports another. Search only ever offers records the caller may read.
+
+  Scope: resolution is wired for the admin UI. Public status pages and notification
+  bodies do not resolve mentions yet, so a mention renders there as plain text -
+  the safe default above, not a broken link.
+
+  Precisely: the admin resolver maps a well-formed reference to a route WITHOUT
+  checking that the target still exists or that this viewer may read it, so a
+  mention to a deleted or unreadable record links to a not-found or an access gate.
+  That is deliberate - gating on the provider's fetched list would silently
+  downgrade valid references to plain text (the incident search excludes resolved
+  incidents by default), and silently dropping a valid link is worse than one that
+  lands on a gate the backend already enforces. The confidentiality property is
+  carried by the public renderers, which resolve nothing.
+
+- 88f4333: Resolve `#` mentions on public status pages, and check viewability in the admin UI
+
+  Cross-entity mentions previously resolved only in the admin UI, and did so
+  without asking whether the reader could actually open the target. Public
+  surfaces resolved nothing at all. Three changes, one per delivery context.
+
+  **The admin UI now checks viewability.** `useMentionResolution({ documents })`
+  collects the references a page is about to render and asks each owning plugin -
+  in ONE batched request - which of them this viewer may read. A mention to a
+  deleted or unreadable record now renders as plain text instead of a link to a
+  not-found page or an access gate. Backed by new `resolveIncidentRefs` /
+  `resolveMaintenanceRefs` procedures, which return ids only (so an unreadable
+  record is indistinguishable from a deleted one) and carry the same `listKey`
+  read post-filter as their list procedures. They are deliberately not a filter
+  over the authoring search list, which hides resolved incidents and would
+  silently downgrade valid references.
+
+  **Public status pages now resolve mentions.** A reference becomes a link to the
+  target's public detail page when - and only when - the same page publishes that
+  target, which is exactly the anti-enumeration gate the detail pages already
+  apply. So an operator writing "caused by #Database upgrade" in a public update
+  gets a working link, while a mention of an internal-only incident stays plain
+  text rather than becoming a link that confirms it exists. Widgets opt in by
+  declaring a `mentionType`, so the status-page packages take no dependency on any
+  domain plugin.
+
+  **BREAKING CHANGE (behavioural, no API change):** the in-app public status page
+  at `/statuspage/view/<slug>` now builds detail-page hrefs. Previously it passed
+  none, so incident and maintenance titles rendered as plain text there while the
+  same page on a custom domain linked them. Both now behave identically.
+
+  **Notification bodies no longer leak the internal scheme.** `checkstack:` is
+  meaningless outside a Checkstack renderer, and channels leaked it differently:
+  the email sanitiser stripped the href and left a dead anchor, while Slack's
+  mrkdwn emitted `<checkstack:maintenance/9f1c-abc|Database upgrade>` straight to
+  the recipient (Discord, Telegram and Teams render markdown natively and would
+  have passed it through too). `sanitizeUpdateMessage` now flattens every mention
+  to its label before the body reaches any channel, so no channel has to know the
+  scheme exists. Flattening also happens before the length bound, so the excerpt
+  budget is spent on visible text rather than on an internal URI.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/signal-common@0.3.2
+
 ## 0.17.0
 
 ### Minor Changes
diff --git a/core/frontend-api/package.json b/core/frontend-api/package.json
index 81015f103..c976f0250 100644
--- a/core/frontend-api/package.json
+++ b/core/frontend-api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/frontend-api",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/frontend/CHANGELOG.md b/core/frontend/CHANGELOG.md
index b45e2db0f..ce8fe7049 100644
--- a/core/frontend/CHANGELOG.md
+++ b/core/frontend/CHANGELOG.md
@@ -1,5 +1,110 @@
 # @checkstack/frontend
 
+## 0.17.0
+
+### Minor Changes
+
+- 88f4333: Resolve `#` mentions on public status pages, and check viewability in the admin UI
+
+  Cross-entity mentions previously resolved only in the admin UI, and did so
+  without asking whether the reader could actually open the target. Public
+  surfaces resolved nothing at all. Three changes, one per delivery context.
+
+  **The admin UI now checks viewability.** `useMentionResolution({ documents })`
+  collects the references a page is about to render and asks each owning plugin -
+  in ONE batched request - which of them this viewer may read. A mention to a
+  deleted or unreadable record now renders as plain text instead of a link to a
+  not-found page or an access gate. Backed by new `resolveIncidentRefs` /
+  `resolveMaintenanceRefs` procedures, which return ids only (so an unreadable
+  record is indistinguishable from a deleted one) and carry the same `listKey`
+  read post-filter as their list procedures. They are deliberately not a filter
+  over the authoring search list, which hides resolved incidents and would
+  silently downgrade valid references.
+
+  **Public status pages now resolve mentions.** A reference becomes a link to the
+  target's public detail page when - and only when - the same page publishes that
+  target, which is exactly the anti-enumeration gate the detail pages already
+  apply. So an operator writing "caused by #Database upgrade" in a public update
+  gets a working link, while a mention of an internal-only incident stays plain
+  text rather than becoming a link that confirms it exists. Widgets opt in by
+  declaring a `mentionType`, so the status-page packages take no dependency on any
+  domain plugin.
+
+  **BREAKING CHANGE (behavioural, no API change):** the in-app public status page
+  at `/statuspage/view/<slug>` now builds detail-page hrefs. Previously it passed
+  none, so incident and maintenance titles rendered as plain text there while the
+  same page on a custom domain linked them. Both now behave identically.
+
+  **Notification bodies no longer leak the internal scheme.** `checkstack:` is
+  meaningless outside a Checkstack renderer, and channels leaked it differently:
+  the email sanitiser stripped the href and left a dead anchor, while Slack's
+  mrkdwn emitted `<checkstack:maintenance/9f1c-abc|Database upgrade>` straight to
+  the recipient (Discord, Telegram and Teams render markdown natively and would
+  have passed it through too). `sanitizeUpdateMessage` now flattens every mention
+  to its label before the body reaches any channel, so no channel has to know the
+  scheme exists. Flattening also happens before the length bound, so the excerpt
+  budget is spent on visible text rather than on an internal URI.
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+  - @checkstack/about-frontend@0.6.0
+  - @checkstack/auth-frontend@0.16.0
+  - @checkstack/common@0.24.0
+  - @checkstack/status-page-common@0.7.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/catalog-frontend@0.22.0
+  - @checkstack/command-frontend@0.6.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/announcement-frontend@0.11.0
+  - @checkstack/status-page-frontend@0.9.0
+  - @checkstack/dependency-frontend@0.9.0
+  - @checkstack/signal-common@0.3.2
+  - @checkstack/signal-frontend@0.3.8
+
 ## 0.16.0
 
 ### Minor Changes
diff --git a/core/frontend/package.json b/core/frontend/package.json
index e62582cb3..67d674397 100644
--- a/core/frontend/package.json
+++ b/core/frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/frontend",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "license": "Elastic-2.0",
   "checkstack": {
     "type": "frontend"
diff --git a/core/gitops-backend/CHANGELOG.md b/core/gitops-backend/CHANGELOG.md
index 0f4bbddbc..2ab5fb47f 100644
--- a/core/gitops-backend/CHANGELOG.md
+++ b/core/gitops-backend/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @checkstack/gitops-backend
 
+## 0.5.28
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/command-backend@0.3.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/secrets-backend@0.3.10
+  - @checkstack/gitops-common@0.7.5
+  - @checkstack/queue-api@0.4.1
+
 ## 0.5.27
 
 ### Patch Changes
diff --git a/core/gitops-backend/package.json b/core/gitops-backend/package.json
index e08aeb5cf..43dcc7cb2 100644
--- a/core/gitops-backend/package.json
+++ b/core/gitops-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/gitops-backend",
-  "version": "0.5.27",
+  "version": "0.5.28",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/gitops-common/CHANGELOG.md b/core/gitops-common/CHANGELOG.md
index c3001c381..05ee056d1 100644
--- a/core/gitops-common/CHANGELOG.md
+++ b/core/gitops-common/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @checkstack/gitops-common
 
+## 0.7.5
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/secrets-common@0.3.4
+
 ## 0.7.4
 
 ### Patch Changes
diff --git a/core/gitops-common/package.json b/core/gitops-common/package.json
index 88eca8ec2..29b0ca68f 100644
--- a/core/gitops-common/package.json
+++ b/core/gitops-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/gitops-common",
-  "version": "0.7.4",
+  "version": "0.7.5",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/gitops-frontend/CHANGELOG.md b/core/gitops-frontend/CHANGELOG.md
index 65677a189..9f5476b48 100644
--- a/core/gitops-frontend/CHANGELOG.md
+++ b/core/gitops-frontend/CHANGELOG.md
@@ -1,5 +1,56 @@
 # @checkstack/gitops-frontend
 
+## 0.8.0
+
+### Minor Changes
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/tips-frontend@0.5.6
+  - @checkstack/gitops-common@0.7.5
+
 ## 0.7.9
 
 ### Patch Changes
diff --git a/core/gitops-frontend/package.json b/core/gitops-frontend/package.json
index efee3ab91..2d7345477 100644
--- a/core/gitops-frontend/package.json
+++ b/core/gitops-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/gitops-frontend",
-  "version": "0.7.9",
+  "version": "0.8.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/healthcheck-backend/CHANGELOG.md b/core/healthcheck-backend/CHANGELOG.md
index cdbb6875e..0a03dd5ad 100644
--- a/core/healthcheck-backend/CHANGELOG.md
+++ b/core/healthcheck-backend/CHANGELOG.md
@@ -1,5 +1,100 @@
 # @checkstack/healthcheck-backend
 
+## 1.23.0
+
+### Minor Changes
+
+- 88f4333: Per-satellite offline threshold, connectivity notifications, and stop satellite-only checks going silent
+
+  **A satellite going offline was invisible, and so were its checks.** Three
+  related changes:
+
+  **Per-satellite offline threshold.** The 45-second global constant is now a
+  per-satellite override (**Offline after**, 2 minutes to 24 hours), because
+  tolerance is a property of the link, not of the platform: a satellite on a flaky
+  uplink needs grace that should not be forced on every other satellite. The
+  threshold is carried on every row read by `computeStatus`, so the entity read,
+  the admin list and the heartbeat monitor cannot disagree about the same
+  satellite. Additive, nullable column - existing satellites keep the default.
+
+  **Connectivity notifications.** Satellites are now a notification target with a
+  **Satellite connectivity** subscription: a warning when a satellite stops
+  heartbeating, informational when it returns. A reconnect only notifies if the
+  satellite was actually offline, so a redeploy is not an event. (The same
+  transitions remain available as `satellite.heartbeat_lost` / `.connected`
+  automation triggers for anyone wanting different routing.)
+
+  **Satellite-only checks no longer go silent.** BUG FIX: a check with
+  `includeLocal: false` whose satellites were all offline recorded NOTHING, so it
+  displayed its last known status indefinitely - a dead probe was indistinguishable
+  from a passing one. The core now records a `degraded` run with a clear message.
+  Degraded rather than unhealthy because the target may be fine; what failed is our
+  ability to observe it. Liveness that cannot be resolved is treated as "executing"
+  so a transient lookup failure cannot mark the whole fleet degraded at once.
+
+  Checks also surface staleness: a last run older than five intervals (minimum ten
+  minutes) is highlighted, so an ageing status is visible even with no run to
+  explain it. Paused checks are never stale, and neither is a RETIRED slice - one
+  whose environment was removed or whose satellite was unassigned - because
+  warning about something you retired on purpose trains operators to ignore the
+  badge.
+
+  The unobservable run does NOT notify subscribers. One offline satellite degrades
+  every check assigned to it in the same tick, and `healthy -> degraded` is an
+  escalation, so notifying per check would turn a single root cause into one alert
+  per check. The satellite's own connectivity subscription reports the cause once;
+  the runs are still recorded, so health and the UI stay honest.
+
+  Satellite liveness is cached on the shared platform cache with a 5s TTL. The
+  executor asks per tick of every satellite-only check and the read is a full
+  scan, so the uncached version scaled with the number of such checks. The TTL is
+  well below the smallest offline threshold the schema allows, so a cached answer
+  can lag a transition by one tick but never span one.
+
+  Corrects the user guide, which claimed offline satellites produced failed runs -
+  they produced nothing at all.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/status-page-common@0.7.0
+  - @checkstack/incident-common@1.11.0
+  - @checkstack/maintenance-common@1.11.0
+  - @checkstack/command-backend@0.3.0
+  - @checkstack/incident-backend@1.14.0
+  - @checkstack/satellite-backend@0.10.0
+  - @checkstack/status-page-backend@0.7.0
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/ai-backend@0.11.5
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/satellite-common@0.12.0
+  - @checkstack/automation-backend@0.11.9
+  - @checkstack/secrets-backend@0.3.10
+  - @checkstack/ai-common@0.6.8
+  - @checkstack/cache-api@0.3.21
+  - @checkstack/catalog-backend@1.10.2
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/gitops-backend@0.5.28
+  - @checkstack/gitops-common@0.7.5
+  - @checkstack/healthcheck-execution@0.35.1
+  - @checkstack/queue-api@0.4.1
+  - @checkstack/script-packages-backend@0.4.7
+  - @checkstack/sdk@0.136.1
+  - @checkstack/secrets-common@0.3.4
+  - @checkstack/signal-common@0.3.2
+  - @checkstack/cache-utils@0.3.2
+
 ## 1.22.0
 
 ### Minor Changes
diff --git a/core/healthcheck-backend/package.json b/core/healthcheck-backend/package.json
index dd27b104c..0e8ebde81 100644
--- a/core/healthcheck-backend/package.json
+++ b/core/healthcheck-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-backend",
-  "version": "1.22.0",
+  "version": "1.23.0",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/healthcheck-common/CHANGELOG.md b/core/healthcheck-common/CHANGELOG.md
index a6abf4026..12865d465 100644
--- a/core/healthcheck-common/CHANGELOG.md
+++ b/core/healthcheck-common/CHANGELOG.md
@@ -1,5 +1,59 @@
 # @checkstack/healthcheck-common
 
+## 1.19.1
+
+### Patch Changes
+
+- 1deaac5: Make endpoint authorization self-documenting in the generated API docs
+
+  Every procedure's authorization is now derived from its contract metadata (its
+  `access` rules + `instanceAccess` mode) via a shared mode-descriptor registry and
+  emitted into the OpenAPI spec - both structurally (`x-orpc-meta.authorization`)
+  and as a human `**Authorization.**` sentence folded into the operation
+  description. Previously the docs surfaced only a flat list of global rule ids, so
+  an integrator (an API-key/application principal that CAN hold team grants) never
+  saw the team-grant / per-object dimension, and endpoints gated purely in the
+  handler showed no restriction at all.
+
+  For authorization that no declarative mode can express and is therefore enforced
+  in the handler (a compound OR, a graded verdict, a DB-derived id set), a new
+  optional `accessNote` on the procedure metadata surfaces the real rule in the
+  docs as an explicitly handler-enforced addendum. The note is documentation, not a
+  guarantee: per `.claude/rules/rlac.md` the drift guard for such authz is
+  behavioral tests over an extracted pure decision function, and the note must
+  state exactly what those tests pin.
+
+  Every handler-enforced authorization endpoint now carries such a note so the docs
+  are complete: the team read/scoping and team-management endpoints
+  (`@checkstack/auth-common`), the health-check assignment/history reads
+  (`@checkstack/healthcheck-common`), the audience-graded incident/maintenance
+  reads (`@checkstack/incident-common`, `@checkstack/maintenance-common`), status
+  -page publish's bound-resource check (`@checkstack/status-page-common`), the
+  stream `setSystemLinks` readable-additions check
+  (`@checkstack/{metricstream,tracestream,logstream}-common`), and the automation
+  `runAs` escalation guard (`@checkstack/automation-common`). These are
+  metadata-only additions - no runtime behavior changed. The notes describe the
+  rule for API-doc readers only; the drift guard is behavioral tests over the
+  check's decision function (per `.claude/rules/rlac.md`), so the notes name no
+  internal test files.
+
+  The API docs viewer (`@checkstack/api-docs-frontend`) now renders each
+  operation's description as Markdown, so the `**Authorization.**` block (and any
+  inline `code`) formats correctly instead of showing raw markdown.
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/secrets-common@0.3.4
+  - @checkstack/signal-common@0.3.2
+
 ## 1.19.0
 
 ### Minor Changes
diff --git a/core/healthcheck-common/package.json b/core/healthcheck-common/package.json
index cc228a618..c0a612cf2 100644
--- a/core/healthcheck-common/package.json
+++ b/core/healthcheck-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-common",
-  "version": "1.19.0",
+  "version": "1.19.1",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/healthcheck-execution/CHANGELOG.md b/core/healthcheck-execution/CHANGELOG.md
index 19a722ef2..89a5a6e7c 100644
--- a/core/healthcheck-execution/CHANGELOG.md
+++ b/core/healthcheck-execution/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/healthcheck-execution
 
+## 0.35.1
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/template-engine@0.4.13
+
 ## 0.35.0
 
 ### Minor Changes
diff --git a/core/healthcheck-execution/package.json b/core/healthcheck-execution/package.json
index 609c341db..a504f0541 100644
--- a/core/healthcheck-execution/package.json
+++ b/core/healthcheck-execution/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-execution",
-  "version": "0.35.0",
+  "version": "0.35.1",
   "license": "Elastic-2.0",
   "type": "module",
   "exports": {
diff --git a/core/healthcheck-frontend/CHANGELOG.md b/core/healthcheck-frontend/CHANGELOG.md
index b4491ec56..db955ea8b 100644
--- a/core/healthcheck-frontend/CHANGELOG.md
+++ b/core/healthcheck-frontend/CHANGELOG.md
@@ -1,5 +1,135 @@
 # @checkstack/healthcheck-frontend
 
+## 0.39.0
+
+### Minor Changes
+
+- 88f4333: Preview system custom fields in the health-check editor
+
+  The editor gained a **System** picker beside the existing "Preview as"
+  environment picker, so `{{ system.metadata.<key> }}` resolves in the preview line
+  and offers `{{ }}` autocomplete.
+
+  Previously system templating could only be previewed when the editor happened to
+  be opened FROM a system: a shared-config authoring flow and every edit-mode
+  session got no preview and no completions at all, because the systems list was
+  not even fetched in edit mode.
+
+  Selecting only a system is now enough to preview - an environment is no longer
+  required, since `system.metadata.*` is fully resolvable without one. Both pickers
+  only offer resources the caller may read.
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+- 88f4333: Per-satellite offline threshold, connectivity notifications, and stop satellite-only checks going silent
+
+  **A satellite going offline was invisible, and so were its checks.** Three
+  related changes:
+
+  **Per-satellite offline threshold.** The 45-second global constant is now a
+  per-satellite override (**Offline after**, 2 minutes to 24 hours), because
+  tolerance is a property of the link, not of the platform: a satellite on a flaky
+  uplink needs grace that should not be forced on every other satellite. The
+  threshold is carried on every row read by `computeStatus`, so the entity read,
+  the admin list and the heartbeat monitor cannot disagree about the same
+  satellite. Additive, nullable column - existing satellites keep the default.
+
+  **Connectivity notifications.** Satellites are now a notification target with a
+  **Satellite connectivity** subscription: a warning when a satellite stops
+  heartbeating, informational when it returns. A reconnect only notifies if the
+  satellite was actually offline, so a redeploy is not an event. (The same
+  transitions remain available as `satellite.heartbeat_lost` / `.connected`
+  automation triggers for anyone wanting different routing.)
+
+  **Satellite-only checks no longer go silent.** BUG FIX: a check with
+  `includeLocal: false` whose satellites were all offline recorded NOTHING, so it
+  displayed its last known status indefinitely - a dead probe was indistinguishable
+  from a passing one. The core now records a `degraded` run with a clear message.
+  Degraded rather than unhealthy because the target may be fine; what failed is our
+  ability to observe it. Liveness that cannot be resolved is treated as "executing"
+  so a transient lookup failure cannot mark the whole fleet degraded at once.
+
+  Checks also surface staleness: a last run older than five intervals (minimum ten
+  minutes) is highlighted, so an ageing status is visible even with no run to
+  explain it. Paused checks are never stale, and neither is a RETIRED slice - one
+  whose environment was removed or whose satellite was unassigned - because
+  warning about something you retired on purpose trains operators to ignore the
+  badge.
+
+  The unobservable run does NOT notify subscribers. One offline satellite degrades
+  every check assigned to it in the same tick, and `healthy -> degraded` is an
+  escalation, so notifying per check would turn a single root cause into one alert
+  per check. The satellite's own connectivity subscription reports the cause once;
+  the runs are still recorded, so health and the UI stay honest.
+
+  Satellite liveness is cached on the shared platform cache with a 5s TTL. The
+  executor asks per tick of every satellite-only check and the read is a full
+  scan, so the uncached version scaled with the number of such checks. The TTL is
+  well below the smallest offline threshold the schema allows, so a cached answer
+  can lag a transition by one tick but never span one.
+
+  Corrects the user guide, which claimed offline satellites produced failed runs -
+  they produced nothing at all.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+  - @checkstack/auth-frontend@0.16.0
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/ui@1.31.0
+  - @checkstack/catalog-frontend@0.22.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/dashboard-frontend@0.12.0
+  - @checkstack/gitops-frontend@0.8.0
+  - @checkstack/script-packages-frontend@0.5.0
+  - @checkstack/secrets-frontend@0.4.0
+  - @checkstack/satellite-common@0.12.0
+  - @checkstack/tips-frontend@0.5.6
+  - @checkstack/anomaly-common@1.8.4
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/signal-frontend@0.3.8
+
 ## 0.38.0
 
 ### Minor Changes
diff --git a/core/healthcheck-frontend/package.json b/core/healthcheck-frontend/package.json
index b5deac58a..43349d6df 100644
--- a/core/healthcheck-frontend/package.json
+++ b/core/healthcheck-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-frontend",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/incident-backend/CHANGELOG.md b/core/incident-backend/CHANGELOG.md
index d7afdcba3..b730dc2e5 100644
--- a/core/incident-backend/CHANGELOG.md
+++ b/core/incident-backend/CHANGELOG.md
@@ -1,5 +1,101 @@
 # @checkstack/incident-backend
 
+## 1.14.0
+
+### Minor Changes
+
+- 88f4333: Resolve `#` mentions on public status pages, and check viewability in the admin UI
+
+  Cross-entity mentions previously resolved only in the admin UI, and did so
+  without asking whether the reader could actually open the target. Public
+  surfaces resolved nothing at all. Three changes, one per delivery context.
+
+  **The admin UI now checks viewability.** `useMentionResolution({ documents })`
+  collects the references a page is about to render and asks each owning plugin -
+  in ONE batched request - which of them this viewer may read. A mention to a
+  deleted or unreadable record now renders as plain text instead of a link to a
+  not-found page or an access gate. Backed by new `resolveIncidentRefs` /
+  `resolveMaintenanceRefs` procedures, which return ids only (so an unreadable
+  record is indistinguishable from a deleted one) and carry the same `listKey`
+  read post-filter as their list procedures. They are deliberately not a filter
+  over the authoring search list, which hides resolved incidents and would
+  silently downgrade valid references.
+
+  **Public status pages now resolve mentions.** A reference becomes a link to the
+  target's public detail page when - and only when - the same page publishes that
+  target, which is exactly the anti-enumeration gate the detail pages already
+  apply. So an operator writing "caused by #Database upgrade" in a public update
+  gets a working link, while a mention of an internal-only incident stays plain
+  text rather than becoming a link that confirms it exists. Widgets opt in by
+  declaring a `mentionType`, so the status-page packages take no dependency on any
+  domain plugin.
+
+  **BREAKING CHANGE (behavioural, no API change):** the in-app public status page
+  at `/statuspage/view/<slug>` now builds detail-page hrefs. Previously it passed
+  none, so incident and maintenance titles rendered as plain text there while the
+  same page on a custom domain linked them. Both now behave identically.
+
+  **Notification bodies no longer leak the internal scheme.** `checkstack:` is
+  meaningless outside a Checkstack renderer, and channels leaked it differently:
+  the email sanitiser stripped the href and left a dead anchor, while Slack's
+  mrkdwn emitted `<checkstack:maintenance/9f1c-abc|Database upgrade>` straight to
+  the recipient (Discord, Telegram and Teams render markdown natively and would
+  have passed it through too). `sanitizeUpdateMessage` now flattens every mention
+  to its label before the body reaches any channel, so no channel has to know the
+  scheme exists. Flattening also happens before the length bound, so the excerpt
+  budget is spent on visible text rather than on an internal URI.
+
+### Patch Changes
+
+- 88f4333: Show command-palette actions to team-scoped users
+
+  The palette filtered commands against the caller's GLOBAL access rules only, so a
+  user whose team holds a create-capability grant - but who holds no global
+  `incident.incident.manage` / `maintenance.maintenance.manage` rule - never saw
+  "Create Incident" or "Create Maintenance", nor their keyboard shortcuts. The
+  palette hid the actions from exactly the people authorized to run them.
+
+  Commands can now declare a `manageCapability` (mirroring the gate routes and nav
+  already use). `filterByAccessRules` shows an item when the caller holds the
+  global rules OR can create/manage the declared type through a team grant, and the
+  command backend resolves that per request via `hasAnyTypeGrant` (with
+  `includeCreator`, so a team member who may CREATE the type qualifies before
+  owning an instance). It fails closed: an auth error leaves pure global gating.
+  The incident and maintenance commands declare their types.
+
+  `useGlobalShortcuts` no longer takes `userAccessRules` and no longer re-checks
+  access: the server-filtered list is authoritative. That re-check tested the
+  global rules only and would have dropped team-scoped users' shortcuts - both call
+  sites already defeated it by passing `["*"]`.
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+  - @checkstack/common@0.24.0
+  - @checkstack/auth-common@0.17.0
+  - @checkstack/status-page-common@0.7.0
+  - @checkstack/incident-common@1.11.0
+  - @checkstack/automation-common@0.10.3
+  - @checkstack/command-backend@0.3.0
+  - @checkstack/status-page-backend@0.7.0
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/ai-backend@0.11.5
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/automation-backend@0.11.9
+  - @checkstack/ai-common@0.6.8
+  - @checkstack/cache-api@0.3.21
+  - @checkstack/catalog-backend@1.10.2
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/integration-backend@0.7.10
+  - @checkstack/integration-common@0.9.11
+  - @checkstack/signal-common@0.3.2
+  - @checkstack/cache-utils@0.3.2
+
 ## 1.13.6
 
 ### Patch Changes
diff --git a/core/incident-backend/package.json b/core/incident-backend/package.json
index 02c37f521..224ec7a67 100644
--- a/core/incident-backend/package.json
+++ b/core/incident-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/incident-backend",
-  "version": "1.13.6",
+  "version": "1.14.0",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/incident-common/CHANGELOG.md b/core/incident-common/CHANGELOG.md
index 16aef5287..4820db79d 100644
--- a/core/incident-common/CHANGELOG.md
+++ b/core/incident-common/CHANGELOG.md
@@ -1,5 +1,101 @@
 # @checkstack/incident-common
 
+## 1.11.0
+
+### Minor Changes
+
+- 88f4333: Resolve `#` mentions on public status pages, and check viewability in the admin UI
+
+  Cross-entity mentions previously resolved only in the admin UI, and did so
+  without asking whether the reader could actually open the target. Public
+  surfaces resolved nothing at all. Three changes, one per delivery context.
+
+  **The admin UI now checks viewability.** `useMentionResolution({ documents })`
+  collects the references a page is about to render and asks each owning plugin -
+  in ONE batched request - which of them this viewer may read. A mention to a
+  deleted or unreadable record now renders as plain text instead of a link to a
+  not-found page or an access gate. Backed by new `resolveIncidentRefs` /
+  `resolveMaintenanceRefs` procedures, which return ids only (so an unreadable
+  record is indistinguishable from a deleted one) and carry the same `listKey`
+  read post-filter as their list procedures. They are deliberately not a filter
+  over the authoring search list, which hides resolved incidents and would
+  silently downgrade valid references.
+
+  **Public status pages now resolve mentions.** A reference becomes a link to the
+  target's public detail page when - and only when - the same page publishes that
+  target, which is exactly the anti-enumeration gate the detail pages already
+  apply. So an operator writing "caused by #Database upgrade" in a public update
+  gets a working link, while a mention of an internal-only incident stays plain
+  text rather than becoming a link that confirms it exists. Widgets opt in by
+  declaring a `mentionType`, so the status-page packages take no dependency on any
+  domain plugin.
+
+  **BREAKING CHANGE (behavioural, no API change):** the in-app public status page
+  at `/statuspage/view/<slug>` now builds detail-page hrefs. Previously it passed
+  none, so incident and maintenance titles rendered as plain text there while the
+  same page on a custom domain linked them. Both now behave identically.
+
+  **Notification bodies no longer leak the internal scheme.** `checkstack:` is
+  meaningless outside a Checkstack renderer, and channels leaked it differently:
+  the email sanitiser stripped the href and left a dead anchor, while Slack's
+  mrkdwn emitted `<checkstack:maintenance/9f1c-abc|Database upgrade>` straight to
+  the recipient (Discord, Telegram and Teams render markdown natively and would
+  have passed it through too). `sanitizeUpdateMessage` now flattens every mention
+  to its label before the body reaches any channel, so no channel has to know the
+  scheme exists. Flattening also happens before the length bound, so the excerpt
+  budget is spent on visible text rather than on an internal URI.
+
+### Patch Changes
+
+- 1deaac5: Make endpoint authorization self-documenting in the generated API docs
+
+  Every procedure's authorization is now derived from its contract metadata (its
+  `access` rules + `instanceAccess` mode) via a shared mode-descriptor registry and
+  emitted into the OpenAPI spec - both structurally (`x-orpc-meta.authorization`)
+  and as a human `**Authorization.**` sentence folded into the operation
+  description. Previously the docs surfaced only a flat list of global rule ids, so
+  an integrator (an API-key/application principal that CAN hold team grants) never
+  saw the team-grant / per-object dimension, and endpoints gated purely in the
+  handler showed no restriction at all.
+
+  For authorization that no declarative mode can express and is therefore enforced
+  in the handler (a compound OR, a graded verdict, a DB-derived id set), a new
+  optional `accessNote` on the procedure metadata surfaces the real rule in the
+  docs as an explicitly handler-enforced addendum. The note is documentation, not a
+  guarantee: per `.claude/rules/rlac.md` the drift guard for such authz is
+  behavioral tests over an extracted pure decision function, and the note must
+  state exactly what those tests pin.
+
+  Every handler-enforced authorization endpoint now carries such a note so the docs
+  are complete: the team read/scoping and team-management endpoints
+  (`@checkstack/auth-common`), the health-check assignment/history reads
+  (`@checkstack/healthcheck-common`), the audience-graded incident/maintenance
+  reads (`@checkstack/incident-common`, `@checkstack/maintenance-common`), status
+  -page publish's bound-resource check (`@checkstack/status-page-common`), the
+  stream `setSystemLinks` readable-additions check
+  (`@checkstack/{metricstream,tracestream,logstream}-common`), and the automation
+  `runAs` escalation guard (`@checkstack/automation-common`). These are
+  metadata-only additions - no runtime behavior changed. The notes describe the
+  rule for API-doc readers only; the drift guard is behavioral tests over the
+  check's decision function (per `.claude/rules/rlac.md`), so the notes name no
+  internal test files.
+
+  The API docs viewer (`@checkstack/api-docs-frontend`) now renders each
+  operation's description as Markdown, so the `**Authorization.**` block (and any
+  inline `code`) formats correctly instead of showing raw markdown.
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/signal-common@0.3.2
+
 ## 1.10.5
 
 ### Patch Changes
diff --git a/core/incident-common/package.json b/core/incident-common/package.json
index 1488fa8dc..842233953 100644
--- a/core/incident-common/package.json
+++ b/core/incident-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/incident-common",
-  "version": "1.10.5",
+  "version": "1.11.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/incident-frontend/CHANGELOG.md b/core/incident-frontend/CHANGELOG.md
index 274f27c35..d4004fad3 100644
--- a/core/incident-frontend/CHANGELOG.md
+++ b/core/incident-frontend/CHANGELOG.md
@@ -1,5 +1,217 @@
 # @checkstack/incident-frontend
 
+## 0.17.0
+
+### Minor Changes
+
+- 88f4333: Report an incident or schedule maintenance straight from a system
+
+  The system overview showed a system's incidents and maintenances but offered no
+  way to open one for it - you had to navigate to the incidents/maintenance page
+  and re-pick the system by hand.
+
+  Both panels now carry an action ("Report incident" / "Schedule maintenance")
+  that deep-links to the editor with the system already selected, via
+  `?action=create&systemId=<id>`. The pages consume both params and clear them, so
+  a refresh doesn't reopen the dialog.
+
+  The action is gated on `useProcedureAccess` over the CREATE procedure's
+  contract, so it appears for a global manager AND for someone who can manage this
+  system through a team (the `create.parent` gate) - exactly who the backend
+  accepts. Gating on the bare global rule would have hidden it from the
+  team-scoped users it is most useful to.
+
+  The editors' unsaved-changes baseline accounts for the pre-selection, so opening
+  a pre-scoped form and closing it again doesn't falsely prompt to discard.
+
+- 88f4333: Link incidents and maintenances with `#` mentions
+
+  Typing `#` in a markdown field now opens a picker over every mentionable record
+  and inserts a reference. Referencing another record previously meant pasting a
+  URL, which cannot be right everywhere: an admin URL is meaningless on a public
+  status page, a status-page URL is meaningless in the admin UI, and neither works
+  in an email.
+
+  A mention therefore stores WHAT it points at, never where:
+  `[Database upgrade](checkstack:maintenance/<id>)`. That is an ordinary markdown
+  link - readable in the raw source, parsed unchanged by existing tooling - and
+  only the href is resolved per render context.
+
+  Resolution may REFUSE: a resolver returning nothing renders the label as plain
+  text rather than a link. That is a confidentiality property, not a nicety - an
+  internal-only incident referenced from a public status update must not become a
+  link that confirms it exists. A renderer given no resolver links nothing.
+
+  Incident and maintenance detail pages gained a **Referenced items** section,
+  derived by scanning the authored markdown on each render. Nothing is stored
+  twice, so an edit that drops a reference drops it from the list too.
+
+  The platform owns the contract (`registerMentionRoutes` / `setMentionSearch` in
+  `@checkstack/frontend-api`); each owning plugin registers its own type, so no
+  plugin imports another. Search only ever offers records the caller may read.
+
+  Scope: resolution is wired for the admin UI. Public status pages and notification
+  bodies do not resolve mentions yet, so a mention renders there as plain text -
+  the safe default above, not a broken link.
+
+  Precisely: the admin resolver maps a well-formed reference to a route WITHOUT
+  checking that the target still exists or that this viewer may read it, so a
+  mention to a deleted or unreadable record links to a not-found or an access gate.
+  That is deliberate - gating on the provider's fetched list would silently
+  downgrade valid references to plain text (the incident search excludes resolved
+  incidents by default), and silently dropping a valid link is worse than one that
+  lands on a gate the backend already enforces. The confidentiality property is
+  carried by the public renderers, which resolve nothing.
+
+- 88f4333: Markdown editor with a live preview tab and formatting toolbar
+
+  Markdown fields were plain textareas with a "Markdown supported" hint, so an
+  author found out how their text rendered only after saving - or, for a
+  notification, after it had already been delivered.
+
+  New `MarkdownEditor` in `@checkstack/ui`: Write / Preview tabs plus a toolbar
+  (bold, italic, link, code, lists, quote). Adopted by the incident and maintenance
+  update forms and descriptions, and the announcement message.
+
+  The preview renders through `MarkdownBlock` - the same component, remark/rehype
+  chain and sanitiser used for the saved content. A second renderer here would be
+  free to drift, and a preview that disagrees with the real render is worse than no
+  preview.
+
+  Toolbar marks toggle rather than only adding, and mark lengths are matched
+  exactly so italic (`*`) never claims bold's (`**`) delimiters and silently
+  downgrades an author's emphasis.
+
+  Note for adopters: `MarkdownEditor` wraps its textarea, so `required` on it does
+  nothing - gate submission explicitly instead.
+
+- 88f4333: Resolve `#` mentions on public status pages, and check viewability in the admin UI
+
+  Cross-entity mentions previously resolved only in the admin UI, and did so
+  without asking whether the reader could actually open the target. Public
+  surfaces resolved nothing at all. Three changes, one per delivery context.
+
+  **The admin UI now checks viewability.** `useMentionResolution({ documents })`
+  collects the references a page is about to render and asks each owning plugin -
+  in ONE batched request - which of them this viewer may read. A mention to a
+  deleted or unreadable record now renders as plain text instead of a link to a
+  not-found page or an access gate. Backed by new `resolveIncidentRefs` /
+  `resolveMaintenanceRefs` procedures, which return ids only (so an unreadable
+  record is indistinguishable from a deleted one) and carry the same `listKey`
+  read post-filter as their list procedures. They are deliberately not a filter
+  over the authoring search list, which hides resolved incidents and would
+  silently downgrade valid references.
+
+  **Public status pages now resolve mentions.** A reference becomes a link to the
+  target's public detail page when - and only when - the same page publishes that
+  target, which is exactly the anti-enumeration gate the detail pages already
+  apply. So an operator writing "caused by #Database upgrade" in a public update
+  gets a working link, while a mention of an internal-only incident stays plain
+  text rather than becoming a link that confirms it exists. Widgets opt in by
+  declaring a `mentionType`, so the status-page packages take no dependency on any
+  domain plugin.
+
+  **BREAKING CHANGE (behavioural, no API change):** the in-app public status page
+  at `/statuspage/view/<slug>` now builds detail-page hrefs. Previously it passed
+  none, so incident and maintenance titles rendered as plain text there while the
+  same page on a custom domain linked them. Both now behave identically.
+
+  **Notification bodies no longer leak the internal scheme.** `checkstack:` is
+  meaningless outside a Checkstack renderer, and channels leaked it differently:
+  the email sanitiser stripped the href and left a dead anchor, while Slack's
+  mrkdwn emitted `<checkstack:maintenance/9f1c-abc|Database upgrade>` straight to
+  the recipient (Discord, Telegram and Teams render markdown natively and would
+  have passed it through too). `sanitizeUpdateMessage` now flattens every mention
+  to its label before the body reaches any channel, so no channel has to know the
+  scheme exists. Flattening also happens before the length bound, so the excerpt
+  budget is spent on visible text rather than on an internal URI.
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+- 88f4333: Name the single maintenance or incident on the system overview cards
+
+  When a system has exactly one leading maintenance window (or one active
+  incident), its card now shows the TITLE, linked to the record, instead of the
+  count. A bare "1" told the reader nothing they could not already infer from the
+  card being there, and forced a second click to learn anything.
+
+  With two or more there is no single thing to name, so the count remains.
+
+- 88f4333: Colour timeline dots, and fix the rail they hang from
+
+  Status-update timeline dots were uniformly grey, so the rail carried no
+  information. They are now toned:
+
+  - **Maintenance** dots take the update's own status. Maintenance has no severity,
+    so its lifecycle is the one coloured dimension and nothing competes with it.
+  - **Incident** dots take the incident's SEVERITY, keeping status on a neutral
+    pill. Incidents carry both an urgency and a lifecycle, and `status-tone.ts`
+    gives the hue to the urgency - colouring both would put two competing scales on
+    one row.
+  - **Public status pages** now tone the dot to match the status label already
+    rendered beside it.
+
+  An update that changes nothing stays neutral, so a coloured dot always means "the
+  status moved here".
+
+  Also fixes the rail itself: it anchored its left EDGE at `left-4`, putting its
+  centre at 16.25px while every dot centres at 16px, so each dot sat a hair off the
+  line. The rail is now centred on the same axis, and a new exported `TimelineDot`
+  owns the positioning so the four separate copies of that maths cannot diverge
+  again.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+  - @checkstack/auth-frontend@0.16.0
+  - @checkstack/common@0.24.0
+  - @checkstack/incident-common@1.11.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/dashboard-frontend@0.12.0
+  - @checkstack/notification-frontend@0.10.0
+  - @checkstack/tips-frontend@0.5.6
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/signal-frontend@0.3.8
+
 ## 0.16.5
 
 ### Patch Changes
diff --git a/core/incident-frontend/package.json b/core/incident-frontend/package.json
index 3c4e7af14..82ed3b946 100644
--- a/core/incident-frontend/package.json
+++ b/core/incident-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/incident-frontend",
-  "version": "0.16.5",
+  "version": "0.17.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/infrastructure-common/CHANGELOG.md b/core/infrastructure-common/CHANGELOG.md
index 6dfd752d2..c03d8ee3b 100644
--- a/core/infrastructure-common/CHANGELOG.md
+++ b/core/infrastructure-common/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @checkstack/infrastructure-common
 
+## 0.3.24
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/frontend-api@0.18.0
+
 ## 0.3.23
 
 ### Patch Changes
diff --git a/core/infrastructure-common/package.json b/core/infrastructure-common/package.json
index 94a995e1d..604a231ca 100644
--- a/core/infrastructure-common/package.json
+++ b/core/infrastructure-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/infrastructure-common",
-  "version": "0.3.23",
+  "version": "0.3.24",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/infrastructure-frontend/CHANGELOG.md b/core/infrastructure-frontend/CHANGELOG.md
index 906b546be..8507f77bd 100644
--- a/core/infrastructure-frontend/CHANGELOG.md
+++ b/core/infrastructure-frontend/CHANGELOG.md
@@ -1,5 +1,55 @@
 # @checkstack/infrastructure-frontend
 
+## 0.6.0
+
+### Minor Changes
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/infrastructure-common@0.3.24
+
 ## 0.5.9
 
 ### Patch Changes
diff --git a/core/infrastructure-frontend/package.json b/core/infrastructure-frontend/package.json
index 79e25e1e6..aae6bf863 100644
--- a/core/infrastructure-frontend/package.json
+++ b/core/infrastructure-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/infrastructure-frontend",
-  "version": "0.5.9",
+  "version": "0.6.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/ingest-utils/CHANGELOG.md b/core/ingest-utils/CHANGELOG.md
index 2f029affd..86a3cb722 100644
--- a/core/ingest-utils/CHANGELOG.md
+++ b/core/ingest-utils/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @checkstack/ingest-utils
 
+## 0.2.1
+
+### Patch Changes
+
+- @checkstack/cache-api@0.3.21
+- @checkstack/cache-utils@0.3.2
+- @checkstack/otlp-wire@0.1.1
+
 ## 0.2.0
 
 ### Minor Changes
diff --git a/core/ingest-utils/package.json b/core/ingest-utils/package.json
index a99ae4c98..9f1fd1cd6 100644
--- a/core/ingest-utils/package.json
+++ b/core/ingest-utils/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/ingest-utils",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "license": "Elastic-2.0",
   "checkstack": {
     "type": "tooling"
diff --git a/core/integration-backend/CHANGELOG.md b/core/integration-backend/CHANGELOG.md
index 6b2e49b32..7131b49c2 100644
--- a/core/integration-backend/CHANGELOG.md
+++ b/core/integration-backend/CHANGELOG.md
@@ -1,5 +1,25 @@
 # @checkstack/integration-backend
 
+## 0.7.10
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/command-backend@0.3.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/secrets-backend@0.3.10
+  - @checkstack/integration-common@0.9.11
+  - @checkstack/queue-api@0.4.1
+  - @checkstack/secrets-common@0.3.4
+  - @checkstack/signal-common@0.3.2
+
 ## 0.7.9
 
 ### Patch Changes
diff --git a/core/integration-backend/package.json b/core/integration-backend/package.json
index 86b70ee85..31aef92d1 100644
--- a/core/integration-backend/package.json
+++ b/core/integration-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/integration-backend",
-  "version": "0.7.9",
+  "version": "0.7.10",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/integration-common/CHANGELOG.md b/core/integration-common/CHANGELOG.md
index b14e0ad4c..30b19b59e 100644
--- a/core/integration-common/CHANGELOG.md
+++ b/core/integration-common/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @checkstack/integration-common
 
+## 0.9.11
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/signal-common@0.3.2
+
 ## 0.9.10
 
 ### Patch Changes
diff --git a/core/integration-common/package.json b/core/integration-common/package.json
index 5f61a63b1..e6d6fcd09 100644
--- a/core/integration-common/package.json
+++ b/core/integration-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/integration-common",
-  "version": "0.9.10",
+  "version": "0.9.11",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/integration-frontend/CHANGELOG.md b/core/integration-frontend/CHANGELOG.md
index ca95785c3..d207a7d17 100644
--- a/core/integration-frontend/CHANGELOG.md
+++ b/core/integration-frontend/CHANGELOG.md
@@ -1,5 +1,57 @@
 # @checkstack/integration-frontend
 
+## 0.9.0
+
+### Minor Changes
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/tips-frontend@0.5.6
+  - @checkstack/integration-common@0.9.11
+  - @checkstack/signal-frontend@0.3.8
+
 ## 0.8.9
 
 ### Patch Changes
diff --git a/core/integration-frontend/package.json b/core/integration-frontend/package.json
index 43f29d059..2503b69d2 100644
--- a/core/integration-frontend/package.json
+++ b/core/integration-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/integration-frontend",
-  "version": "0.8.9",
+  "version": "0.9.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/k8s-events-common/CHANGELOG.md b/core/k8s-events-common/CHANGELOG.md
index ba6b01fea..f8dd38c49 100644
--- a/core/k8s-events-common/CHANGELOG.md
+++ b/core/k8s-events-common/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/k8s-events-common
 
+## 0.1.2
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/telemetry-common@0.2.0
+
 ## 0.1.1
 
 ### Patch Changes
diff --git a/core/k8s-events-common/package.json b/core/k8s-events-common/package.json
index 75bd55675..58fb9a6e0 100644
--- a/core/k8s-events-common/package.json
+++ b/core/k8s-events-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/k8s-events-common",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/core/logstream-backend/CHANGELOG.md b/core/logstream-backend/CHANGELOG.md
index b329b0a43..c41323243 100644
--- a/core/logstream-backend/CHANGELOG.md
+++ b/core/logstream-backend/CHANGELOG.md
@@ -1,5 +1,35 @@
 # @checkstack/logstream-backend
 
+## 0.4.2
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/auth-common@0.17.0
+  - @checkstack/logstream-common@0.4.2
+  - @checkstack/satellite-backend@0.10.0
+  - @checkstack/ai-backend@0.11.5
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/telemetry-common@0.2.0
+  - @checkstack/telemetry-backend@0.2.0
+  - @checkstack/cache-api@0.3.21
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/queue-api@0.4.1
+  - @checkstack/signal-common@0.3.2
+  - @checkstack/cache-utils@0.3.2
+  - @checkstack/ingest-utils@0.2.1
+
 ## 0.4.1
 
 ### Patch Changes
diff --git a/core/logstream-backend/package.json b/core/logstream-backend/package.json
index e92c87da0..b3f06c1b8 100644
--- a/core/logstream-backend/package.json
+++ b/core/logstream-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/logstream-backend",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Log stream ingestion, storage, drain and health integration",
   "author": "Checkstack contributors",
   "license": "Elastic-2.0",
diff --git a/core/logstream-common/CHANGELOG.md b/core/logstream-common/CHANGELOG.md
index 948690ac8..3ad7365ae 100644
--- a/core/logstream-common/CHANGELOG.md
+++ b/core/logstream-common/CHANGELOG.md
@@ -1,5 +1,59 @@
 # @checkstack/logstream-common
 
+## 0.4.2
+
+### Patch Changes
+
+- 1deaac5: Make endpoint authorization self-documenting in the generated API docs
+
+  Every procedure's authorization is now derived from its contract metadata (its
+  `access` rules + `instanceAccess` mode) via a shared mode-descriptor registry and
+  emitted into the OpenAPI spec - both structurally (`x-orpc-meta.authorization`)
+  and as a human `**Authorization.**` sentence folded into the operation
+  description. Previously the docs surfaced only a flat list of global rule ids, so
+  an integrator (an API-key/application principal that CAN hold team grants) never
+  saw the team-grant / per-object dimension, and endpoints gated purely in the
+  handler showed no restriction at all.
+
+  For authorization that no declarative mode can express and is therefore enforced
+  in the handler (a compound OR, a graded verdict, a DB-derived id set), a new
+  optional `accessNote` on the procedure metadata surfaces the real rule in the
+  docs as an explicitly handler-enforced addendum. The note is documentation, not a
+  guarantee: per `.claude/rules/rlac.md` the drift guard for such authz is
+  behavioral tests over an extracted pure decision function, and the note must
+  state exactly what those tests pin.
+
+  Every handler-enforced authorization endpoint now carries such a note so the docs
+  are complete: the team read/scoping and team-management endpoints
+  (`@checkstack/auth-common`), the health-check assignment/history reads
+  (`@checkstack/healthcheck-common`), the audience-graded incident/maintenance
+  reads (`@checkstack/incident-common`, `@checkstack/maintenance-common`), status
+  -page publish's bound-resource check (`@checkstack/status-page-common`), the
+  stream `setSystemLinks` readable-additions check
+  (`@checkstack/{metricstream,tracestream,logstream}-common`), and the automation
+  `runAs` escalation guard (`@checkstack/automation-common`). These are
+  metadata-only additions - no runtime behavior changed. The notes describe the
+  rule for API-doc readers only; the drift guard is behavioral tests over the
+  check's decision function (per `.claude/rules/rlac.md`), so the notes name no
+  internal test files.
+
+  The API docs viewer (`@checkstack/api-docs-frontend`) now renders each
+  operation's description as Markdown, so the `**Authorization.**` block (and any
+  inline `code`) formats correctly instead of showing raw markdown.
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/telemetry-common@0.2.0
+  - @checkstack/signal-common@0.3.2
+  - @checkstack/otlp-wire@0.1.1
+
 ## 0.4.1
 
 ### Patch Changes
diff --git a/core/logstream-common/package.json b/core/logstream-common/package.json
index 7a4dfc1c1..dd1f3f9e6 100644
--- a/core/logstream-common/package.json
+++ b/core/logstream-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/logstream-common",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Log stream contracts, schemas, access rules and signals",
   "author": "Checkstack contributors",
   "license": "Elastic-2.0",
diff --git a/core/logstream-frontend/CHANGELOG.md b/core/logstream-frontend/CHANGELOG.md
index c48f33d8b..19f73ed6b 100644
--- a/core/logstream-frontend/CHANGELOG.md
+++ b/core/logstream-frontend/CHANGELOG.md
@@ -1,5 +1,91 @@
 # @checkstack/logstream-frontend
 
+## 0.4.0
+
+### Minor Changes
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- 88f4333: Colour timeline dots, and fix the rail they hang from
+
+  Status-update timeline dots were uniformly grey, so the rail carried no
+  information. They are now toned:
+
+  - **Maintenance** dots take the update's own status. Maintenance has no severity,
+    so its lifecycle is the one coloured dimension and nothing competes with it.
+  - **Incident** dots take the incident's SEVERITY, keeping status on a neutral
+    pill. Incidents carry both an urgency and a lifecycle, and `status-tone.ts`
+    gives the hue to the urgency - colouring both would put two competing scales on
+    one row.
+  - **Public status pages** now tone the dot to match the status label already
+    rendered beside it.
+
+  An update that changes nothing stays neutral, so a coloured dot always means "the
+  status moved here".
+
+  Also fixes the rail itself: it anchored its left EDGE at `left-4`, putting its
+  centre at 16.25px while every dot centres at 16px, so each dot sat a hair off the
+  line. The rail is now centred on the same axis, and a new exported `TimelineDot`
+  owns the positioning so the four separate copies of that maths cannot diverge
+  again.
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+  - @checkstack/auth-frontend@0.16.0
+  - @checkstack/common@0.24.0
+  - @checkstack/tracestream-common@0.1.2
+  - @checkstack/logstream-common@0.4.2
+  - @checkstack/ui@1.31.0
+  - @checkstack/catalog-frontend@0.22.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/healthcheck-frontend@0.39.0
+  - @checkstack/telemetry-frontend@0.2.0
+  - @checkstack/telemetry-common@0.2.0
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/signal-common@0.3.2
+
 ## 0.3.2
 
 ### Patch Changes
diff --git a/core/logstream-frontend/package.json b/core/logstream-frontend/package.json
index ec6322983..e0a1167aa 100644
--- a/core/logstream-frontend/package.json
+++ b/core/logstream-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/logstream-frontend",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "description": "Log stream management and viewer UI",
   "author": "Checkstack contributors",
   "license": "Elastic-2.0",
diff --git a/core/maintenance-backend/CHANGELOG.md b/core/maintenance-backend/CHANGELOG.md
index 7202b96e9..1f9bd8fe9 100644
--- a/core/maintenance-backend/CHANGELOG.md
+++ b/core/maintenance-backend/CHANGELOG.md
@@ -1,5 +1,114 @@
 # @checkstack/maintenance-backend
 
+## 1.12.0
+
+### Minor Changes
+
+- 88f4333: Include the window and description in maintenance notifications
+
+  A maintenance notification said only `Maintenance "<title>" has been scheduled`,
+  which told a subscriber nothing about WHAT was planned or WHEN - every recipient
+  had to open the app to learn anything at all.
+
+  The body now carries the scheduled window and the maintenance description, both
+  of which the operator had already written.
+
+  The window renders in **UTC with an explicit suffix**: the notification pipeline
+  has no per-recipient timezone, so a server-local time would be silently wrong for
+  most subscribers and an unlabelled one would be unfalsifiable. The description is
+  normalised through the same sanitiser as update messages, so authored markdown
+  survives while control characters and blank-line padding do not.
+
+- 88f4333: Resolve `#` mentions on public status pages, and check viewability in the admin UI
+
+  Cross-entity mentions previously resolved only in the admin UI, and did so
+  without asking whether the reader could actually open the target. Public
+  surfaces resolved nothing at all. Three changes, one per delivery context.
+
+  **The admin UI now checks viewability.** `useMentionResolution({ documents })`
+  collects the references a page is about to render and asks each owning plugin -
+  in ONE batched request - which of them this viewer may read. A mention to a
+  deleted or unreadable record now renders as plain text instead of a link to a
+  not-found page or an access gate. Backed by new `resolveIncidentRefs` /
+  `resolveMaintenanceRefs` procedures, which return ids only (so an unreadable
+  record is indistinguishable from a deleted one) and carry the same `listKey`
+  read post-filter as their list procedures. They are deliberately not a filter
+  over the authoring search list, which hides resolved incidents and would
+  silently downgrade valid references.
+
+  **Public status pages now resolve mentions.** A reference becomes a link to the
+  target's public detail page when - and only when - the same page publishes that
+  target, which is exactly the anti-enumeration gate the detail pages already
+  apply. So an operator writing "caused by #Database upgrade" in a public update
+  gets a working link, while a mention of an internal-only incident stays plain
+  text rather than becoming a link that confirms it exists. Widgets opt in by
+  declaring a `mentionType`, so the status-page packages take no dependency on any
+  domain plugin.
+
+  **BREAKING CHANGE (behavioural, no API change):** the in-app public status page
+  at `/statuspage/view/<slug>` now builds detail-page hrefs. Previously it passed
+  none, so incident and maintenance titles rendered as plain text there while the
+  same page on a custom domain linked them. Both now behave identically.
+
+  **Notification bodies no longer leak the internal scheme.** `checkstack:` is
+  meaningless outside a Checkstack renderer, and channels leaked it differently:
+  the email sanitiser stripped the href and left a dead anchor, while Slack's
+  mrkdwn emitted `<checkstack:maintenance/9f1c-abc|Database upgrade>` straight to
+  the recipient (Discord, Telegram and Teams render markdown natively and would
+  have passed it through too). `sanitizeUpdateMessage` now flattens every mention
+  to its label before the body reaches any channel, so no channel has to know the
+  scheme exists. Flattening also happens before the length bound, so the excerpt
+  budget is spent on visible text rather than on an internal URI.
+
+### Patch Changes
+
+- 88f4333: Show command-palette actions to team-scoped users
+
+  The palette filtered commands against the caller's GLOBAL access rules only, so a
+  user whose team holds a create-capability grant - but who holds no global
+  `incident.incident.manage` / `maintenance.maintenance.manage` rule - never saw
+  "Create Incident" or "Create Maintenance", nor their keyboard shortcuts. The
+  palette hid the actions from exactly the people authorized to run them.
+
+  Commands can now declare a `manageCapability` (mirroring the gate routes and nav
+  already use). `filterByAccessRules` shows an item when the caller holds the
+  global rules OR can create/manage the declared type through a team grant, and the
+  command backend resolves that per request via `hasAnyTypeGrant` (with
+  `includeCreator`, so a team member who may CREATE the type qualifies before
+  owning an instance). It fails closed: an auth error leaves pure global gating.
+  The incident and maintenance commands declare their types.
+
+  `useGlobalShortcuts` no longer takes `userAccessRules` and no longer re-checks
+  access: the server-filtered list is authoritative. That re-check tested the
+  global rules only and would have dropped team-scoped users' shortcuts - both call
+  sites already defeated it by passing `["*"]`.
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+  - @checkstack/common@0.24.0
+  - @checkstack/auth-common@0.17.0
+  - @checkstack/status-page-common@0.7.0
+  - @checkstack/maintenance-common@1.11.0
+  - @checkstack/automation-common@0.10.3
+  - @checkstack/command-backend@0.3.0
+  - @checkstack/status-page-backend@0.7.0
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/ai-backend@0.11.5
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/automation-backend@0.11.9
+  - @checkstack/ai-common@0.6.8
+  - @checkstack/cache-api@0.3.21
+  - @checkstack/catalog-backend@1.10.2
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/signal-common@0.3.2
+  - @checkstack/cache-utils@0.3.2
+
 ## 1.11.6
 
 ### Patch Changes
diff --git a/core/maintenance-backend/package.json b/core/maintenance-backend/package.json
index 73ee74ea9..cb13cec00 100644
--- a/core/maintenance-backend/package.json
+++ b/core/maintenance-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/maintenance-backend",
-  "version": "1.11.6",
+  "version": "1.12.0",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/maintenance-common/CHANGELOG.md b/core/maintenance-common/CHANGELOG.md
index a3e7cf594..18e7203ec 100644
--- a/core/maintenance-common/CHANGELOG.md
+++ b/core/maintenance-common/CHANGELOG.md
@@ -1,5 +1,101 @@
 # @checkstack/maintenance-common
 
+## 1.11.0
+
+### Minor Changes
+
+- 88f4333: Resolve `#` mentions on public status pages, and check viewability in the admin UI
+
+  Cross-entity mentions previously resolved only in the admin UI, and did so
+  without asking whether the reader could actually open the target. Public
+  surfaces resolved nothing at all. Three changes, one per delivery context.
+
+  **The admin UI now checks viewability.** `useMentionResolution({ documents })`
+  collects the references a page is about to render and asks each owning plugin -
+  in ONE batched request - which of them this viewer may read. A mention to a
+  deleted or unreadable record now renders as plain text instead of a link to a
+  not-found page or an access gate. Backed by new `resolveIncidentRefs` /
+  `resolveMaintenanceRefs` procedures, which return ids only (so an unreadable
+  record is indistinguishable from a deleted one) and carry the same `listKey`
+  read post-filter as their list procedures. They are deliberately not a filter
+  over the authoring search list, which hides resolved incidents and would
+  silently downgrade valid references.
+
+  **Public status pages now resolve mentions.** A reference becomes a link to the
+  target's public detail page when - and only when - the same page publishes that
+  target, which is exactly the anti-enumeration gate the detail pages already
+  apply. So an operator writing "caused by #Database upgrade" in a public update
+  gets a working link, while a mention of an internal-only incident stays plain
+  text rather than becoming a link that confirms it exists. Widgets opt in by
+  declaring a `mentionType`, so the status-page packages take no dependency on any
+  domain plugin.
+
+  **BREAKING CHANGE (behavioural, no API change):** the in-app public status page
+  at `/statuspage/view/<slug>` now builds detail-page hrefs. Previously it passed
+  none, so incident and maintenance titles rendered as plain text there while the
+  same page on a custom domain linked them. Both now behave identically.
+
+  **Notification bodies no longer leak the internal scheme.** `checkstack:` is
+  meaningless outside a Checkstack renderer, and channels leaked it differently:
+  the email sanitiser stripped the href and left a dead anchor, while Slack's
+  mrkdwn emitted `<checkstack:maintenance/9f1c-abc|Database upgrade>` straight to
+  the recipient (Discord, Telegram and Teams render markdown natively and would
+  have passed it through too). `sanitizeUpdateMessage` now flattens every mention
+  to its label before the body reaches any channel, so no channel has to know the
+  scheme exists. Flattening also happens before the length bound, so the excerpt
+  budget is spent on visible text rather than on an internal URI.
+
+### Patch Changes
+
+- 1deaac5: Make endpoint authorization self-documenting in the generated API docs
+
+  Every procedure's authorization is now derived from its contract metadata (its
+  `access` rules + `instanceAccess` mode) via a shared mode-descriptor registry and
+  emitted into the OpenAPI spec - both structurally (`x-orpc-meta.authorization`)
+  and as a human `**Authorization.**` sentence folded into the operation
+  description. Previously the docs surfaced only a flat list of global rule ids, so
+  an integrator (an API-key/application principal that CAN hold team grants) never
+  saw the team-grant / per-object dimension, and endpoints gated purely in the
+  handler showed no restriction at all.
+
+  For authorization that no declarative mode can express and is therefore enforced
+  in the handler (a compound OR, a graded verdict, a DB-derived id set), a new
+  optional `accessNote` on the procedure metadata surfaces the real rule in the
+  docs as an explicitly handler-enforced addendum. The note is documentation, not a
+  guarantee: per `.claude/rules/rlac.md` the drift guard for such authz is
+  behavioral tests over an extracted pure decision function, and the note must
+  state exactly what those tests pin.
+
+  Every handler-enforced authorization endpoint now carries such a note so the docs
+  are complete: the team read/scoping and team-management endpoints
+  (`@checkstack/auth-common`), the health-check assignment/history reads
+  (`@checkstack/healthcheck-common`), the audience-graded incident/maintenance
+  reads (`@checkstack/incident-common`, `@checkstack/maintenance-common`), status
+  -page publish's bound-resource check (`@checkstack/status-page-common`), the
+  stream `setSystemLinks` readable-additions check
+  (`@checkstack/{metricstream,tracestream,logstream}-common`), and the automation
+  `runAs` escalation guard (`@checkstack/automation-common`). These are
+  metadata-only additions - no runtime behavior changed. The notes describe the
+  rule for API-doc readers only; the drift guard is behavioral tests over the
+  check's decision function (per `.claude/rules/rlac.md`), so the notes name no
+  internal test files.
+
+  The API docs viewer (`@checkstack/api-docs-frontend`) now renders each
+  operation's description as Markdown, so the `**Authorization.**` block (and any
+  inline `code`) formats correctly instead of showing raw markdown.
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/signal-common@0.3.2
+
 ## 1.10.5
 
 ### Patch Changes
diff --git a/core/maintenance-common/package.json b/core/maintenance-common/package.json
index 4a24643de..da07e0829 100644
--- a/core/maintenance-common/package.json
+++ b/core/maintenance-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/maintenance-common",
-  "version": "1.10.5",
+  "version": "1.11.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/maintenance-frontend/CHANGELOG.md b/core/maintenance-frontend/CHANGELOG.md
index 15e9c3357..083212637 100644
--- a/core/maintenance-frontend/CHANGELOG.md
+++ b/core/maintenance-frontend/CHANGELOG.md
@@ -1,5 +1,217 @@
 # @checkstack/maintenance-frontend
 
+## 0.18.0
+
+### Minor Changes
+
+- 88f4333: Report an incident or schedule maintenance straight from a system
+
+  The system overview showed a system's incidents and maintenances but offered no
+  way to open one for it - you had to navigate to the incidents/maintenance page
+  and re-pick the system by hand.
+
+  Both panels now carry an action ("Report incident" / "Schedule maintenance")
+  that deep-links to the editor with the system already selected, via
+  `?action=create&systemId=<id>`. The pages consume both params and clear them, so
+  a refresh doesn't reopen the dialog.
+
+  The action is gated on `useProcedureAccess` over the CREATE procedure's
+  contract, so it appears for a global manager AND for someone who can manage this
+  system through a team (the `create.parent` gate) - exactly who the backend
+  accepts. Gating on the bare global rule would have hidden it from the
+  team-scoped users it is most useful to.
+
+  The editors' unsaved-changes baseline accounts for the pre-selection, so opening
+  a pre-scoped form and closing it again doesn't falsely prompt to discard.
+
+- 88f4333: Link incidents and maintenances with `#` mentions
+
+  Typing `#` in a markdown field now opens a picker over every mentionable record
+  and inserts a reference. Referencing another record previously meant pasting a
+  URL, which cannot be right everywhere: an admin URL is meaningless on a public
+  status page, a status-page URL is meaningless in the admin UI, and neither works
+  in an email.
+
+  A mention therefore stores WHAT it points at, never where:
+  `[Database upgrade](checkstack:maintenance/<id>)`. That is an ordinary markdown
+  link - readable in the raw source, parsed unchanged by existing tooling - and
+  only the href is resolved per render context.
+
+  Resolution may REFUSE: a resolver returning nothing renders the label as plain
+  text rather than a link. That is a confidentiality property, not a nicety - an
+  internal-only incident referenced from a public status update must not become a
+  link that confirms it exists. A renderer given no resolver links nothing.
+
+  Incident and maintenance detail pages gained a **Referenced items** section,
+  derived by scanning the authored markdown on each render. Nothing is stored
+  twice, so an edit that drops a reference drops it from the list too.
+
+  The platform owns the contract (`registerMentionRoutes` / `setMentionSearch` in
+  `@checkstack/frontend-api`); each owning plugin registers its own type, so no
+  plugin imports another. Search only ever offers records the caller may read.
+
+  Scope: resolution is wired for the admin UI. Public status pages and notification
+  bodies do not resolve mentions yet, so a mention renders there as plain text -
+  the safe default above, not a broken link.
+
+  Precisely: the admin resolver maps a well-formed reference to a route WITHOUT
+  checking that the target still exists or that this viewer may read it, so a
+  mention to a deleted or unreadable record links to a not-found or an access gate.
+  That is deliberate - gating on the provider's fetched list would silently
+  downgrade valid references to plain text (the incident search excludes resolved
+  incidents by default), and silently dropping a valid link is worse than one that
+  lands on a gate the backend already enforces. The confidentiality property is
+  carried by the public renderers, which resolve nothing.
+
+- 88f4333: Markdown editor with a live preview tab and formatting toolbar
+
+  Markdown fields were plain textareas with a "Markdown supported" hint, so an
+  author found out how their text rendered only after saving - or, for a
+  notification, after it had already been delivered.
+
+  New `MarkdownEditor` in `@checkstack/ui`: Write / Preview tabs plus a toolbar
+  (bold, italic, link, code, lists, quote). Adopted by the incident and maintenance
+  update forms and descriptions, and the announcement message.
+
+  The preview renders through `MarkdownBlock` - the same component, remark/rehype
+  chain and sanitiser used for the saved content. A second renderer here would be
+  free to drift, and a preview that disagrees with the real render is worse than no
+  preview.
+
+  Toolbar marks toggle rather than only adding, and mark lengths are matched
+  exactly so italic (`*`) never claims bold's (`**`) delimiters and silently
+  downgrades an author's emphasis.
+
+  Note for adopters: `MarkdownEditor` wraps its textarea, so `required` on it does
+  nothing - gate submission explicitly instead.
+
+- 88f4333: Resolve `#` mentions on public status pages, and check viewability in the admin UI
+
+  Cross-entity mentions previously resolved only in the admin UI, and did so
+  without asking whether the reader could actually open the target. Public
+  surfaces resolved nothing at all. Three changes, one per delivery context.
+
+  **The admin UI now checks viewability.** `useMentionResolution({ documents })`
+  collects the references a page is about to render and asks each owning plugin -
+  in ONE batched request - which of them this viewer may read. A mention to a
+  deleted or unreadable record now renders as plain text instead of a link to a
+  not-found page or an access gate. Backed by new `resolveIncidentRefs` /
+  `resolveMaintenanceRefs` procedures, which return ids only (so an unreadable
+  record is indistinguishable from a deleted one) and carry the same `listKey`
+  read post-filter as their list procedures. They are deliberately not a filter
+  over the authoring search list, which hides resolved incidents and would
+  silently downgrade valid references.
+
+  **Public status pages now resolve mentions.** A reference becomes a link to the
+  target's public detail page when - and only when - the same page publishes that
+  target, which is exactly the anti-enumeration gate the detail pages already
+  apply. So an operator writing "caused by #Database upgrade" in a public update
+  gets a working link, while a mention of an internal-only incident stays plain
+  text rather than becoming a link that confirms it exists. Widgets opt in by
+  declaring a `mentionType`, so the status-page packages take no dependency on any
+  domain plugin.
+
+  **BREAKING CHANGE (behavioural, no API change):** the in-app public status page
+  at `/statuspage/view/<slug>` now builds detail-page hrefs. Previously it passed
+  none, so incident and maintenance titles rendered as plain text there while the
+  same page on a custom domain linked them. Both now behave identically.
+
+  **Notification bodies no longer leak the internal scheme.** `checkstack:` is
+  meaningless outside a Checkstack renderer, and channels leaked it differently:
+  the email sanitiser stripped the href and left a dead anchor, while Slack's
+  mrkdwn emitted `<checkstack:maintenance/9f1c-abc|Database upgrade>` straight to
+  the recipient (Discord, Telegram and Teams render markdown natively and would
+  have passed it through too). `sanitizeUpdateMessage` now flattens every mention
+  to its label before the body reaches any channel, so no channel has to know the
+  scheme exists. Flattening also happens before the length bound, so the excerpt
+  budget is spent on visible text rather than on an internal URI.
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+- 88f4333: Name the single maintenance or incident on the system overview cards
+
+  When a system has exactly one leading maintenance window (or one active
+  incident), its card now shows the TITLE, linked to the record, instead of the
+  count. A bare "1" told the reader nothing they could not already infer from the
+  card being there, and forced a second click to learn anything.
+
+  With two or more there is no single thing to name, so the count remains.
+
+- 88f4333: Colour timeline dots, and fix the rail they hang from
+
+  Status-update timeline dots were uniformly grey, so the rail carried no
+  information. They are now toned:
+
+  - **Maintenance** dots take the update's own status. Maintenance has no severity,
+    so its lifecycle is the one coloured dimension and nothing competes with it.
+  - **Incident** dots take the incident's SEVERITY, keeping status on a neutral
+    pill. Incidents carry both an urgency and a lifecycle, and `status-tone.ts`
+    gives the hue to the urgency - colouring both would put two competing scales on
+    one row.
+  - **Public status pages** now tone the dot to match the status label already
+    rendered beside it.
+
+  An update that changes nothing stays neutral, so a coloured dot always means "the
+  status moved here".
+
+  Also fixes the rail itself: it anchored its left EDGE at `left-4`, putting its
+  centre at 16.25px while every dot centres at 16px, so each dot sat a hair off the
+  line. The rail is now centred on the same axis, and a new exported `TimelineDot`
+  owns the positioning so the four separate copies of that maths cannot diverge
+  again.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+  - @checkstack/auth-frontend@0.16.0
+  - @checkstack/common@0.24.0
+  - @checkstack/maintenance-common@1.11.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/dashboard-frontend@0.12.0
+  - @checkstack/notification-frontend@0.10.0
+  - @checkstack/tips-frontend@0.5.6
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/signal-frontend@0.3.8
+
 ## 0.17.0
 
 ### Minor Changes
diff --git a/core/maintenance-frontend/package.json b/core/maintenance-frontend/package.json
index 69fef1134..9fc95c44a 100644
--- a/core/maintenance-frontend/package.json
+++ b/core/maintenance-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/maintenance-frontend",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/metricstream-backend/CHANGELOG.md b/core/metricstream-backend/CHANGELOG.md
index 3f352ddc4..7b0976d49 100644
--- a/core/metricstream-backend/CHANGELOG.md
+++ b/core/metricstream-backend/CHANGELOG.md
@@ -1,5 +1,37 @@
 # @checkstack/metricstream-backend
 
+## 0.2.2
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/auth-common@0.17.0
+  - @checkstack/metricstream-common@0.2.2
+  - @checkstack/satellite-backend@0.10.0
+  - @checkstack/ai-backend@0.11.5
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/telemetry-common@0.2.0
+  - @checkstack/telemetry-backend@0.2.0
+  - @checkstack/secrets-backend@0.3.10
+  - @checkstack/cache-api@0.3.21
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/queue-api@0.4.1
+  - @checkstack/secrets-common@0.3.4
+  - @checkstack/signal-common@0.3.2
+  - @checkstack/cache-utils@0.3.2
+  - @checkstack/ingest-utils@0.2.1
+
 ## 0.2.1
 
 ### Patch Changes
diff --git a/core/metricstream-backend/package.json b/core/metricstream-backend/package.json
index f16fe7d72..e94b50517 100644
--- a/core/metricstream-backend/package.json
+++ b/core/metricstream-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/metricstream-backend",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Metric stream ingestion, storage, scraping and health integration",
   "author": "Checkstack contributors",
   "license": "Elastic-2.0",
diff --git a/core/metricstream-common/CHANGELOG.md b/core/metricstream-common/CHANGELOG.md
index 618ba7eec..b1c23886b 100644
--- a/core/metricstream-common/CHANGELOG.md
+++ b/core/metricstream-common/CHANGELOG.md
@@ -1,5 +1,58 @@
 # @checkstack/metricstream-common
 
+## 0.2.2
+
+### Patch Changes
+
+- 1deaac5: Make endpoint authorization self-documenting in the generated API docs
+
+  Every procedure's authorization is now derived from its contract metadata (its
+  `access` rules + `instanceAccess` mode) via a shared mode-descriptor registry and
+  emitted into the OpenAPI spec - both structurally (`x-orpc-meta.authorization`)
+  and as a human `**Authorization.**` sentence folded into the operation
+  description. Previously the docs surfaced only a flat list of global rule ids, so
+  an integrator (an API-key/application principal that CAN hold team grants) never
+  saw the team-grant / per-object dimension, and endpoints gated purely in the
+  handler showed no restriction at all.
+
+  For authorization that no declarative mode can express and is therefore enforced
+  in the handler (a compound OR, a graded verdict, a DB-derived id set), a new
+  optional `accessNote` on the procedure metadata surfaces the real rule in the
+  docs as an explicitly handler-enforced addendum. The note is documentation, not a
+  guarantee: per `.claude/rules/rlac.md` the drift guard for such authz is
+  behavioral tests over an extracted pure decision function, and the note must
+  state exactly what those tests pin.
+
+  Every handler-enforced authorization endpoint now carries such a note so the docs
+  are complete: the team read/scoping and team-management endpoints
+  (`@checkstack/auth-common`), the health-check assignment/history reads
+  (`@checkstack/healthcheck-common`), the audience-graded incident/maintenance
+  reads (`@checkstack/incident-common`, `@checkstack/maintenance-common`), status
+  -page publish's bound-resource check (`@checkstack/status-page-common`), the
+  stream `setSystemLinks` readable-additions check
+  (`@checkstack/{metricstream,tracestream,logstream}-common`), and the automation
+  `runAs` escalation guard (`@checkstack/automation-common`). These are
+  metadata-only additions - no runtime behavior changed. The notes describe the
+  rule for API-doc readers only; the drift guard is behavioral tests over the
+  check's decision function (per `.claude/rules/rlac.md`), so the notes name no
+  internal test files.
+
+  The API docs viewer (`@checkstack/api-docs-frontend`) now renders each
+  operation's description as Markdown, so the `**Authorization.**` block (and any
+  inline `code`) formats correctly instead of showing raw markdown.
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/telemetry-common@0.2.0
+  - @checkstack/signal-common@0.3.2
+  - @checkstack/otlp-wire@0.1.1
+
 ## 0.2.1
 
 ### Patch Changes
diff --git a/core/metricstream-common/package.json b/core/metricstream-common/package.json
index 6593387d0..69e133e45 100644
--- a/core/metricstream-common/package.json
+++ b/core/metricstream-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/metricstream-common",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Metric stream contracts, schemas, access rules and signals",
   "author": "Checkstack contributors",
   "license": "Elastic-2.0",
diff --git a/core/metricstream-frontend/CHANGELOG.md b/core/metricstream-frontend/CHANGELOG.md
index 2c29d9c77..7d21fbce2 100644
--- a/core/metricstream-frontend/CHANGELOG.md
+++ b/core/metricstream-frontend/CHANGELOG.md
@@ -1,5 +1,91 @@
 # @checkstack/metricstream-frontend
 
+## 0.3.0
+
+### Minor Changes
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- 88f4333: Colour timeline dots, and fix the rail they hang from
+
+  Status-update timeline dots were uniformly grey, so the rail carried no
+  information. They are now toned:
+
+  - **Maintenance** dots take the update's own status. Maintenance has no severity,
+    so its lifecycle is the one coloured dimension and nothing competes with it.
+  - **Incident** dots take the incident's SEVERITY, keeping status on a neutral
+    pill. Incidents carry both an urgency and a lifecycle, and `status-tone.ts`
+    gives the hue to the urgency - colouring both would put two competing scales on
+    one row.
+  - **Public status pages** now tone the dot to match the status label already
+    rendered beside it.
+
+  An update that changes nothing stays neutral, so a coloured dot always means "the
+  status moved here".
+
+  Also fixes the rail itself: it anchored its left EDGE at `left-4`, putting its
+  centre at 16.25px while every dot centres at 16px, so each dot sat a hair off the
+  line. The rail is now centred on the same axis, and a new exported `TimelineDot`
+  owns the positioning so the four separate copies of that maths cannot diverge
+  again.
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+  - @checkstack/auth-frontend@0.16.0
+  - @checkstack/common@0.24.0
+  - @checkstack/metricstream-common@0.2.2
+  - @checkstack/tracestream-common@0.1.2
+  - @checkstack/ui@1.31.0
+  - @checkstack/catalog-frontend@0.22.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/healthcheck-frontend@0.39.0
+  - @checkstack/telemetry-frontend@0.2.0
+  - @checkstack/telemetry-common@0.2.0
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/signal-common@0.3.2
+
 ## 0.2.2
 
 ### Patch Changes
diff --git a/core/metricstream-frontend/package.json b/core/metricstream-frontend/package.json
index fe041bc65..4097328e9 100644
--- a/core/metricstream-frontend/package.json
+++ b/core/metricstream-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/metricstream-frontend",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "description": "Metric stream management and viewer UI",
   "author": "Checkstack contributors",
   "license": "Elastic-2.0",
diff --git a/core/notification-backend/CHANGELOG.md b/core/notification-backend/CHANGELOG.md
index cd06ccbbe..1d594f0b9 100644
--- a/core/notification-backend/CHANGELOG.md
+++ b/core/notification-backend/CHANGELOG.md
@@ -1,5 +1,28 @@
 # @checkstack/notification-backend
 
+## 1.8.7
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/auth-common@0.17.0
+  - @checkstack/command-backend@0.3.0
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/auth-backend@0.14.0
+  - @checkstack/automation-backend@0.11.9
+  - @checkstack/cache-api@0.3.21
+  - @checkstack/queue-api@0.4.1
+  - @checkstack/signal-common@0.3.2
+  - @checkstack/cache-utils@0.3.2
+
 ## 1.8.6
 
 ### Patch Changes
diff --git a/core/notification-backend/package.json b/core/notification-backend/package.json
index f7e41777e..c14ab674a 100644
--- a/core/notification-backend/package.json
+++ b/core/notification-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/notification-backend",
-  "version": "1.8.6",
+  "version": "1.8.7",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/notification-common/CHANGELOG.md b/core/notification-common/CHANGELOG.md
index 0c1b759d1..1f4b53815 100644
--- a/core/notification-common/CHANGELOG.md
+++ b/core/notification-common/CHANGELOG.md
@@ -1,5 +1,61 @@
 # @checkstack/notification-common
 
+## 1.9.0
+
+### Minor Changes
+
+- 88f4333: Resolve `#` mentions on public status pages, and check viewability in the admin UI
+
+  Cross-entity mentions previously resolved only in the admin UI, and did so
+  without asking whether the reader could actually open the target. Public
+  surfaces resolved nothing at all. Three changes, one per delivery context.
+
+  **The admin UI now checks viewability.** `useMentionResolution({ documents })`
+  collects the references a page is about to render and asks each owning plugin -
+  in ONE batched request - which of them this viewer may read. A mention to a
+  deleted or unreadable record now renders as plain text instead of a link to a
+  not-found page or an access gate. Backed by new `resolveIncidentRefs` /
+  `resolveMaintenanceRefs` procedures, which return ids only (so an unreadable
+  record is indistinguishable from a deleted one) and carry the same `listKey`
+  read post-filter as their list procedures. They are deliberately not a filter
+  over the authoring search list, which hides resolved incidents and would
+  silently downgrade valid references.
+
+  **Public status pages now resolve mentions.** A reference becomes a link to the
+  target's public detail page when - and only when - the same page publishes that
+  target, which is exactly the anti-enumeration gate the detail pages already
+  apply. So an operator writing "caused by #Database upgrade" in a public update
+  gets a working link, while a mention of an internal-only incident stays plain
+  text rather than becoming a link that confirms it exists. Widgets opt in by
+  declaring a `mentionType`, so the status-page packages take no dependency on any
+  domain plugin.
+
+  **BREAKING CHANGE (behavioural, no API change):** the in-app public status page
+  at `/statuspage/view/<slug>` now builds detail-page hrefs. Previously it passed
+  none, so incident and maintenance titles rendered as plain text there while the
+  same page on a custom domain linked them. Both now behave identically.
+
+  **Notification bodies no longer leak the internal scheme.** `checkstack:` is
+  meaningless outside a Checkstack renderer, and channels leaked it differently:
+  the email sanitiser stripped the href and left a dead anchor, while Slack's
+  mrkdwn emitted `<checkstack:maintenance/9f1c-abc|Database upgrade>` straight to
+  the recipient (Discord, Telegram and Teams render markdown natively and would
+  have passed it through too). `sanitizeUpdateMessage` now flattens every mention
+  to its label before the body reaches any channel, so no channel has to know the
+  scheme exists. Flattening also happens before the length bound, so the excerpt
+  budget is spent on visible text rather than on an internal URI.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/signal-common@0.3.2
+
 ## 1.8.0
 
 ### Minor Changes
diff --git a/core/notification-common/package.json b/core/notification-common/package.json
index 2e1d5a4af..8835da527 100644
--- a/core/notification-common/package.json
+++ b/core/notification-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/notification-common",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/notification-frontend/CHANGELOG.md b/core/notification-frontend/CHANGELOG.md
index b4bb81af6..e9ab9d199 100644
--- a/core/notification-frontend/CHANGELOG.md
+++ b/core/notification-frontend/CHANGELOG.md
@@ -1,5 +1,60 @@
 # @checkstack/notification-frontend
 
+## 0.10.0
+
+### Minor Changes
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+  - @checkstack/auth-frontend@0.16.0
+  - @checkstack/common@0.24.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/tips-frontend@0.5.6
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/signal-frontend@0.3.8
+
 ## 0.9.7
 
 ### Patch Changes
diff --git a/core/notification-frontend/package.json b/core/notification-frontend/package.json
index 88c8bc208..d6fbe1f9e 100644
--- a/core/notification-frontend/package.json
+++ b/core/notification-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/notification-frontend",
-  "version": "0.9.7",
+  "version": "0.10.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/pluginmanager-common/CHANGELOG.md b/core/pluginmanager-common/CHANGELOG.md
index c9a66cf0c..e4cf18ddb 100644
--- a/core/pluginmanager-common/CHANGELOG.md
+++ b/core/pluginmanager-common/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @checkstack/pluginmanager-common
 
+## 0.2.18
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+
 ## 0.2.17
 
 ### Patch Changes
diff --git a/core/pluginmanager-common/package.json b/core/pluginmanager-common/package.json
index bb647c37c..67ef4a10d 100644
--- a/core/pluginmanager-common/package.json
+++ b/core/pluginmanager-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/pluginmanager-common",
-  "version": "0.2.17",
+  "version": "0.2.18",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/pluginmanager-frontend/CHANGELOG.md b/core/pluginmanager-frontend/CHANGELOG.md
index 5d34cf38b..8d210f914 100644
--- a/core/pluginmanager-frontend/CHANGELOG.md
+++ b/core/pluginmanager-frontend/CHANGELOG.md
@@ -1,5 +1,56 @@
 # @checkstack/pluginmanager-frontend
 
+## 0.7.0
+
+### Minor Changes
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/tips-frontend@0.5.6
+  - @checkstack/pluginmanager-common@0.2.18
+
 ## 0.6.9
 
 ### Patch Changes
diff --git a/core/pluginmanager-frontend/package.json b/core/pluginmanager-frontend/package.json
index 8422cb23b..bea3a9714 100644
--- a/core/pluginmanager-frontend/package.json
+++ b/core/pluginmanager-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/pluginmanager-frontend",
-  "version": "0.6.9",
+  "version": "0.7.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/queue-api/CHANGELOG.md b/core/queue-api/CHANGELOG.md
index 20a7a8bb4..be94e467c 100644
--- a/core/queue-api/CHANGELOG.md
+++ b/core/queue-api/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @checkstack/queue-api
 
+## 0.4.1
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+
 ## 0.4.0
 
 ### Minor Changes
diff --git a/core/queue-api/package.json b/core/queue-api/package.json
index 6795454cb..56e5bb82d 100644
--- a/core/queue-api/package.json
+++ b/core/queue-api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/queue-api",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "license": "Elastic-2.0",
   "checkstack": {
     "type": "tooling"
diff --git a/core/queue-backend/CHANGELOG.md b/core/queue-backend/CHANGELOG.md
index 1f78db535..450e25107 100644
--- a/core/queue-backend/CHANGELOG.md
+++ b/core/queue-backend/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @checkstack/queue-backend
 
+## 0.4.28
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/queue-api@0.4.1
+  - @checkstack/queue-common@0.6.14
+
 ## 0.4.27
 
 ### Patch Changes
diff --git a/core/queue-backend/package.json b/core/queue-backend/package.json
index c8d78f0a5..0aab37414 100644
--- a/core/queue-backend/package.json
+++ b/core/queue-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/queue-backend",
-  "version": "0.4.27",
+  "version": "0.4.28",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/queue-common/CHANGELOG.md b/core/queue-common/CHANGELOG.md
index 742981661..bf1321073 100644
--- a/core/queue-common/CHANGELOG.md
+++ b/core/queue-common/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @checkstack/queue-common
 
+## 0.6.14
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/signal-common@0.3.2
+
 ## 0.6.13
 
 ### Patch Changes
diff --git a/core/queue-common/package.json b/core/queue-common/package.json
index efe7fc754..e8fe93345 100644
--- a/core/queue-common/package.json
+++ b/core/queue-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/queue-common",
-  "version": "0.6.13",
+  "version": "0.6.14",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/queue-frontend/CHANGELOG.md b/core/queue-frontend/CHANGELOG.md
index 88035149d..118a79a5b 100644
--- a/core/queue-frontend/CHANGELOG.md
+++ b/core/queue-frontend/CHANGELOG.md
@@ -1,5 +1,57 @@
 # @checkstack/queue-frontend
 
+## 0.8.0
+
+### Minor Changes
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/infrastructure-common@0.3.24
+  - @checkstack/queue-common@0.6.14
+  - @checkstack/signal-frontend@0.3.8
+
 ## 0.7.9
 
 ### Patch Changes
diff --git a/core/queue-frontend/package.json b/core/queue-frontend/package.json
index d396d1f19..294777b9d 100644
--- a/core/queue-frontend/package.json
+++ b/core/queue-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/queue-frontend",
-  "version": "0.7.9",
+  "version": "0.8.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/release/CHANGELOG.md b/core/release/CHANGELOG.md
index 4173ed32d..b20dec561 100644
--- a/core/release/CHANGELOG.md
+++ b/core/release/CHANGELOG.md
@@ -1,5 +1,33 @@
 # @checkstack/release
 
+## 0.137.0
+
+### Minor Changes
+
+- 88f4333: Clarify the team-access editor and guard against locking yourself out
+
+  Four fixes to the "Who can change this" editor and the team member picker, from
+  user feedback:
+
+  - **The "Manage" checkbox read as "manage the team".** It sets the selected
+    team's grant on THIS resource, but the label plus a gear icon suggested it
+    would open the team itself. It is now labelled **"Can edit"** (with no gear),
+    naming its effect on the resource.
+  - **The team name is now a link** to that team (`/teams?team=<id>`), which opens
+    its members dialog directly. That gives "take me to the team" its own
+    affordance instead of overloading the checkbox. The Teams page consumes the
+    `team` query param once and then clears it.
+  - **Revoking your own team's access now asks first.** A team-scoped user could
+    remove (or downgrade) their own team's only edit grant and afterwards be unable
+    to change the resource _or_ restore the permission. That case now shows a
+    confirmation explaining the consequence. Global `auth.teams.manage` admins are
+    not warned - they can always restore it. The decision is a pure, unit-tested
+    `isSelfRevokingChange`.
+  - **The add-member field explained.** Its placeholder ("Add a user by name or
+    email") and new helper text state that it adds a NEW member from the whole
+    directory rather than filtering current members, and that a user is only
+    findable after their first sign-in (SSO/LDAP accounts materialise on login).
+
 ## 0.136.0
 
 ### Minor Changes
diff --git a/core/release/package.json b/core/release/package.json
index 0c7f62713..ab9105cb4 100644
--- a/core/release/package.json
+++ b/core/release/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/release",
-  "version": "0.136.0",
+  "version": "0.137.0",
   "license": "Elastic-2.0",
   "private": true,
   "description": "Release version tracker for Checkstack Docker builds"
diff --git a/core/satellite-backend/CHANGELOG.md b/core/satellite-backend/CHANGELOG.md
index 48e21d679..8e7dc5815 100644
--- a/core/satellite-backend/CHANGELOG.md
+++ b/core/satellite-backend/CHANGELOG.md
@@ -1,5 +1,117 @@
 # @checkstack/satellite-backend
 
+## 0.10.0
+
+### Minor Changes
+
+- 88f4333: Per-satellite offline threshold, connectivity notifications, and stop satellite-only checks going silent
+
+  **A satellite going offline was invisible, and so were its checks.** Three
+  related changes:
+
+  **Per-satellite offline threshold.** The 45-second global constant is now a
+  per-satellite override (**Offline after**, 2 minutes to 24 hours), because
+  tolerance is a property of the link, not of the platform: a satellite on a flaky
+  uplink needs grace that should not be forced on every other satellite. The
+  threshold is carried on every row read by `computeStatus`, so the entity read,
+  the admin list and the heartbeat monitor cannot disagree about the same
+  satellite. Additive, nullable column - existing satellites keep the default.
+
+  **Connectivity notifications.** Satellites are now a notification target with a
+  **Satellite connectivity** subscription: a warning when a satellite stops
+  heartbeating, informational when it returns. A reconnect only notifies if the
+  satellite was actually offline, so a redeploy is not an event. (The same
+  transitions remain available as `satellite.heartbeat_lost` / `.connected`
+  automation triggers for anyone wanting different routing.)
+
+  **Satellite-only checks no longer go silent.** BUG FIX: a check with
+  `includeLocal: false` whose satellites were all offline recorded NOTHING, so it
+  displayed its last known status indefinitely - a dead probe was indistinguishable
+  from a passing one. The core now records a `degraded` run with a clear message.
+  Degraded rather than unhealthy because the target may be fine; what failed is our
+  ability to observe it. Liveness that cannot be resolved is treated as "executing"
+  so a transient lookup failure cannot mark the whole fleet degraded at once.
+
+  Checks also surface staleness: a last run older than five intervals (minimum ten
+  minutes) is highlighted, so an ageing status is visible even with no run to
+  explain it. Paused checks are never stale, and neither is a RETIRED slice - one
+  whose environment was removed or whose satellite was unassigned - because
+  warning about something you retired on purpose trains operators to ignore the
+  badge.
+
+  The unobservable run does NOT notify subscribers. One offline satellite degrades
+  every check assigned to it in the same tick, and `healthy -> degraded` is an
+  escalation, so notifying per check would turn a single root cause into one alert
+  per check. The satellite's own connectivity subscription reports the cause once;
+  the runs are still recorded, so health and the UI stay honest.
+
+  Satellite liveness is cached on the shared platform cache with a 5s TTL. The
+  executor asks per tick of every satellite-only check and the read is a full
+  scan, so the uncached version scaled with the number of such checks. The TTL is
+  well below the smallest offline threshold the schema allows, so a cached answer
+  can lag a transition by one tick but never span one.
+
+  Corrects the user guide, which claimed offline satellites produced failed runs -
+  they produced nothing at all.
+
+### Patch Changes
+
+- 88f4333: Cover the features that shipped on logic-only tests
+
+  Inline mentions shipped completely inert while ~90 unit tests passed, because
+  those tests proved the pure functions and nothing proved the render path. Four
+  features carried exactly the same shape of coverage. Each now has a guard that
+  was VERIFIED to fail when the thing it guards is broken.
+
+  - **HTTP proxy.** `fetch({ proxy })` had never run: every test covered the URL
+    we build, the SSRF host we guard and the field contracts, but no test routed a
+    request through an actual proxy. A real proxy server now proves the request
+    arrives there, that credentials are sent, that a 407 is a COMPLETED request
+    (not a transport failure), that an unreachable proxy IS a transport failure,
+    and that an empty templated proxy falls back to a direct connection.
+  - **Status-coloured timeline dots.** The feature was `StatusUpdateTimeline`
+    forwarding a caller's `renderDot`; the colour helpers were tested but the
+    one-line forward was not. Now pinned, including per-item independence and the
+    newest-first ordering a dot renderer must not assume away.
+  - **System custom-field preview.** `SystemPreviewPicker` had no render coverage
+    at all. Now covers the empty case, that the SELECTION is displayed, and that
+    "No system" reports `null` rather than leaking the internal sentinel.
+  - **Per-satellite offline threshold.** `computeStatus` is called from five
+    places and a site that forgets the per-satellite value silently falls back to
+    the global default, so the admin list, the entity read and the monitor
+    disagree about the same satellite. A behavioural drift guard now drives the
+    real reads with a heartbeat stale by the global default but fresh by the
+    satellite's own threshold - and the shorter-threshold direction too.
+
+  Tests only; no runtime behaviour changes.
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/automation-common@0.10.3
+  - @checkstack/command-backend@0.3.0
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/satellite-common@0.12.0
+  - @checkstack/healthcheck-backend@1.23.0
+  - @checkstack/automation-backend@0.11.9
+  - @checkstack/secrets-backend@0.3.10
+  - @checkstack/cache-api@0.3.21
+  - @checkstack/gitops-backend@0.5.28
+  - @checkstack/gitops-common@0.7.5
+  - @checkstack/queue-api@0.4.1
+  - @checkstack/script-packages-backend@0.4.7
+  - @checkstack/script-packages-common@0.4.3
+  - @checkstack/secrets-common@0.3.4
+  - @checkstack/signal-common@0.3.2
+
 ## 0.9.4
 
 ### Patch Changes
diff --git a/core/satellite-backend/package.json b/core/satellite-backend/package.json
index fd31df3d1..ce709530d 100644
--- a/core/satellite-backend/package.json
+++ b/core/satellite-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/satellite-backend",
-  "version": "0.9.4",
+  "version": "0.10.0",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/satellite-common/CHANGELOG.md b/core/satellite-common/CHANGELOG.md
index 02e8c4138..c77bb9efd 100644
--- a/core/satellite-common/CHANGELOG.md
+++ b/core/satellite-common/CHANGELOG.md
@@ -1,5 +1,72 @@
 # @checkstack/satellite-common
 
+## 0.12.0
+
+### Minor Changes
+
+- 88f4333: Per-satellite offline threshold, connectivity notifications, and stop satellite-only checks going silent
+
+  **A satellite going offline was invisible, and so were its checks.** Three
+  related changes:
+
+  **Per-satellite offline threshold.** The 45-second global constant is now a
+  per-satellite override (**Offline after**, 2 minutes to 24 hours), because
+  tolerance is a property of the link, not of the platform: a satellite on a flaky
+  uplink needs grace that should not be forced on every other satellite. The
+  threshold is carried on every row read by `computeStatus`, so the entity read,
+  the admin list and the heartbeat monitor cannot disagree about the same
+  satellite. Additive, nullable column - existing satellites keep the default.
+
+  **Connectivity notifications.** Satellites are now a notification target with a
+  **Satellite connectivity** subscription: a warning when a satellite stops
+  heartbeating, informational when it returns. A reconnect only notifies if the
+  satellite was actually offline, so a redeploy is not an event. (The same
+  transitions remain available as `satellite.heartbeat_lost` / `.connected`
+  automation triggers for anyone wanting different routing.)
+
+  **Satellite-only checks no longer go silent.** BUG FIX: a check with
+  `includeLocal: false` whose satellites were all offline recorded NOTHING, so it
+  displayed its last known status indefinitely - a dead probe was indistinguishable
+  from a passing one. The core now records a `degraded` run with a clear message.
+  Degraded rather than unhealthy because the target may be fine; what failed is our
+  ability to observe it. Liveness that cannot be resolved is treated as "executing"
+  so a transient lookup failure cannot mark the whole fleet degraded at once.
+
+  Checks also surface staleness: a last run older than five intervals (minimum ten
+  minutes) is highlighted, so an ageing status is visible even with no run to
+  explain it. Paused checks are never stale, and neither is a RETIRED slice - one
+  whose environment was removed or whose satellite was unassigned - because
+  warning about something you retired on purpose trains operators to ignore the
+  badge.
+
+  The unobservable run does NOT notify subscribers. One offline satellite degrades
+  every check assigned to it in the same tick, and `healthy -> degraded` is an
+  escalation, so notifying per check would turn a single root cause into one alert
+  per check. The satellite's own connectivity subscription reports the cause once;
+  the runs are still recorded, so health and the UI stay honest.
+
+  Satellite liveness is cached on the shared platform cache with a 5s TTL. The
+  executor asks per tick of every satellite-only check and the read is a full
+  scan, so the uncached version scaled with the number of such checks. The TTL is
+  well below the smallest offline threshold the schema allows, so a cached answer
+  can lag a transition by one tick but never span one.
+
+  Corrects the user guide, which claimed offline satellites produced failed runs -
+  they produced nothing at all.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/signal-common@0.3.2
+
 ## 0.11.0
 
 ### Minor Changes
diff --git a/core/satellite-common/package.json b/core/satellite-common/package.json
index 5e88544dc..b422e792a 100644
--- a/core/satellite-common/package.json
+++ b/core/satellite-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/satellite-common",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/satellite-frontend/CHANGELOG.md b/core/satellite-frontend/CHANGELOG.md
index 5a9b67946..efa21e786 100644
--- a/core/satellite-frontend/CHANGELOG.md
+++ b/core/satellite-frontend/CHANGELOG.md
@@ -1,5 +1,110 @@
 # @checkstack/satellite-frontend
 
+## 0.9.0
+
+### Minor Changes
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+- 88f4333: Per-satellite offline threshold, connectivity notifications, and stop satellite-only checks going silent
+
+  **A satellite going offline was invisible, and so were its checks.** Three
+  related changes:
+
+  **Per-satellite offline threshold.** The 45-second global constant is now a
+  per-satellite override (**Offline after**, 2 minutes to 24 hours), because
+  tolerance is a property of the link, not of the platform: a satellite on a flaky
+  uplink needs grace that should not be forced on every other satellite. The
+  threshold is carried on every row read by `computeStatus`, so the entity read,
+  the admin list and the heartbeat monitor cannot disagree about the same
+  satellite. Additive, nullable column - existing satellites keep the default.
+
+  **Connectivity notifications.** Satellites are now a notification target with a
+  **Satellite connectivity** subscription: a warning when a satellite stops
+  heartbeating, informational when it returns. A reconnect only notifies if the
+  satellite was actually offline, so a redeploy is not an event. (The same
+  transitions remain available as `satellite.heartbeat_lost` / `.connected`
+  automation triggers for anyone wanting different routing.)
+
+  **Satellite-only checks no longer go silent.** BUG FIX: a check with
+  `includeLocal: false` whose satellites were all offline recorded NOTHING, so it
+  displayed its last known status indefinitely - a dead probe was indistinguishable
+  from a passing one. The core now records a `degraded` run with a clear message.
+  Degraded rather than unhealthy because the target may be fine; what failed is our
+  ability to observe it. Liveness that cannot be resolved is treated as "executing"
+  so a transient lookup failure cannot mark the whole fleet degraded at once.
+
+  Checks also surface staleness: a last run older than five intervals (minimum ten
+  minutes) is highlighted, so an ageing status is visible even with no run to
+  explain it. Paused checks are never stale, and neither is a RETIRED slice - one
+  whose environment was removed or whose satellite was unassigned - because
+  warning about something you retired on purpose trains operators to ignore the
+  badge.
+
+  The unobservable run does NOT notify subscribers. One offline satellite degrades
+  every check assigned to it in the same tick, and `healthy -> degraded` is an
+  escalation, so notifying per check would turn a single root cause into one alert
+  per check. The satellite's own connectivity subscription reports the cause once;
+  the runs are still recorded, so health and the UI stay honest.
+
+  Satellite liveness is cached on the shared platform cache with a 5s TTL. The
+  executor asks per tick of every satellite-only check and the read is a full
+  scan, so the uncached version scaled with the number of such checks. The TTL is
+  well below the smallest offline threshold the schema allows, so a cached answer
+  can lag a transition by one tick but never span one.
+
+  Corrects the user guide, which claimed offline satellites produced failed runs -
+  they produced nothing at all.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/gitops-frontend@0.8.0
+  - @checkstack/satellite-common@0.12.0
+  - @checkstack/tips-frontend@0.5.6
+  - @checkstack/gitops-common@0.7.5
+  - @checkstack/signal-frontend@0.3.8
+
 ## 0.8.4
 
 ### Patch Changes
diff --git a/core/satellite-frontend/package.json b/core/satellite-frontend/package.json
index e9df48179..5b0db1ff3 100644
--- a/core/satellite-frontend/package.json
+++ b/core/satellite-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/satellite-frontend",
-  "version": "0.8.4",
+  "version": "0.9.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/satellite/CHANGELOG.md b/core/satellite/CHANGELOG.md
index c72896a18..99773d563 100644
--- a/core/satellite/CHANGELOG.md
+++ b/core/satellite/CHANGELOG.md
@@ -1,5 +1,32 @@
 # @checkstack/satellite
 
+## 0.9.1
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/metricstream-common@0.2.2
+  - @checkstack/tracestream-common@0.1.2
+  - @checkstack/logstream-common@0.4.2
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/satellite-common@0.12.0
+  - @checkstack/telemetry-common@0.2.0
+  - @checkstack/healthcheck-execution@0.35.1
+  - @checkstack/k8s-events-common@0.1.2
+  - @checkstack/script-packages-backend@0.4.7
+  - @checkstack/secrets-common@0.3.4
+  - @checkstack/ingest-utils@0.2.1
+  - @checkstack/otlp-wire@0.1.1
+
 ## 0.9.0
 
 ### Minor Changes
diff --git a/core/satellite/package.json b/core/satellite/package.json
index 660d4f8a0..5cea85623 100644
--- a/core/satellite/package.json
+++ b/core/satellite/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/satellite",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/screenshots/CHANGELOG.md b/core/screenshots/CHANGELOG.md
index 304792ce8..5de8c7228 100644
--- a/core/screenshots/CHANGELOG.md
+++ b/core/screenshots/CHANGELOG.md
@@ -1,5 +1,25 @@
 # @checkstack/screenshots
 
+## 0.0.11
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/ai-backend@0.11.5
+  - @checkstack/healthcheck-backend@1.23.0
+  - @checkstack/anomaly-backend@1.5.7
+  - @checkstack/notification-backend@1.8.7
+  - @checkstack/sdk@0.136.1
+  - @checkstack/slo-backend@0.12.7
+
 ## 0.0.10
 
 ### Patch Changes
diff --git a/core/screenshots/package.json b/core/screenshots/package.json
index ab953e00a..5cdb93b42 100644
--- a/core/screenshots/package.json
+++ b/core/screenshots/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/screenshots",
-  "version": "0.0.10",
+  "version": "0.0.11",
   "license": "Elastic-2.0",
   "private": true,
   "checkstack": {
diff --git a/core/script-packages-backend/CHANGELOG.md b/core/script-packages-backend/CHANGELOG.md
index caa4d505e..cc84bd299 100644
--- a/core/script-packages-backend/CHANGELOG.md
+++ b/core/script-packages-backend/CHANGELOG.md
@@ -1,5 +1,26 @@
 # @checkstack/script-packages-backend
 
+## 0.4.7
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/auth-common@0.17.0
+  - @checkstack/command-backend@0.3.0
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/secrets-backend@0.3.10
+  - @checkstack/script-packages-common@0.4.3
+  - @checkstack/sdk@0.136.1
+  - @checkstack/secrets-common@0.3.4
+
 ## 0.4.6
 
 ### Patch Changes
diff --git a/core/script-packages-backend/package.json b/core/script-packages-backend/package.json
index 8c52f6c3c..5269e3f87 100644
--- a/core/script-packages-backend/package.json
+++ b/core/script-packages-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/script-packages-backend",
-  "version": "0.4.6",
+  "version": "0.4.7",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/script-packages-common/CHANGELOG.md b/core/script-packages-common/CHANGELOG.md
index dd8acde06..4e512136d 100644
--- a/core/script-packages-common/CHANGELOG.md
+++ b/core/script-packages-common/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @checkstack/script-packages-common
 
+## 0.4.3
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/signal-common@0.3.2
+
 ## 0.4.2
 
 ### Patch Changes
diff --git a/core/script-packages-common/package.json b/core/script-packages-common/package.json
index aa8136781..f53cb5829 100644
--- a/core/script-packages-common/package.json
+++ b/core/script-packages-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/script-packages-common",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/script-packages-frontend/CHANGELOG.md b/core/script-packages-frontend/CHANGELOG.md
index bfea052a3..03769eb3e 100644
--- a/core/script-packages-frontend/CHANGELOG.md
+++ b/core/script-packages-frontend/CHANGELOG.md
@@ -1,5 +1,57 @@
 # @checkstack/script-packages-frontend
 
+## 0.5.0
+
+### Minor Changes
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/script-packages-common@0.4.3
+  - @checkstack/sdk@0.136.1
+  - @checkstack/signal-frontend@0.3.8
+
 ## 0.4.18
 
 ### Patch Changes
diff --git a/core/script-packages-frontend/package.json b/core/script-packages-frontend/package.json
index d877bc740..6f8e2c4ed 100644
--- a/core/script-packages-frontend/package.json
+++ b/core/script-packages-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/script-packages-frontend",
-  "version": "0.4.18",
+  "version": "0.5.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/script-packages-store-postgres/CHANGELOG.md b/core/script-packages-store-postgres/CHANGELOG.md
index 681ff4594..af7a43365 100644
--- a/core/script-packages-store-postgres/CHANGELOG.md
+++ b/core/script-packages-store-postgres/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @checkstack/script-packages-store-postgres
 
+## 0.2.34
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/script-packages-backend@0.4.7
+  - @checkstack/script-packages-common@0.4.3
+
 ## 0.2.33
 
 ### Patch Changes
diff --git a/core/script-packages-store-postgres/package.json b/core/script-packages-store-postgres/package.json
index f1687df0b..50d6a4982 100644
--- a/core/script-packages-store-postgres/package.json
+++ b/core/script-packages-store-postgres/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/script-packages-store-postgres",
-  "version": "0.2.33",
+  "version": "0.2.34",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/script-packages-store-s3/CHANGELOG.md b/core/script-packages-store-s3/CHANGELOG.md
index 65f4c8cbc..50b6f53d8 100644
--- a/core/script-packages-store-s3/CHANGELOG.md
+++ b/core/script-packages-store-s3/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/script-packages-store-s3
 
+## 0.2.34
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/script-packages-backend@0.4.7
+
 ## 0.2.33
 
 ### Patch Changes
diff --git a/core/script-packages-store-s3/package.json b/core/script-packages-store-s3/package.json
index 7402800a6..8471b866b 100644
--- a/core/script-packages-store-s3/package.json
+++ b/core/script-packages-store-s3/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/script-packages-store-s3",
-  "version": "0.2.33",
+  "version": "0.2.34",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/scripts/CHANGELOG.md b/core/scripts/CHANGELOG.md
index d27543b29..81913c27a 100644
--- a/core/scripts/CHANGELOG.md
+++ b/core/scripts/CHANGELOG.md
@@ -1,5 +1,22 @@
 # @checkstack/scripts
 
+## 0.7.7
+
+### Patch Changes
+
+- bd60aff: Security: auto-remediated fixable vulnerabilities flagged by the daily scan.
+
+  - `tar` 7.5.20 → 7.5.21 (GHSA-r292-9mhp-454m)
+  - `brace-expansion` 5.0.7 → 5.0.8 (CVE-2026-14257)
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+
 ## 0.7.6
 
 ### Patch Changes
diff --git a/core/scripts/package.json b/core/scripts/package.json
index 908d203bb..23b101637 100644
--- a/core/scripts/package.json
+++ b/core/scripts/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/scripts",
-  "version": "0.7.6",
+  "version": "0.7.7",
   "description": "Checkstack tooling: plugin scaffolding, codegen, and the plugin-pack CLI used by external plugin authors.",
   "license": "Elastic-2.0",
   "type": "module",
diff --git a/core/sdk/CHANGELOG.md b/core/sdk/CHANGELOG.md
index 37360197c..a674989a3 100644
--- a/core/sdk/CHANGELOG.md
+++ b/core/sdk/CHANGELOG.md
@@ -1,5 +1,41 @@
 # @checkstack/sdk
 
+## 0.136.1
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/auth-common@0.17.0
+  - @checkstack/incident-common@1.11.0
+  - @checkstack/maintenance-common@1.11.0
+  - @checkstack/automation-common@0.10.3
+  - @checkstack/command-common@0.4.0
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/satellite-common@0.12.0
+  - @checkstack/announcement-common@0.7.3
+  - @checkstack/anomaly-common@1.8.4
+  - @checkstack/cache-common@0.5.13
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/dependency-common@1.7.8
+  - @checkstack/gitops-common@0.7.5
+  - @checkstack/integration-common@0.9.11
+  - @checkstack/pluginmanager-common@0.2.18
+  - @checkstack/queue-common@0.6.14
+  - @checkstack/script-packages-common@0.4.3
+  - @checkstack/secrets-common@0.3.4
+  - @checkstack/slo-common@0.9.6
+  - @checkstack/theme-common@0.2.13
+  - @checkstack/tips-common@0.3.13
+
 ## 0.135.1
 
 ### Patch Changes
diff --git a/core/sdk/package.json b/core/sdk/package.json
index 22930186a..74ec11f06 100644
--- a/core/sdk/package.json
+++ b/core/sdk/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/sdk",
-  "version": "0.136.0",
+  "version": "0.137.0",
   "license": "Elastic-2.0",
   "type": "module",
   "description": "Auto-generated, version-pinned typed client and script-authoring helpers for Checkstack.",
diff --git a/core/sdk/src/version.ts b/core/sdk/src/version.ts
index 221ef482e..6416f80b7 100644
--- a/core/sdk/src/version.ts
+++ b/core/sdk/src/version.ts
@@ -3,4 +3,4 @@
 // script-context helper builders.
 
 /** The platform release version this SDK was stamped to. */
-export const SDK_RELEASE_VERSION = "0.136.0";
+export const SDK_RELEASE_VERSION = "0.137.0";
diff --git a/core/secrets-backend-local/CHANGELOG.md b/core/secrets-backend-local/CHANGELOG.md
index 1c17da8c2..ba467c42f 100644
--- a/core/secrets-backend-local/CHANGELOG.md
+++ b/core/secrets-backend-local/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @checkstack/secrets-backend-local
 
+## 0.1.30
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/secrets-backend@0.3.10
+  - @checkstack/secrets-common@0.3.4
+
 ## 0.1.29
 
 ### Patch Changes
diff --git a/core/secrets-backend-local/package.json b/core/secrets-backend-local/package.json
index 783f9b4db..6907eb8b6 100644
--- a/core/secrets-backend-local/package.json
+++ b/core/secrets-backend-local/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/secrets-backend-local",
-  "version": "0.1.29",
+  "version": "0.1.30",
   "description": "Default local secret backend: AES-256-GCM values in Postgres",
   "author": "Checkstack contributors",
   "license": "Elastic-2.0",
diff --git a/core/secrets-backend-vault/CHANGELOG.md b/core/secrets-backend-vault/CHANGELOG.md
index 5485b23d3..fbd3321d2 100644
--- a/core/secrets-backend-vault/CHANGELOG.md
+++ b/core/secrets-backend-vault/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @checkstack/secrets-backend-vault
 
+## 0.1.30
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/secrets-backend@0.3.10
+  - @checkstack/secrets-common@0.3.4
+
 ## 0.1.29
 
 ### Patch Changes
diff --git a/core/secrets-backend-vault/package.json b/core/secrets-backend-vault/package.json
index d3cf304be..8c835ccf7 100644
--- a/core/secrets-backend-vault/package.json
+++ b/core/secrets-backend-vault/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/secrets-backend-vault",
-  "version": "0.1.29",
+  "version": "0.1.30",
   "description": "HashiCorp Vault secret backend (OIDC/AppRole/token, KV v2, TTL cache)",
   "author": "Checkstack contributors",
   "license": "Elastic-2.0",
diff --git a/core/secrets-backend/CHANGELOG.md b/core/secrets-backend/CHANGELOG.md
index 9d1711338..5f99a21f7 100644
--- a/core/secrets-backend/CHANGELOG.md
+++ b/core/secrets-backend/CHANGELOG.md
@@ -1,5 +1,21 @@
 # @checkstack/secrets-backend
 
+## 0.3.10
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/command-backend@0.3.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/secrets-common@0.3.4
+
 ## 0.3.9
 
 ### Patch Changes
diff --git a/core/secrets-backend/package.json b/core/secrets-backend/package.json
index e45296d6e..c171042ee 100644
--- a/core/secrets-backend/package.json
+++ b/core/secrets-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/secrets-backend",
-  "version": "0.3.9",
+  "version": "0.3.10",
   "description": "Secrets platform backend: resolver service, masking, backend extension point, RPC router",
   "author": "Checkstack contributors",
   "license": "Elastic-2.0",
diff --git a/core/secrets-common/CHANGELOG.md b/core/secrets-common/CHANGELOG.md
index 7fb5d529b..67f066efe 100644
--- a/core/secrets-common/CHANGELOG.md
+++ b/core/secrets-common/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @checkstack/secrets-common
 
+## 0.3.4
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+
 ## 0.3.3
 
 ### Patch Changes
diff --git a/core/secrets-common/package.json b/core/secrets-common/package.json
index 9fbf96492..bd82205c0 100644
--- a/core/secrets-common/package.json
+++ b/core/secrets-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/secrets-common",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "description": "Shared schemas, contract, and access rules for the Secrets platform",
   "author": "Checkstack contributors",
   "license": "Elastic-2.0",
diff --git a/core/secrets-frontend/CHANGELOG.md b/core/secrets-frontend/CHANGELOG.md
index b8a3ac29b..61bf1eb41 100644
--- a/core/secrets-frontend/CHANGELOG.md
+++ b/core/secrets-frontend/CHANGELOG.md
@@ -1,5 +1,55 @@
 # @checkstack/secrets-frontend
 
+## 0.4.0
+
+### Minor Changes
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/secrets-common@0.3.4
+
 ## 0.3.17
 
 ### Patch Changes
diff --git a/core/secrets-frontend/package.json b/core/secrets-frontend/package.json
index 9c4a94aa8..3789c9a84 100644
--- a/core/secrets-frontend/package.json
+++ b/core/secrets-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/secrets-frontend",
-  "version": "0.3.17",
+  "version": "0.4.0",
   "description": "Admin Settings -> Secrets management page",
   "author": "Checkstack contributors",
   "license": "Elastic-2.0",
diff --git a/core/signal-backend/CHANGELOG.md b/core/signal-backend/CHANGELOG.md
index 287bb52cc..4d3e4b443 100644
--- a/core/signal-backend/CHANGELOG.md
+++ b/core/signal-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/signal-backend
 
+## 0.3.28
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/signal-common@0.3.2
+
 ## 0.3.27
 
 ### Patch Changes
diff --git a/core/signal-backend/package.json b/core/signal-backend/package.json
index e6ae007bc..257cee9f6 100644
--- a/core/signal-backend/package.json
+++ b/core/signal-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/signal-backend",
-  "version": "0.3.27",
+  "version": "0.3.28",
   "license": "Elastic-2.0",
   "type": "module",
   "exports": {
diff --git a/core/signal-common/CHANGELOG.md b/core/signal-common/CHANGELOG.md
index d2a9a98f2..b6a96ac5e 100644
--- a/core/signal-common/CHANGELOG.md
+++ b/core/signal-common/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @checkstack/signal-common
 
+## 0.3.2
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+
 ## 0.3.1
 
 ### Patch Changes
diff --git a/core/signal-common/package.json b/core/signal-common/package.json
index 4327aeda7..ec758c45b 100644
--- a/core/signal-common/package.json
+++ b/core/signal-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/signal-common",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/signal-frontend/CHANGELOG.md b/core/signal-frontend/CHANGELOG.md
index ef0296cf0..7c42d685b 100644
--- a/core/signal-frontend/CHANGELOG.md
+++ b/core/signal-frontend/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @checkstack/signal-frontend
 
+## 0.3.8
+
+### Patch Changes
+
+- @checkstack/signal-common@0.3.2
+
 ## 0.3.7
 
 ### Patch Changes
diff --git a/core/signal-frontend/package.json b/core/signal-frontend/package.json
index fab96799c..53eb5235d 100644
--- a/core/signal-frontend/package.json
+++ b/core/signal-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/signal-frontend",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/slo-backend/CHANGELOG.md b/core/slo-backend/CHANGELOG.md
index 5e6312a88..7c61410b6 100644
--- a/core/slo-backend/CHANGELOG.md
+++ b/core/slo-backend/CHANGELOG.md
@@ -1,5 +1,38 @@
 # @checkstack/slo-backend
 
+## 0.12.7
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/incident-common@1.11.0
+  - @checkstack/maintenance-common@1.11.0
+  - @checkstack/command-backend@0.3.0
+  - @checkstack/ai-backend@0.11.5
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/healthcheck-backend@1.23.0
+  - @checkstack/automation-backend@0.11.9
+  - @checkstack/cache-api@0.3.21
+  - @checkstack/catalog-backend@1.10.2
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/dependency-common@1.7.8
+  - @checkstack/gitops-backend@0.5.28
+  - @checkstack/gitops-common@0.7.5
+  - @checkstack/queue-api@0.4.1
+  - @checkstack/signal-common@0.3.2
+  - @checkstack/slo-common@0.9.6
+  - @checkstack/cache-utils@0.3.2
+
 ## 0.12.6
 
 ### Patch Changes
diff --git a/core/slo-backend/package.json b/core/slo-backend/package.json
index 0affb0d86..5d8d2924a 100644
--- a/core/slo-backend/package.json
+++ b/core/slo-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/slo-backend",
-  "version": "0.12.6",
+  "version": "0.12.7",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/slo-common/CHANGELOG.md b/core/slo-common/CHANGELOG.md
index 91ef34409..338deb91e 100644
--- a/core/slo-common/CHANGELOG.md
+++ b/core/slo-common/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @checkstack/slo-common
 
+## 0.9.6
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/signal-common@0.3.2
+
 ## 0.9.5
 
 ### Patch Changes
diff --git a/core/slo-common/package.json b/core/slo-common/package.json
index ee02924f6..9334237d3 100644
--- a/core/slo-common/package.json
+++ b/core/slo-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/slo-common",
-  "version": "0.9.5",
+  "version": "0.9.6",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/slo-frontend/CHANGELOG.md b/core/slo-frontend/CHANGELOG.md
index a5dabd695..727da6e43 100644
--- a/core/slo-frontend/CHANGELOG.md
+++ b/core/slo-frontend/CHANGELOG.md
@@ -1,5 +1,63 @@
 # @checkstack/slo-frontend
 
+## 0.12.0
+
+### Minor Changes
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+  - @checkstack/auth-frontend@0.16.0
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/dashboard-frontend@0.12.0
+  - @checkstack/tips-frontend@0.5.6
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/dependency-common@1.7.8
+  - @checkstack/slo-common@0.9.6
+  - @checkstack/signal-frontend@0.3.8
+
 ## 0.11.8
 
 ### Patch Changes
diff --git a/core/slo-frontend/package.json b/core/slo-frontend/package.json
index 62a982926..829e746b2 100644
--- a/core/slo-frontend/package.json
+++ b/core/slo-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/slo-frontend",
-  "version": "0.11.8",
+  "version": "0.12.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/status-page-backend/CHANGELOG.md b/core/status-page-backend/CHANGELOG.md
index e5c5f1730..6fc585626 100644
--- a/core/status-page-backend/CHANGELOG.md
+++ b/core/status-page-backend/CHANGELOG.md
@@ -1,5 +1,66 @@
 # @checkstack/status-page-backend
 
+## 0.7.0
+
+### Minor Changes
+
+- 88f4333: Resolve `#` mentions on public status pages, and check viewability in the admin UI
+
+  Cross-entity mentions previously resolved only in the admin UI, and did so
+  without asking whether the reader could actually open the target. Public
+  surfaces resolved nothing at all. Three changes, one per delivery context.
+
+  **The admin UI now checks viewability.** `useMentionResolution({ documents })`
+  collects the references a page is about to render and asks each owning plugin -
+  in ONE batched request - which of them this viewer may read. A mention to a
+  deleted or unreadable record now renders as plain text instead of a link to a
+  not-found page or an access gate. Backed by new `resolveIncidentRefs` /
+  `resolveMaintenanceRefs` procedures, which return ids only (so an unreadable
+  record is indistinguishable from a deleted one) and carry the same `listKey`
+  read post-filter as their list procedures. They are deliberately not a filter
+  over the authoring search list, which hides resolved incidents and would
+  silently downgrade valid references.
+
+  **Public status pages now resolve mentions.** A reference becomes a link to the
+  target's public detail page when - and only when - the same page publishes that
+  target, which is exactly the anti-enumeration gate the detail pages already
+  apply. So an operator writing "caused by #Database upgrade" in a public update
+  gets a working link, while a mention of an internal-only incident stays plain
+  text rather than becoming a link that confirms it exists. Widgets opt in by
+  declaring a `mentionType`, so the status-page packages take no dependency on any
+  domain plugin.
+
+  **BREAKING CHANGE (behavioural, no API change):** the in-app public status page
+  at `/statuspage/view/<slug>` now builds detail-page hrefs. Previously it passed
+  none, so incident and maintenance titles rendered as plain text there while the
+  same page on a custom domain linked them. Both now behave identically.
+
+  **Notification bodies no longer leak the internal scheme.** `checkstack:` is
+  meaningless outside a Checkstack renderer, and channels leaked it differently:
+  the email sanitiser stripped the href and left a dead anchor, while Slack's
+  mrkdwn emitted `<checkstack:maintenance/9f1c-abc|Database upgrade>` straight to
+  the recipient (Discord, Telegram and Teams render markdown natively and would
+  have passed it through too). `sanitizeUpdateMessage` now flattens every mention
+  to its label before the body reaches any channel, so no channel has to know the
+  scheme exists. Flattening also happens before the length bound, so the excerpt
+  budget is spent on visible text rather than on an internal URI.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/status-page-common@0.7.0
+  - @checkstack/command-backend@0.3.0
+  - @checkstack/notification-common@1.9.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/notification-backend@1.8.7
+
 ## 0.6.6
 
 ### Patch Changes
diff --git a/core/status-page-backend/package.json b/core/status-page-backend/package.json
index b2227f54d..0df58ad80 100644
--- a/core/status-page-backend/package.json
+++ b/core/status-page-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/status-page-backend",
-  "version": "0.6.6",
+  "version": "0.7.0",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/status-page-common/CHANGELOG.md b/core/status-page-common/CHANGELOG.md
index 915fdff99..e6346210b 100644
--- a/core/status-page-common/CHANGELOG.md
+++ b/core/status-page-common/CHANGELOG.md
@@ -1,5 +1,98 @@
 # @checkstack/status-page-common
 
+## 0.7.0
+
+### Minor Changes
+
+- 88f4333: Resolve `#` mentions on public status pages, and check viewability in the admin UI
+
+  Cross-entity mentions previously resolved only in the admin UI, and did so
+  without asking whether the reader could actually open the target. Public
+  surfaces resolved nothing at all. Three changes, one per delivery context.
+
+  **The admin UI now checks viewability.** `useMentionResolution({ documents })`
+  collects the references a page is about to render and asks each owning plugin -
+  in ONE batched request - which of them this viewer may read. A mention to a
+  deleted or unreadable record now renders as plain text instead of a link to a
+  not-found page or an access gate. Backed by new `resolveIncidentRefs` /
+  `resolveMaintenanceRefs` procedures, which return ids only (so an unreadable
+  record is indistinguishable from a deleted one) and carry the same `listKey`
+  read post-filter as their list procedures. They are deliberately not a filter
+  over the authoring search list, which hides resolved incidents and would
+  silently downgrade valid references.
+
+  **Public status pages now resolve mentions.** A reference becomes a link to the
+  target's public detail page when - and only when - the same page publishes that
+  target, which is exactly the anti-enumeration gate the detail pages already
+  apply. So an operator writing "caused by #Database upgrade" in a public update
+  gets a working link, while a mention of an internal-only incident stays plain
+  text rather than becoming a link that confirms it exists. Widgets opt in by
+  declaring a `mentionType`, so the status-page packages take no dependency on any
+  domain plugin.
+
+  **BREAKING CHANGE (behavioural, no API change):** the in-app public status page
+  at `/statuspage/view/<slug>` now builds detail-page hrefs. Previously it passed
+  none, so incident and maintenance titles rendered as plain text there while the
+  same page on a custom domain linked them. Both now behave identically.
+
+  **Notification bodies no longer leak the internal scheme.** `checkstack:` is
+  meaningless outside a Checkstack renderer, and channels leaked it differently:
+  the email sanitiser stripped the href and left a dead anchor, while Slack's
+  mrkdwn emitted `<checkstack:maintenance/9f1c-abc|Database upgrade>` straight to
+  the recipient (Discord, Telegram and Teams render markdown natively and would
+  have passed it through too). `sanitizeUpdateMessage` now flattens every mention
+  to its label before the body reaches any channel, so no channel has to know the
+  scheme exists. Flattening also happens before the length bound, so the excerpt
+  budget is spent on visible text rather than on an internal URI.
+
+### Patch Changes
+
+- 1deaac5: Make endpoint authorization self-documenting in the generated API docs
+
+  Every procedure's authorization is now derived from its contract metadata (its
+  `access` rules + `instanceAccess` mode) via a shared mode-descriptor registry and
+  emitted into the OpenAPI spec - both structurally (`x-orpc-meta.authorization`)
+  and as a human `**Authorization.**` sentence folded into the operation
+  description. Previously the docs surfaced only a flat list of global rule ids, so
+  an integrator (an API-key/application principal that CAN hold team grants) never
+  saw the team-grant / per-object dimension, and endpoints gated purely in the
+  handler showed no restriction at all.
+
+  For authorization that no declarative mode can express and is therefore enforced
+  in the handler (a compound OR, a graded verdict, a DB-derived id set), a new
+  optional `accessNote` on the procedure metadata surfaces the real rule in the
+  docs as an explicitly handler-enforced addendum. The note is documentation, not a
+  guarantee: per `.claude/rules/rlac.md` the drift guard for such authz is
+  behavioral tests over an extracted pure decision function, and the note must
+  state exactly what those tests pin.
+
+  Every handler-enforced authorization endpoint now carries such a note so the docs
+  are complete: the team read/scoping and team-management endpoints
+  (`@checkstack/auth-common`), the health-check assignment/history reads
+  (`@checkstack/healthcheck-common`), the audience-graded incident/maintenance
+  reads (`@checkstack/incident-common`, `@checkstack/maintenance-common`), status
+  -page publish's bound-resource check (`@checkstack/status-page-common`), the
+  stream `setSystemLinks` readable-additions check
+  (`@checkstack/{metricstream,tracestream,logstream}-common`), and the automation
+  `runAs` escalation guard (`@checkstack/automation-common`). These are
+  metadata-only additions - no runtime behavior changed. The notes describe the
+  rule for API-doc readers only; the drift guard is behavioral tests over the
+  check's decision function (per `.claude/rules/rlac.md`), so the notes name no
+  internal test files.
+
+  The API docs viewer (`@checkstack/api-docs-frontend`) now renders each
+  operation's description as Markdown, so the `**Authorization.**` block (and any
+  inline `code`) formats correctly instead of showing raw markdown.
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/frontend-api@0.18.0
+
 ## 0.6.5
 
 ### Patch Changes
diff --git a/core/status-page-common/package.json b/core/status-page-common/package.json
index 875075dd5..477bcf1f0 100644
--- a/core/status-page-common/package.json
+++ b/core/status-page-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/status-page-common",
-  "version": "0.6.5",
+  "version": "0.7.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/status-page-frontend/CHANGELOG.md b/core/status-page-frontend/CHANGELOG.md
index 2702569d5..83b706aa5 100644
--- a/core/status-page-frontend/CHANGELOG.md
+++ b/core/status-page-frontend/CHANGELOG.md
@@ -1,5 +1,122 @@
 # @checkstack/status-page-frontend
 
+## 0.9.0
+
+### Minor Changes
+
+- 88f4333: Resolve `#` mentions on public status pages, and check viewability in the admin UI
+
+  Cross-entity mentions previously resolved only in the admin UI, and did so
+  without asking whether the reader could actually open the target. Public
+  surfaces resolved nothing at all. Three changes, one per delivery context.
+
+  **The admin UI now checks viewability.** `useMentionResolution({ documents })`
+  collects the references a page is about to render and asks each owning plugin -
+  in ONE batched request - which of them this viewer may read. A mention to a
+  deleted or unreadable record now renders as plain text instead of a link to a
+  not-found page or an access gate. Backed by new `resolveIncidentRefs` /
+  `resolveMaintenanceRefs` procedures, which return ids only (so an unreadable
+  record is indistinguishable from a deleted one) and carry the same `listKey`
+  read post-filter as their list procedures. They are deliberately not a filter
+  over the authoring search list, which hides resolved incidents and would
+  silently downgrade valid references.
+
+  **Public status pages now resolve mentions.** A reference becomes a link to the
+  target's public detail page when - and only when - the same page publishes that
+  target, which is exactly the anti-enumeration gate the detail pages already
+  apply. So an operator writing "caused by #Database upgrade" in a public update
+  gets a working link, while a mention of an internal-only incident stays plain
+  text rather than becoming a link that confirms it exists. Widgets opt in by
+  declaring a `mentionType`, so the status-page packages take no dependency on any
+  domain plugin.
+
+  **BREAKING CHANGE (behavioural, no API change):** the in-app public status page
+  at `/statuspage/view/<slug>` now builds detail-page hrefs. Previously it passed
+  none, so incident and maintenance titles rendered as plain text there while the
+  same page on a custom domain linked them. Both now behave identically.
+
+  **Notification bodies no longer leak the internal scheme.** `checkstack:` is
+  meaningless outside a Checkstack renderer, and channels leaked it differently:
+  the email sanitiser stripped the href and left a dead anchor, while Slack's
+  mrkdwn emitted `<checkstack:maintenance/9f1c-abc|Database upgrade>` straight to
+  the recipient (Discord, Telegram and Teams render markdown natively and would
+  have passed it through too). `sanitizeUpdateMessage` now flattens every mention
+  to its label before the body reaches any channel, so no channel has to know the
+  scheme exists. Flattening also happens before the length bound, so the excerpt
+  budget is spent on visible text rather than on an internal URI.
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+- 88f4333: Colour timeline dots, and fix the rail they hang from
+
+  Status-update timeline dots were uniformly grey, so the rail carried no
+  information. They are now toned:
+
+  - **Maintenance** dots take the update's own status. Maintenance has no severity,
+    so its lifecycle is the one coloured dimension and nothing competes with it.
+  - **Incident** dots take the incident's SEVERITY, keeping status on a neutral
+    pill. Incidents carry both an urgency and a lifecycle, and `status-tone.ts`
+    gives the hue to the urgency - colouring both would put two competing scales on
+    one row.
+  - **Public status pages** now tone the dot to match the status label already
+    rendered beside it.
+
+  An update that changes nothing stays neutral, so a coloured dot always means "the
+  status moved here".
+
+  Also fixes the rail itself: it anchored its left EDGE at `left-4`, putting its
+  centre at 16.25px while every dot centres at 16px, so each dot sat a hair off the
+  line. The rail is now centred on the same axis, and a new exported `TimelineDot`
+  owns the positioning so the four separate copies of that maths cannot diverge
+  again.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+  - @checkstack/auth-frontend@0.16.0
+  - @checkstack/common@0.24.0
+  - @checkstack/status-page-common@0.7.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/catalog-common@2.8.2
+
 ## 0.8.0
 
 ### Minor Changes
diff --git a/core/status-page-frontend/package.json b/core/status-page-frontend/package.json
index 71488be1c..0d9044da7 100644
--- a/core/status-page-frontend/package.json
+++ b/core/status-page-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/status-page-frontend",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/telemetry-backend/CHANGELOG.md b/core/telemetry-backend/CHANGELOG.md
index 5f2b67578..b5fecc737 100644
--- a/core/telemetry-backend/CHANGELOG.md
+++ b/core/telemetry-backend/CHANGELOG.md
@@ -1,5 +1,57 @@
 # @checkstack/telemetry-backend
 
+## 0.2.0
+
+### Minor Changes
+
+- 1deaac5: Split telemetry "Test connection" so its authorization is contract-declared
+
+  `testSourceConfig` used to accept an optional `sourceId` (to reuse an existing
+  source's stored secrets) and verified MANAGE on that source with a hand-rolled
+  check in the handler - the one telemetry endpoint whose authorization was not
+  declared on the contract. It is now split into two procedures, each fully
+  declared:
+
+  - `testSourceConfig` - the fresh-editor dry run (no stored secrets), `typeScoped`
+    at manage level, as before but with `sourceId` removed from its input.
+  - `testExistingSource` - the secret-reuse dry run, `sourceId` required and
+    authorized by the `idParam` instanceAccess mode (MANAGE on that source),
+    enforced by the middleware. The hand-rolled `assertCanManageSource` handler
+    check is deleted.
+
+  The "Test connection" button calls whichever procedure fits (it has a `sourceId`
+  or not), so the UI is unchanged.
+
+  BREAKING CHANGE: `testSourceConfig` no longer accepts a `sourceId` - callers that
+  reused stored secrets by passing one must call the new `testExistingSource`
+  instead. Authorization behaviour is unchanged (still MANAGE on the referenced
+  source), only the endpoint split.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/auth-common@0.17.0
+  - @checkstack/satellite-backend@0.10.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/satellite-common@0.12.0
+  - @checkstack/telemetry-common@0.2.0
+  - @checkstack/secrets-backend@0.3.10
+  - @checkstack/cache-api@0.3.21
+  - @checkstack/queue-api@0.4.1
+  - @checkstack/secrets-common@0.3.4
+  - @checkstack/signal-common@0.3.2
+  - @checkstack/cache-utils@0.3.2
+  - @checkstack/ingest-utils@0.2.1
+
 ## 0.1.1
 
 ### Patch Changes
diff --git a/core/telemetry-backend/package.json b/core/telemetry-backend/package.json
index d10b00827..84dcf505c 100644
--- a/core/telemetry-backend/package.json
+++ b/core/telemetry-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/telemetry-backend",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Platform-level telemetry source/sink abstraction (pluggable sources for logs, metrics and traces)",
   "author": "Checkstack contributors",
   "license": "Elastic-2.0",
diff --git a/core/telemetry-common/CHANGELOG.md b/core/telemetry-common/CHANGELOG.md
index 2b9ee43a2..0d46f3db6 100644
--- a/core/telemetry-common/CHANGELOG.md
+++ b/core/telemetry-common/CHANGELOG.md
@@ -1,5 +1,44 @@
 # @checkstack/telemetry-common
 
+## 0.2.0
+
+### Minor Changes
+
+- 1deaac5: Split telemetry "Test connection" so its authorization is contract-declared
+
+  `testSourceConfig` used to accept an optional `sourceId` (to reuse an existing
+  source's stored secrets) and verified MANAGE on that source with a hand-rolled
+  check in the handler - the one telemetry endpoint whose authorization was not
+  declared on the contract. It is now split into two procedures, each fully
+  declared:
+
+  - `testSourceConfig` - the fresh-editor dry run (no stored secrets), `typeScoped`
+    at manage level, as before but with `sourceId` removed from its input.
+  - `testExistingSource` - the secret-reuse dry run, `sourceId` required and
+    authorized by the `idParam` instanceAccess mode (MANAGE on that source),
+    enforced by the middleware. The hand-rolled `assertCanManageSource` handler
+    check is deleted.
+
+  The "Test connection" button calls whichever procedure fits (it has a `sourceId`
+  or not), so the UI is unchanged.
+
+  BREAKING CHANGE: `testSourceConfig` no longer accepts a `sourceId` - callers that
+  reused stored secrets by passing one must call the new `testExistingSource`
+  instead. Authorization behaviour is unchanged (still MANAGE on the referenced
+  source), only the endpoint split.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/signal-common@0.3.2
+
 ## 0.1.1
 
 ### Patch Changes
diff --git a/core/telemetry-common/package.json b/core/telemetry-common/package.json
index 7b4417a64..0e9f9fa23 100644
--- a/core/telemetry-common/package.json
+++ b/core/telemetry-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/telemetry-common",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Platform-level telemetry source/sink abstraction (pluggable sources for logs, metrics and traces)",
   "author": "Checkstack contributors",
   "license": "Elastic-2.0",
diff --git a/core/telemetry-frontend/CHANGELOG.md b/core/telemetry-frontend/CHANGELOG.md
index be6ad97d1..000ffa5b0 100644
--- a/core/telemetry-frontend/CHANGELOG.md
+++ b/core/telemetry-frontend/CHANGELOG.md
@@ -1,5 +1,84 @@
 # @checkstack/telemetry-frontend
 
+## 0.2.0
+
+### Minor Changes
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- 1deaac5: Split telemetry "Test connection" so its authorization is contract-declared
+
+  `testSourceConfig` used to accept an optional `sourceId` (to reuse an existing
+  source's stored secrets) and verified MANAGE on that source with a hand-rolled
+  check in the handler - the one telemetry endpoint whose authorization was not
+  declared on the contract. It is now split into two procedures, each fully
+  declared:
+
+  - `testSourceConfig` - the fresh-editor dry run (no stored secrets), `typeScoped`
+    at manage level, as before but with `sourceId` removed from its input.
+  - `testExistingSource` - the secret-reuse dry run, `sourceId` required and
+    authorized by the `idParam` instanceAccess mode (MANAGE on that source),
+    enforced by the middleware. The hand-rolled `assertCanManageSource` handler
+    check is deleted.
+
+  The "Test connection" button calls whichever procedure fits (it has a `sourceId`
+  or not), so the UI is unchanged.
+
+  BREAKING CHANGE: `testSourceConfig` no longer accepts a `sourceId` - callers that
+  reused stored secrets by passing one must call the new `testExistingSource`
+  instead. Authorization behaviour is unchanged (still MANAGE on the referenced
+  source), only the endpoint split.
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+  - @checkstack/auth-frontend@0.16.0
+  - @checkstack/common@0.24.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/satellite-common@0.12.0
+  - @checkstack/telemetry-common@0.2.0
+  - @checkstack/signal-common@0.3.2
+
 ## 0.1.1
 
 ### Patch Changes
diff --git a/core/telemetry-frontend/package.json b/core/telemetry-frontend/package.json
index db2014325..3a51a5ab8 100644
--- a/core/telemetry-frontend/package.json
+++ b/core/telemetry-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/telemetry-frontend",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Platform-level telemetry source/sink abstraction (pluggable sources for logs, metrics and traces)",
   "author": "Checkstack contributors",
   "license": "Elastic-2.0",
diff --git a/core/template-engine/CHANGELOG.md b/core/template-engine/CHANGELOG.md
index 6d4f1252d..4282c43ad 100644
--- a/core/template-engine/CHANGELOG.md
+++ b/core/template-engine/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @checkstack/template-engine
 
+## 0.4.13
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+
 ## 0.4.12
 
 ### Patch Changes
diff --git a/core/template-engine/package.json b/core/template-engine/package.json
index afb06b44c..dcf94d681 100644
--- a/core/template-engine/package.json
+++ b/core/template-engine/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/template-engine",
-  "version": "0.4.12",
+  "version": "0.4.13",
   "license": "Elastic-2.0",
   "type": "module",
   "exports": {
diff --git a/core/test-utils-backend/CHANGELOG.md b/core/test-utils-backend/CHANGELOG.md
index 4eee1eceb..564e2aab4 100644
--- a/core/test-utils-backend/CHANGELOG.md
+++ b/core/test-utils-backend/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @checkstack/test-utils-backend
 
+## 0.1.62
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/queue-api@0.4.1
+  - @checkstack/signal-common@0.3.2
+
 ## 0.1.61
 
 ### Patch Changes
diff --git a/core/test-utils-backend/package.json b/core/test-utils-backend/package.json
index b564a2db8..1a53560f9 100644
--- a/core/test-utils-backend/package.json
+++ b/core/test-utils-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/test-utils-backend",
-  "version": "0.1.61",
+  "version": "0.1.62",
   "license": "Elastic-2.0",
   "checkstack": {
     "type": "tooling"
diff --git a/core/theme-backend/CHANGELOG.md b/core/theme-backend/CHANGELOG.md
index f0ca46ea3..f84dc656c 100644
--- a/core/theme-backend/CHANGELOG.md
+++ b/core/theme-backend/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @checkstack/theme-backend
 
+## 0.2.28
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/auth-backend@0.14.0
+  - @checkstack/theme-common@0.2.13
+
 ## 0.2.27
 
 ### Patch Changes
diff --git a/core/theme-backend/package.json b/core/theme-backend/package.json
index b931212fa..a1885f47c 100644
--- a/core/theme-backend/package.json
+++ b/core/theme-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/theme-backend",
-  "version": "0.2.27",
+  "version": "0.2.28",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/theme-common/CHANGELOG.md b/core/theme-common/CHANGELOG.md
index 14aa30164..8b97aaf7a 100644
--- a/core/theme-common/CHANGELOG.md
+++ b/core/theme-common/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @checkstack/theme-common
 
+## 0.2.13
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+
 ## 0.2.12
 
 ### Patch Changes
diff --git a/core/theme-common/package.json b/core/theme-common/package.json
index 4cdeda993..a052cf4b2 100644
--- a/core/theme-common/package.json
+++ b/core/theme-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/theme-common",
-  "version": "0.2.12",
+  "version": "0.2.13",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/theme-frontend/CHANGELOG.md b/core/theme-frontend/CHANGELOG.md
index 234cd6cb1..d416288df 100644
--- a/core/theme-frontend/CHANGELOG.md
+++ b/core/theme-frontend/CHANGELOG.md
@@ -1,5 +1,49 @@
 # @checkstack/theme-frontend
 
+## 0.4.0
+
+### Minor Changes
+
+- 88f4333: Auto theme option, and fix Auto never updating
+
+  The theme control is now a three-way Light / Dark / **Auto** selector. Auto
+  persists `system` and follows the operating system's preference.
+
+  This fixes two related bugs:
+
+  - **Auto was a one-way door.** The backend, schema and `ThemeProvider` had always
+    supported `system`, but both toggles were binary and could only ever write
+    `light` or `dark`. Touching the control once destroyed a user's Auto
+    preference permanently, with nothing able to write it back.
+  - **Auto did not react.** `ThemeProvider` read `matchMedia(...).matches` during
+    render with no listener, so a live OS light/dark switch did not repaint until
+    something unrelated re-rendered. It now subscribes and repaints immediately.
+
+  Theme resolution is extracted into a pure `resolveTheme` (exported from
+  `@checkstack/ui`), and a value read from `localStorage` is now narrowed rather
+  than cast - a hand-edited value can no longer put a bogus class on `<html>`.
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+  - @checkstack/auth-frontend@0.16.0
+  - @checkstack/common@0.24.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/theme-common@0.2.13
+
 ## 0.3.18
 
 ### Patch Changes
diff --git a/core/theme-frontend/package.json b/core/theme-frontend/package.json
index b3f16509b..cbaadbdcc 100644
--- a/core/theme-frontend/package.json
+++ b/core/theme-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/theme-frontend",
-  "version": "0.3.18",
+  "version": "0.4.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/tips-backend/CHANGELOG.md b/core/tips-backend/CHANGELOG.md
index d9ed7761c..21d363589 100644
--- a/core/tips-backend/CHANGELOG.md
+++ b/core/tips-backend/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @checkstack/tips-backend
 
+## 0.3.28
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/auth-backend@0.14.0
+  - @checkstack/tips-common@0.3.13
+
 ## 0.3.27
 
 ### Patch Changes
diff --git a/core/tips-backend/package.json b/core/tips-backend/package.json
index df270edab..1ae6012f7 100644
--- a/core/tips-backend/package.json
+++ b/core/tips-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/tips-backend",
-  "version": "0.3.27",
+  "version": "0.3.28",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/core/tips-common/CHANGELOG.md b/core/tips-common/CHANGELOG.md
index 2d7f09056..705b11979 100644
--- a/core/tips-common/CHANGELOG.md
+++ b/core/tips-common/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @checkstack/tips-common
 
+## 0.3.13
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+
 ## 0.3.12
 
 ### Patch Changes
diff --git a/core/tips-common/package.json b/core/tips-common/package.json
index 881a1414d..92b074ffa 100644
--- a/core/tips-common/package.json
+++ b/core/tips-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/tips-common",
-  "version": "0.3.12",
+  "version": "0.3.13",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/tips-frontend/CHANGELOG.md b/core/tips-frontend/CHANGELOG.md
index 9c1a02089..d77d156d1 100644
--- a/core/tips-frontend/CHANGELOG.md
+++ b/core/tips-frontend/CHANGELOG.md
@@ -1,5 +1,28 @@
 # @checkstack/tips-frontend
 
+## 0.5.6
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+  - @checkstack/auth-frontend@0.16.0
+  - @checkstack/common@0.24.0
+  - @checkstack/ui@1.31.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/tips-common@0.3.13
+
 ## 0.5.5
 
 ### Patch Changes
diff --git a/core/tips-frontend/package.json b/core/tips-frontend/package.json
index 13f5d4b25..7c149dfad 100644
--- a/core/tips-frontend/package.json
+++ b/core/tips-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/tips-frontend",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
diff --git a/core/tracestream-backend/CHANGELOG.md b/core/tracestream-backend/CHANGELOG.md
index 921ffbd68..8fef06cb1 100644
--- a/core/tracestream-backend/CHANGELOG.md
+++ b/core/tracestream-backend/CHANGELOG.md
@@ -1,5 +1,35 @@
 # @checkstack/tracestream-backend
 
+## 0.1.2
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/auth-common@0.17.0
+  - @checkstack/tracestream-common@0.1.2
+  - @checkstack/satellite-backend@0.10.0
+  - @checkstack/ai-backend@0.11.5
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/telemetry-common@0.2.0
+  - @checkstack/telemetry-backend@0.2.0
+  - @checkstack/cache-api@0.3.21
+  - @checkstack/catalog-common@2.8.2
+  - @checkstack/queue-api@0.4.1
+  - @checkstack/signal-common@0.3.2
+  - @checkstack/cache-utils@0.3.2
+  - @checkstack/ingest-utils@0.2.1
+
 ## 0.1.1
 
 ### Patch Changes
diff --git a/core/tracestream-backend/package.json b/core/tracestream-backend/package.json
index e12ccce12..7a7d79e51 100644
--- a/core/tracestream-backend/package.json
+++ b/core/tracestream-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/tracestream-backend",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Distributed tracing streams: OTLP trace ingestion, tail-based sampling, trace search and waterfalls",
   "author": "Checkstack contributors",
   "license": "Elastic-2.0",
diff --git a/core/tracestream-common/CHANGELOG.md b/core/tracestream-common/CHANGELOG.md
index 71960822e..386139a63 100644
--- a/core/tracestream-common/CHANGELOG.md
+++ b/core/tracestream-common/CHANGELOG.md
@@ -1,5 +1,59 @@
 # @checkstack/tracestream-common
 
+## 0.1.2
+
+### Patch Changes
+
+- 1deaac5: Make endpoint authorization self-documenting in the generated API docs
+
+  Every procedure's authorization is now derived from its contract metadata (its
+  `access` rules + `instanceAccess` mode) via a shared mode-descriptor registry and
+  emitted into the OpenAPI spec - both structurally (`x-orpc-meta.authorization`)
+  and as a human `**Authorization.**` sentence folded into the operation
+  description. Previously the docs surfaced only a flat list of global rule ids, so
+  an integrator (an API-key/application principal that CAN hold team grants) never
+  saw the team-grant / per-object dimension, and endpoints gated purely in the
+  handler showed no restriction at all.
+
+  For authorization that no declarative mode can express and is therefore enforced
+  in the handler (a compound OR, a graded verdict, a DB-derived id set), a new
+  optional `accessNote` on the procedure metadata surfaces the real rule in the
+  docs as an explicitly handler-enforced addendum. The note is documentation, not a
+  guarantee: per `.claude/rules/rlac.md` the drift guard for such authz is
+  behavioral tests over an extracted pure decision function, and the note must
+  state exactly what those tests pin.
+
+  Every handler-enforced authorization endpoint now carries such a note so the docs
+  are complete: the team read/scoping and team-management endpoints
+  (`@checkstack/auth-common`), the health-check assignment/history reads
+  (`@checkstack/healthcheck-common`), the audience-graded incident/maintenance
+  reads (`@checkstack/incident-common`, `@checkstack/maintenance-common`), status
+  -page publish's bound-resource check (`@checkstack/status-page-common`), the
+  stream `setSystemLinks` readable-additions check
+  (`@checkstack/{metricstream,tracestream,logstream}-common`), and the automation
+  `runAs` escalation guard (`@checkstack/automation-common`). These are
+  metadata-only additions - no runtime behavior changed. The notes describe the
+  rule for API-doc readers only; the drift guard is behavioral tests over the
+  check's decision function (per `.claude/rules/rlac.md`), so the notes name no
+  internal test files.
+
+  The API docs viewer (`@checkstack/api-docs-frontend`) now renders each
+  operation's description as Markdown, so the `**Authorization.**` block (and any
+  inline `code`) formats correctly instead of showing raw markdown.
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/telemetry-common@0.2.0
+  - @checkstack/signal-common@0.3.2
+  - @checkstack/otlp-wire@0.1.1
+
 ## 0.1.1
 
 ### Patch Changes
diff --git a/core/tracestream-common/package.json b/core/tracestream-common/package.json
index d8c307e5a..7da294d2a 100644
--- a/core/tracestream-common/package.json
+++ b/core/tracestream-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/tracestream-common",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Distributed tracing streams: OTLP trace ingestion, tail-based sampling, trace search and waterfalls",
   "author": "Checkstack contributors",
   "license": "Elastic-2.0",
diff --git a/core/tracestream-frontend/CHANGELOG.md b/core/tracestream-frontend/CHANGELOG.md
index 0d1906679..c2841b312 100644
--- a/core/tracestream-frontend/CHANGELOG.md
+++ b/core/tracestream-frontend/CHANGELOG.md
@@ -1,5 +1,91 @@
 # @checkstack/tracestream-frontend
 
+## 0.2.0
+
+### Minor Changes
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+### Patch Changes
+
+- 88f4333: Colour timeline dots, and fix the rail they hang from
+
+  Status-update timeline dots were uniformly grey, so the rail carried no
+  information. They are now toned:
+
+  - **Maintenance** dots take the update's own status. Maintenance has no severity,
+    so its lifecycle is the one coloured dimension and nothing competes with it.
+  - **Incident** dots take the incident's SEVERITY, keeping status on a neutral
+    pill. Incidents carry both an urgency and a lifecycle, and `status-tone.ts`
+    gives the hue to the urgency - colouring both would put two competing scales on
+    one row.
+  - **Public status pages** now tone the dot to match the status label already
+    rendered beside it.
+
+  An update that changes nothing stays neutral, so a coloured dot always means "the
+  status moved here".
+
+  Also fixes the rail itself: it anchored its left EDGE at `left-4`, putting its
+  centre at 16.25px while every dot centres at 16px, so each dot sat a hair off the
+  line. The rail is now centred on the same axis, and a new exported `TimelineDot`
+  owns the positioning so the four separate copies of that maths cannot diverge
+  again.
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [56e5375]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+  - @checkstack/auth-frontend@0.16.0
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/tracestream-common@0.1.2
+  - @checkstack/logstream-common@0.4.2
+  - @checkstack/ui@1.31.0
+  - @checkstack/catalog-frontend@0.22.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/healthcheck-frontend@0.39.0
+  - @checkstack/telemetry-frontend@0.2.0
+  - @checkstack/telemetry-common@0.2.0
+  - @checkstack/catalog-common@2.8.2
+
 ## 0.1.2
 
 ### Patch Changes
diff --git a/core/tracestream-frontend/package.json b/core/tracestream-frontend/package.json
index fe401351e..e55c4a65e 100644
--- a/core/tracestream-frontend/package.json
+++ b/core/tracestream-frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/tracestream-frontend",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "Distributed tracing streams: OTLP trace ingestion, tail-based sampling, trace search and waterfalls",
   "author": "Checkstack contributors",
   "license": "Elastic-2.0",
diff --git a/core/ui/CHANGELOG.md b/core/ui/CHANGELOG.md
index b1e2c3f4f..ee1a2c581 100644
--- a/core/ui/CHANGELOG.md
+++ b/core/ui/CHANGELOG.md
@@ -1,5 +1,208 @@
 # @checkstack/ui
 
+## 1.31.0
+
+### Minor Changes
+
+- 88f4333: Auto theme option, and fix Auto never updating
+
+  The theme control is now a three-way Light / Dark / **Auto** selector. Auto
+  persists `system` and follows the operating system's preference.
+
+  This fixes two related bugs:
+
+  - **Auto was a one-way door.** The backend, schema and `ThemeProvider` had always
+    supported `system`, but both toggles were binary and could only ever write
+    `light` or `dark`. Touching the control once destroyed a user's Auto
+    preference permanently, with nothing able to write it back.
+  - **Auto did not react.** `ThemeProvider` read `matchMedia(...).matches` during
+    render with no listener, so a live OS light/dark switch did not repaint until
+    something unrelated re-rendered. It now subscribes and repaints immediately.
+
+  Theme resolution is extracted into a pure `resolveTheme` (exported from
+  `@checkstack/ui`), and a value read from `localStorage` is now narrowed rather
+  than cast - a hand-edited value can no longer put a bogus class on `<html>`.
+
+- 88f4333: Link incidents and maintenances with `#` mentions
+
+  Typing `#` in a markdown field now opens a picker over every mentionable record
+  and inserts a reference. Referencing another record previously meant pasting a
+  URL, which cannot be right everywhere: an admin URL is meaningless on a public
+  status page, a status-page URL is meaningless in the admin UI, and neither works
+  in an email.
+
+  A mention therefore stores WHAT it points at, never where:
+  `[Database upgrade](checkstack:maintenance/<id>)`. That is an ordinary markdown
+  link - readable in the raw source, parsed unchanged by existing tooling - and
+  only the href is resolved per render context.
+
+  Resolution may REFUSE: a resolver returning nothing renders the label as plain
+  text rather than a link. That is a confidentiality property, not a nicety - an
+  internal-only incident referenced from a public status update must not become a
+  link that confirms it exists. A renderer given no resolver links nothing.
+
+  Incident and maintenance detail pages gained a **Referenced items** section,
+  derived by scanning the authored markdown on each render. Nothing is stored
+  twice, so an edit that drops a reference drops it from the list too.
+
+  The platform owns the contract (`registerMentionRoutes` / `setMentionSearch` in
+  `@checkstack/frontend-api`); each owning plugin registers its own type, so no
+  plugin imports another. Search only ever offers records the caller may read.
+
+  Scope: resolution is wired for the admin UI. Public status pages and notification
+  bodies do not resolve mentions yet, so a mention renders there as plain text -
+  the safe default above, not a broken link.
+
+  Precisely: the admin resolver maps a well-formed reference to a route WITHOUT
+  checking that the target still exists or that this viewer may read it, so a
+  mention to a deleted or unreadable record links to a not-found or an access gate.
+  That is deliberate - gating on the provider's fetched list would silently
+  downgrade valid references to plain text (the incident search excludes resolved
+  incidents by default), and silently dropping a valid link is worse than one that
+  lands on a gate the backend already enforces. The confidentiality property is
+  carried by the public renderers, which resolve nothing.
+
+- 88f4333: Fix cross-entity mentions rendering as dead text everywhere
+
+  Inline `#` mentions never became links - not in the admin UI, not on incident or
+  maintenance detail pages, not anywhere. `react-markdown` blanks any `href` whose
+  protocol is outside its safe list BEFORE the rehype plugins run, so
+  `checkstack:maintenance/<id>` reached the anchor renderer as `""`. The renderer
+  then saw no mention, took the ordinary-link branch, and emitted an `<a>` with no
+  href.
+
+  The failure was invisible: the label still rendered, nothing threw, and the page
+  looked correct - only the link was missing. Two filters had to be widened, since
+  either one alone still drops the href:
+
+  - `urlTransform` now passes the mention scheme through and defers everything
+    else to `defaultUrlTransform`, so `javascript:`/`data:` stay blocked.
+  - The sanitizer's URL-protocol allow-list gains the same scheme, so it does not
+    strip the href immediately afterwards.
+
+  The mention href is never emitted to the DOM either way: the anchor renderer
+  replaces it with a resolved in-app URL or renders plain text.
+
+  `Markdown.mentions.test.tsx` pins the whole path from authored markdown to a
+  rendered anchor, including that an unresolved mention stays plain text and that
+  `javascript:` is still refused. The e2e that appeared to cover this asserted
+  `getByRole("link", …).first()`, which matched the "Referenced items" chip - a
+  plain router link that renders whether or not the inline mention works - so it
+  passed throughout. It now asserts both links and their hrefs.
+
+- 88f4333: Markdown editor with a live preview tab and formatting toolbar
+
+  Markdown fields were plain textareas with a "Markdown supported" hint, so an
+  author found out how their text rendered only after saving - or, for a
+  notification, after it had already been delivered.
+
+  New `MarkdownEditor` in `@checkstack/ui`: Write / Preview tabs plus a toolbar
+  (bold, italic, link, code, lists, quote). Adopted by the incident and maintenance
+  update forms and descriptions, and the announcement message.
+
+  The preview renders through `MarkdownBlock` - the same component, remark/rehype
+  chain and sanitiser used for the saved content. A second renderer here would be
+  free to drift, and a preview that disagrees with the real render is worse than no
+  preview.
+
+  Toolbar marks toggle rather than only adding, and mark lengths are matched
+  exactly so italic (`*`) never claims bold's (`**`) delimiters and silently
+  downgrades an author's emphasis.
+
+  Note for adopters: `MarkdownEditor` wraps its textarea, so `required` on it does
+  nothing - gate submission explicitly instead.
+
+- 56e5375: Migrate the frontend from react-router-dom v7 to react-router v8
+
+  Resolves GHSA-qwww-vcr4-c8h2 (HIGH): React Router before 8.3.0 has an RSC-mode
+  CSRF bypass that lets an action execute before the 400 response. Checkstack runs
+  a client-side SPA (`<BrowserRouter>`) and does not use RSC mode, so the platform
+  was not exploitable through it - but the advisory kept the dependency-graph
+  security gate red on every pull request, and the fix is only available in the 8.x
+  line, which the auto-remediation deliberately will not reach (it refuses major
+  bumps).
+
+  `react-router-dom` has no v8: it was folded into `react-router` in v7 and v8
+  ships as `react-router` only. So this is a package swap rather than a range bump:
+
+  - 31 packages now depend on `react-router@^8.3.0` instead of
+    `react-router-dom@^7.16.0`, and 97 source files import from `react-router`.
+  - The Module Federation host share, `optimizeDeps` and `dedupe` entries move to
+    `react-router` (shared singleton `requiredVersion` `^8.0.0`). Remotes never
+    shared the router, so the remote contract is unchanged.
+  - The syncpack unified-range group tracks `react-router`, keeping the enforced
+    single-range guarantee that a past four-range regression motivated.
+
+  The API surface Checkstack uses is unchanged between v7 and v8 - `BrowserRouter`,
+  `MemoryRouter`, `Routes`, `Route`, `Link`, `NavLink`, `useLocation`,
+  `useNavigate`, `useParams` and `useSearchParams` are all exported by v8 with the
+  same signatures - so no routing code changed beyond the import specifier. v8
+  requires React >= 19.2.7, which the workspace already pins.
+
+- 88f4333: Colour timeline dots, and fix the rail they hang from
+
+  Status-update timeline dots were uniformly grey, so the rail carried no
+  information. They are now toned:
+
+  - **Maintenance** dots take the update's own status. Maintenance has no severity,
+    so its lifecycle is the one coloured dimension and nothing competes with it.
+  - **Incident** dots take the incident's SEVERITY, keeping status on a neutral
+    pill. Incidents carry both an urgency and a lifecycle, and `status-tone.ts`
+    gives the hue to the urgency - colouring both would put two competing scales on
+    one row.
+  - **Public status pages** now tone the dot to match the status label already
+    rendered beside it.
+
+  An update that changes nothing stays neutral, so a coloured dot always means "the
+  status moved here".
+
+  Also fixes the rail itself: it anchored its left EDGE at `left-4`, putting its
+  centre at 16.25px while every dot centres at 16px, so each dot sat a hair off the
+  line. The rail is now centred on the same axis, and a new exported `TimelineDot`
+  owns the positioning so the four separate copies of that maths cannot diverge
+  again.
+
+### Patch Changes
+
+- 88f4333: Cover the features that shipped on logic-only tests
+
+  Inline mentions shipped completely inert while ~90 unit tests passed, because
+  those tests proved the pure functions and nothing proved the render path. Four
+  features carried exactly the same shape of coverage. Each now has a guard that
+  was VERIFIED to fail when the thing it guards is broken.
+
+  - **HTTP proxy.** `fetch({ proxy })` had never run: every test covered the URL
+    we build, the SSRF host we guard and the field contracts, but no test routed a
+    request through an actual proxy. A real proxy server now proves the request
+    arrives there, that credentials are sent, that a 407 is a COMPLETED request
+    (not a transport failure), that an unreachable proxy IS a transport failure,
+    and that an empty templated proxy falls back to a direct connection.
+  - **Status-coloured timeline dots.** The feature was `StatusUpdateTimeline`
+    forwarding a caller's `renderDot`; the colour helpers were tested but the
+    one-line forward was not. Now pinned, including per-item independence and the
+    newest-first ordering a dot renderer must not assume away.
+  - **System custom-field preview.** `SystemPreviewPicker` had no render coverage
+    at all. Now covers the empty case, that the SELECTION is displayed, and that
+    "No system" reports `null` rather than leaking the internal sentinel.
+  - **Per-satellite offline threshold.** `computeStatus` is called from five
+    places and a site that forgets the per-satellite value silently falls back to
+    the global default, so the admin list, the entity read and the monitor
+    disagree about the same satellite. A behavioural drift guard now drives the
+    real reads with a heartbeat stale by the global default but fresh by the
+    satellite's own threshold - and the shorter-threshold direction too.
+
+  Tests only; no runtime behaviour changes.
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/frontend-api@0.18.0
+  - @checkstack/template-engine@0.4.13
+
 ## 1.30.0
 
 ### Minor Changes
diff --git a/core/ui/package.json b/core/ui/package.json
index 3660fa1aa..dacacd99b 100644
--- a/core/ui/package.json
+++ b/core/ui/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/ui",
-  "version": "1.30.0",
+  "version": "1.31.0",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
diff --git a/plugins/auth-credential-backend/CHANGELOG.md b/plugins/auth-credential-backend/CHANGELOG.md
index 1c231bde8..428c9c39e 100644
--- a/plugins/auth-credential-backend/CHANGELOG.md
+++ b/plugins/auth-credential-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/auth-credential-backend
 
+## 0.0.71
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/auth-backend@0.14.0
+
 ## 0.0.70
 
 ### Patch Changes
diff --git a/plugins/auth-credential-backend/package.json b/plugins/auth-credential-backend/package.json
index ed2cbc0d1..7f9728a1e 100644
--- a/plugins/auth-credential-backend/package.json
+++ b/plugins/auth-credential-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/auth-credential-backend",
-  "version": "0.0.70",
+  "version": "0.0.71",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/auth-github-backend/CHANGELOG.md b/plugins/auth-github-backend/CHANGELOG.md
index 2da2ef4f1..4eb4bfdc0 100644
--- a/plugins/auth-github-backend/CHANGELOG.md
+++ b/plugins/auth-github-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/auth-github-backend
 
+## 0.0.71
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/auth-backend@0.14.0
+
 ## 0.0.70
 
 ### Patch Changes
diff --git a/plugins/auth-github-backend/package.json b/plugins/auth-github-backend/package.json
index 265e6f3d8..ceb798f57 100644
--- a/plugins/auth-github-backend/package.json
+++ b/plugins/auth-github-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/auth-github-backend",
-  "version": "0.0.70",
+  "version": "0.0.71",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/auth-ldap-backend/CHANGELOG.md b/plugins/auth-ldap-backend/CHANGELOG.md
index 7afd544d2..73a944971 100644
--- a/plugins/auth-ldap-backend/CHANGELOG.md
+++ b/plugins/auth-ldap-backend/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @checkstack/auth-ldap-backend
 
+## 0.2.28
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/auth-common@0.17.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/auth-backend@0.14.0
+
 ## 0.2.27
 
 ### Patch Changes
diff --git a/plugins/auth-ldap-backend/package.json b/plugins/auth-ldap-backend/package.json
index a7d8a8d82..898b68e21 100644
--- a/plugins/auth-ldap-backend/package.json
+++ b/plugins/auth-ldap-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/auth-ldap-backend",
-  "version": "0.2.27",
+  "version": "0.2.28",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/auth-saml-backend/CHANGELOG.md b/plugins/auth-saml-backend/CHANGELOG.md
index 2813ca0ec..d3d4f5d29 100644
--- a/plugins/auth-saml-backend/CHANGELOG.md
+++ b/plugins/auth-saml-backend/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @checkstack/auth-saml-backend
 
+## 0.2.28
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/auth-common@0.17.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/auth-backend@0.14.0
+
 ## 0.2.27
 
 ### Patch Changes
diff --git a/plugins/auth-saml-backend/package.json b/plugins/auth-saml-backend/package.json
index df413154a..2fe3b3fa9 100644
--- a/plugins/auth-saml-backend/package.json
+++ b/plugins/auth-saml-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/auth-saml-backend",
-  "version": "0.2.27",
+  "version": "0.2.28",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/cache-memory-backend/CHANGELOG.md b/plugins/cache-memory-backend/CHANGELOG.md
index 2fead6398..f0b48f3e6 100644
--- a/plugins/cache-memory-backend/CHANGELOG.md
+++ b/plugins/cache-memory-backend/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @checkstack/cache-memory-backend
 
+## 0.3.37
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/cache-api@0.3.21
+  - @checkstack/cache-memory-common@0.2.19
+
 ## 0.3.36
 
 ### Patch Changes
diff --git a/plugins/cache-memory-backend/package.json b/plugins/cache-memory-backend/package.json
index 9d9b121ae..22ed8e54e 100644
--- a/plugins/cache-memory-backend/package.json
+++ b/plugins/cache-memory-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/cache-memory-backend",
-  "version": "0.3.36",
+  "version": "0.3.37",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/cache-memory-common/CHANGELOG.md b/plugins/cache-memory-common/CHANGELOG.md
index a2449b3c0..33b579171 100644
--- a/plugins/cache-memory-common/CHANGELOG.md
+++ b/plugins/cache-memory-common/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @checkstack/cache-memory-common
 
+## 0.2.19
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+
 ## 0.2.18
 
 ### Patch Changes
diff --git a/plugins/cache-memory-common/package.json b/plugins/cache-memory-common/package.json
index 5278a297c..b12f14892 100644
--- a/plugins/cache-memory-common/package.json
+++ b/plugins/cache-memory-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/cache-memory-common",
-  "version": "0.2.18",
+  "version": "0.2.19",
   "type": "module",
   "sideEffects": [
     "**/*.css"
diff --git a/plugins/cache-redis-backend/CHANGELOG.md b/plugins/cache-redis-backend/CHANGELOG.md
index 958af6db6..f7da75ee4 100644
--- a/plugins/cache-redis-backend/CHANGELOG.md
+++ b/plugins/cache-redis-backend/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @checkstack/cache-redis-backend
 
+## 0.1.5
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/cache-api@0.3.21
+  - @checkstack/cache-redis-common@0.1.2
+
 ## 0.1.4
 
 ### Patch Changes
diff --git a/plugins/cache-redis-backend/package.json b/plugins/cache-redis-backend/package.json
index 2db465d22..302dea92f 100644
--- a/plugins/cache-redis-backend/package.json
+++ b/plugins/cache-redis-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/cache-redis-backend",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/cache-redis-common/CHANGELOG.md b/plugins/cache-redis-common/CHANGELOG.md
index 8378ec1e2..3168617f9 100644
--- a/plugins/cache-redis-common/CHANGELOG.md
+++ b/plugins/cache-redis-common/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @checkstack/cache-redis-common
 
+## 0.1.2
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+
 ## 0.1.1
 
 ### Patch Changes
diff --git a/plugins/cache-redis-common/package.json b/plugins/cache-redis-common/package.json
index d59c8db96..1fa434511 100644
--- a/plugins/cache-redis-common/package.json
+++ b/plugins/cache-redis-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/cache-redis-common",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "type": "module",
   "sideEffects": [
     "**/*.css"
diff --git a/plugins/collector-hardware-backend/CHANGELOG.md b/plugins/collector-hardware-backend/CHANGELOG.md
index fcd8b449b..fa66698cb 100644
--- a/plugins/collector-hardware-backend/CHANGELOG.md
+++ b/plugins/collector-hardware-backend/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @checkstack/collector-hardware-backend
 
+## 0.1.67
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/healthcheck-ssh-common@0.1.31
+
 ## 0.1.66
 
 ### Patch Changes
diff --git a/plugins/collector-hardware-backend/package.json b/plugins/collector-hardware-backend/package.json
index f9d4aeb41..f1755ba08 100644
--- a/plugins/collector-hardware-backend/package.json
+++ b/plugins/collector-hardware-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/collector-hardware-backend",
-  "version": "0.1.66",
+  "version": "0.1.67",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/healthcheck-container-backend/CHANGELOG.md b/plugins/healthcheck-container-backend/CHANGELOG.md
index bb8ed1e8e..f2d284db4 100644
--- a/plugins/healthcheck-container-backend/CHANGELOG.md
+++ b/plugins/healthcheck-container-backend/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @checkstack/healthcheck-container-backend
 
+## 0.2.6
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/healthcheck-container-common@0.1.3
+
 ## 0.2.5
 
 ### Patch Changes
diff --git a/plugins/healthcheck-container-backend/package.json b/plugins/healthcheck-container-backend/package.json
index 18929280b..420c0da77 100644
--- a/plugins/healthcheck-container-backend/package.json
+++ b/plugins/healthcheck-container-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-container-backend",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/healthcheck-container-common/CHANGELOG.md b/plugins/healthcheck-container-common/CHANGELOG.md
index b39263587..33ec3c60f 100644
--- a/plugins/healthcheck-container-common/CHANGELOG.md
+++ b/plugins/healthcheck-container-common/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @checkstack/healthcheck-container-common
 
+## 0.1.3
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+
 ## 0.1.2
 
 ### Patch Changes
diff --git a/plugins/healthcheck-container-common/package.json b/plugins/healthcheck-container-common/package.json
index 76dcdad92..979a72a84 100644
--- a/plugins/healthcheck-container-common/package.json
+++ b/plugins/healthcheck-container-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-container-common",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "type": "module",
   "sideEffects": [
     "**/*.css"
diff --git a/plugins/healthcheck-dns-backend/CHANGELOG.md b/plugins/healthcheck-dns-backend/CHANGELOG.md
index 82268f1ce..d5cedf503 100644
--- a/plugins/healthcheck-dns-backend/CHANGELOG.md
+++ b/plugins/healthcheck-dns-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/healthcheck-dns-backend
 
+## 0.5.6
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/backend-api@0.35.0
+
 ## 0.5.5
 
 ### Patch Changes
diff --git a/plugins/healthcheck-dns-backend/package.json b/plugins/healthcheck-dns-backend/package.json
index fb9bca297..149d67db5 100644
--- a/plugins/healthcheck-dns-backend/package.json
+++ b/plugins/healthcheck-dns-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-dns-backend",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/healthcheck-grpc-backend/CHANGELOG.md b/plugins/healthcheck-grpc-backend/CHANGELOG.md
index b00555423..c1c7b2201 100644
--- a/plugins/healthcheck-grpc-backend/CHANGELOG.md
+++ b/plugins/healthcheck-grpc-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/healthcheck-grpc-backend
 
+## 0.4.6
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/backend-api@0.35.0
+
 ## 0.4.5
 
 ### Patch Changes
diff --git a/plugins/healthcheck-grpc-backend/package.json b/plugins/healthcheck-grpc-backend/package.json
index e2e0b32ab..5d2c0e03e 100644
--- a/plugins/healthcheck-grpc-backend/package.json
+++ b/plugins/healthcheck-grpc-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-grpc-backend",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/healthcheck-http-backend/CHANGELOG.md b/plugins/healthcheck-http-backend/CHANGELOG.md
index 6584f1775..fb2038dad 100644
--- a/plugins/healthcheck-http-backend/CHANGELOG.md
+++ b/plugins/healthcheck-http-backend/CHANGELOG.md
@@ -1,5 +1,87 @@
 # @checkstack/healthcheck-http-backend
 
+## 0.9.0
+
+### Minor Changes
+
+- 88f4333: Route HTTP health checks through a proxy
+
+  HTTP checks gained optional **Proxy URL**, username and password settings, so a
+  network that requires an outbound proxy (a filtering proxy, an audited egress
+  gateway) can be monitored through the same path its users take. The proxy URL is
+  templatable, so one check can use a different proxy per environment, and proxy
+  credentials are stored as secrets.
+
+  Two deliberate consequences, both documented in the field description:
+
+  - **The proxy becomes the egress policy boundary for that check.** The SSRF
+    denylist is applied to the PROXY host, because that is the only host Checkstack
+    connects to, and the target is left for the proxy to resolve. A filtering proxy
+    is frequently the only thing that CAN resolve the target (split-horizon DNS),
+    so pre-resolving locally would reject valid checks while proving nothing about
+    the real egress. A proxy pointed at a denied range is still refused.
+  - **Connect/TLS timings are omitted for proxied checks.** The probe that measures
+    them opens a raw socket to the resolved target, which is a path a proxied
+    request never takes; missing data is honest, a direct-connection timing
+    reported for a proxied request is not.
+
+  A proxy that answers with an error is a COMPLETED request: 407 and 502 surface as
+  an assertable `statusCode`, not as a transport failure. Only failing to reach the
+  proxy at all is a transport failure.
+
+  **Credentials.** The proxy password is a secret field - encrypted at rest,
+  redacted in the UI, resolvable as `${{ secrets.NAME }}`, and delivered to a
+  satellite just in time per run. It is deliberately NOT `{{ }}`-templatable:
+  secret and template fields are resolved in separate ordered passes and marking a
+  field both is rejected at plugin load. So the proxy URL can vary per environment
+  while the credential cannot - documented, and pinned by tests so the
+  boot-breaking combination cannot be introduced.
+
+  **An empty rendered proxy URL means no proxy**, and the target is guarded as
+  usual. Worth knowing when templating a mandatory proxy: an environment missing
+  the field degrades to a direct connection rather than to an error.
+
+### Patch Changes
+
+- 88f4333: Cover the features that shipped on logic-only tests
+
+  Inline mentions shipped completely inert while ~90 unit tests passed, because
+  those tests proved the pure functions and nothing proved the render path. Four
+  features carried exactly the same shape of coverage. Each now has a guard that
+  was VERIFIED to fail when the thing it guards is broken.
+
+  - **HTTP proxy.** `fetch({ proxy })` had never run: every test covered the URL
+    we build, the SSRF host we guard and the field contracts, but no test routed a
+    request through an actual proxy. A real proxy server now proves the request
+    arrives there, that credentials are sent, that a 407 is a COMPLETED request
+    (not a transport failure), that an unreachable proxy IS a transport failure,
+    and that an empty templated proxy falls back to a direct connection.
+  - **Status-coloured timeline dots.** The feature was `StatusUpdateTimeline`
+    forwarding a caller's `renderDot`; the colour helpers were tested but the
+    one-line forward was not. Now pinned, including per-item independence and the
+    newest-first ordering a dot renderer must not assume away.
+  - **System custom-field preview.** `SystemPreviewPicker` had no render coverage
+    at all. Now covers the empty case, that the SELECTION is displayed, and that
+    "No system" reports `null` rather than leaking the internal sentinel.
+  - **Per-satellite offline threshold.** `computeStatus` is called from five
+    places and a site that forgets the per-satellite value silently falls back to
+    the global default, so the admin list, the entity read and the monitor
+    disagree about the same satellite. A behavioural drift guard now drives the
+    real reads with a heartbeat stale by the global default but fresh by the
+    satellite's own threshold - and the shorter-threshold direction too.
+
+  Tests only; no runtime behaviour changes.
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/backend-api@0.35.0
+
 ## 0.8.1
 
 ### Patch Changes
diff --git a/plugins/healthcheck-http-backend/package.json b/plugins/healthcheck-http-backend/package.json
index 3051c46a2..b1cc653e7 100644
--- a/plugins/healthcheck-http-backend/package.json
+++ b/plugins/healthcheck-http-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-http-backend",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/healthcheck-jenkins-backend/CHANGELOG.md b/plugins/healthcheck-jenkins-backend/CHANGELOG.md
index 1378acfc1..d1e4d5f51 100644
--- a/plugins/healthcheck-jenkins-backend/CHANGELOG.md
+++ b/plugins/healthcheck-jenkins-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/healthcheck-jenkins-backend
 
+## 0.6.6
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/backend-api@0.35.0
+
 ## 0.6.5
 
 ### Patch Changes
diff --git a/plugins/healthcheck-jenkins-backend/package.json b/plugins/healthcheck-jenkins-backend/package.json
index 7adcbf51a..86a995864 100644
--- a/plugins/healthcheck-jenkins-backend/package.json
+++ b/plugins/healthcheck-jenkins-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-jenkins-backend",
-  "version": "0.6.5",
+  "version": "0.6.6",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/healthcheck-mysql-backend/CHANGELOG.md b/plugins/healthcheck-mysql-backend/CHANGELOG.md
index de8457a1a..49703df23 100644
--- a/plugins/healthcheck-mysql-backend/CHANGELOG.md
+++ b/plugins/healthcheck-mysql-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/healthcheck-mysql-backend
 
+## 0.5.6
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/backend-api@0.35.0
+
 ## 0.5.5
 
 ### Patch Changes
diff --git a/plugins/healthcheck-mysql-backend/package.json b/plugins/healthcheck-mysql-backend/package.json
index a93f216de..d66b0fdb8 100644
--- a/plugins/healthcheck-mysql-backend/package.json
+++ b/plugins/healthcheck-mysql-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-mysql-backend",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/healthcheck-ping-backend/CHANGELOG.md b/plugins/healthcheck-ping-backend/CHANGELOG.md
index cfd7a734d..18c913acb 100644
--- a/plugins/healthcheck-ping-backend/CHANGELOG.md
+++ b/plugins/healthcheck-ping-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/healthcheck-ping-backend
 
+## 0.4.6
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/backend-api@0.35.0
+
 ## 0.4.5
 
 ### Patch Changes
diff --git a/plugins/healthcheck-ping-backend/package.json b/plugins/healthcheck-ping-backend/package.json
index 56ba77c97..e3ccada71 100644
--- a/plugins/healthcheck-ping-backend/package.json
+++ b/plugins/healthcheck-ping-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-ping-backend",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/healthcheck-postgres-backend/CHANGELOG.md b/plugins/healthcheck-postgres-backend/CHANGELOG.md
index a0a11d35e..908d814f3 100644
--- a/plugins/healthcheck-postgres-backend/CHANGELOG.md
+++ b/plugins/healthcheck-postgres-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/healthcheck-postgres-backend
 
+## 0.5.6
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/backend-api@0.35.0
+
 ## 0.5.5
 
 ### Patch Changes
diff --git a/plugins/healthcheck-postgres-backend/package.json b/plugins/healthcheck-postgres-backend/package.json
index ca679ebc1..0b863ad0f 100644
--- a/plugins/healthcheck-postgres-backend/package.json
+++ b/plugins/healthcheck-postgres-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-postgres-backend",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/healthcheck-rcon-backend/CHANGELOG.md b/plugins/healthcheck-rcon-backend/CHANGELOG.md
index 4149abee3..856b24cf0 100644
--- a/plugins/healthcheck-rcon-backend/CHANGELOG.md
+++ b/plugins/healthcheck-rcon-backend/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @checkstack/healthcheck-rcon-backend
 
+## 0.6.6
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/healthcheck-rcon-common@0.2.29
+
 ## 0.6.5
 
 ### Patch Changes
diff --git a/plugins/healthcheck-rcon-backend/package.json b/plugins/healthcheck-rcon-backend/package.json
index b8f4de298..97a0f76b5 100644
--- a/plugins/healthcheck-rcon-backend/package.json
+++ b/plugins/healthcheck-rcon-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-rcon-backend",
-  "version": "0.6.5",
+  "version": "0.6.6",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/healthcheck-rcon-common/CHANGELOG.md b/plugins/healthcheck-rcon-common/CHANGELOG.md
index c89e58bec..b8dcc416f 100644
--- a/plugins/healthcheck-rcon-common/CHANGELOG.md
+++ b/plugins/healthcheck-rcon-common/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @checkstack/healthcheck-rcon-common
 
+## 0.2.29
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+
 ## 0.2.28
 
 ### Patch Changes
diff --git a/plugins/healthcheck-rcon-common/package.json b/plugins/healthcheck-rcon-common/package.json
index 234752032..18591ce74 100644
--- a/plugins/healthcheck-rcon-common/package.json
+++ b/plugins/healthcheck-rcon-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-rcon-common",
-  "version": "0.2.28",
+  "version": "0.2.29",
   "type": "module",
   "sideEffects": [
     "**/*.css"
diff --git a/plugins/healthcheck-redis-backend/CHANGELOG.md b/plugins/healthcheck-redis-backend/CHANGELOG.md
index 500924687..d9df161d3 100644
--- a/plugins/healthcheck-redis-backend/CHANGELOG.md
+++ b/plugins/healthcheck-redis-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/healthcheck-redis-backend
 
+## 0.5.6
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/backend-api@0.35.0
+
 ## 0.5.5
 
 ### Patch Changes
diff --git a/plugins/healthcheck-redis-backend/package.json b/plugins/healthcheck-redis-backend/package.json
index 1dcfb1bb7..618e13929 100644
--- a/plugins/healthcheck-redis-backend/package.json
+++ b/plugins/healthcheck-redis-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-redis-backend",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/healthcheck-script-backend/CHANGELOG.md b/plugins/healthcheck-script-backend/CHANGELOG.md
index 8b288edc6..b67774e1f 100644
--- a/plugins/healthcheck-script-backend/CHANGELOG.md
+++ b/plugins/healthcheck-script-backend/CHANGELOG.md
@@ -1,5 +1,21 @@
 # @checkstack/healthcheck-script-backend
 
+## 0.10.3
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/script-packages-backend@0.4.7
+  - @checkstack/secrets-common@0.3.4
+
 ## 0.10.2
 
 ### Patch Changes
diff --git a/plugins/healthcheck-script-backend/package.json b/plugins/healthcheck-script-backend/package.json
index cea316aed..e08ce3c84 100644
--- a/plugins/healthcheck-script-backend/package.json
+++ b/plugins/healthcheck-script-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-script-backend",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/healthcheck-snmp-backend/CHANGELOG.md b/plugins/healthcheck-snmp-backend/CHANGELOG.md
index 674460f6d..484bdb357 100644
--- a/plugins/healthcheck-snmp-backend/CHANGELOG.md
+++ b/plugins/healthcheck-snmp-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/healthcheck-snmp-backend
 
+## 0.1.6
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/backend-api@0.35.0
+
 ## 0.1.5
 
 ### Patch Changes
diff --git a/plugins/healthcheck-snmp-backend/package.json b/plugins/healthcheck-snmp-backend/package.json
index 57619f67d..37e918248 100644
--- a/plugins/healthcheck-snmp-backend/package.json
+++ b/plugins/healthcheck-snmp-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-snmp-backend",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/healthcheck-ssh-backend/CHANGELOG.md b/plugins/healthcheck-ssh-backend/CHANGELOG.md
index b784f12d4..a03baac5e 100644
--- a/plugins/healthcheck-ssh-backend/CHANGELOG.md
+++ b/plugins/healthcheck-ssh-backend/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @checkstack/healthcheck-ssh-backend
 
+## 0.5.6
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/healthcheck-ssh-common@0.1.31
+
 ## 0.5.5
 
 ### Patch Changes
diff --git a/plugins/healthcheck-ssh-backend/package.json b/plugins/healthcheck-ssh-backend/package.json
index 7796dd563..bbf65e2b2 100644
--- a/plugins/healthcheck-ssh-backend/package.json
+++ b/plugins/healthcheck-ssh-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-ssh-backend",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/healthcheck-ssh-common/CHANGELOG.md b/plugins/healthcheck-ssh-common/CHANGELOG.md
index 83203821c..f297526d5 100644
--- a/plugins/healthcheck-ssh-common/CHANGELOG.md
+++ b/plugins/healthcheck-ssh-common/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @checkstack/healthcheck-ssh-common
 
+## 0.1.31
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+
 ## 0.1.30
 
 ### Patch Changes
diff --git a/plugins/healthcheck-ssh-common/package.json b/plugins/healthcheck-ssh-common/package.json
index e91c7b496..474d75d0b 100644
--- a/plugins/healthcheck-ssh-common/package.json
+++ b/plugins/healthcheck-ssh-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-ssh-common",
-  "version": "0.1.30",
+  "version": "0.1.31",
   "type": "module",
   "sideEffects": [
     "**/*.css"
diff --git a/plugins/healthcheck-tcp-backend/CHANGELOG.md b/plugins/healthcheck-tcp-backend/CHANGELOG.md
index ad1b3d280..d7d02d06e 100644
--- a/plugins/healthcheck-tcp-backend/CHANGELOG.md
+++ b/plugins/healthcheck-tcp-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/healthcheck-tcp-backend
 
+## 0.5.6
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/backend-api@0.35.0
+
 ## 0.5.5
 
 ### Patch Changes
diff --git a/plugins/healthcheck-tcp-backend/package.json b/plugins/healthcheck-tcp-backend/package.json
index c5b99f5b2..9d98d9063 100644
--- a/plugins/healthcheck-tcp-backend/package.json
+++ b/plugins/healthcheck-tcp-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-tcp-backend",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/healthcheck-tls-backend/CHANGELOG.md b/plugins/healthcheck-tls-backend/CHANGELOG.md
index f84581082..4f1249f88 100644
--- a/plugins/healthcheck-tls-backend/CHANGELOG.md
+++ b/plugins/healthcheck-tls-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/healthcheck-tls-backend
 
+## 0.4.6
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/healthcheck-common@1.19.1
+  - @checkstack/backend-api@0.35.0
+
 ## 0.4.5
 
 ### Patch Changes
diff --git a/plugins/healthcheck-tls-backend/package.json b/plugins/healthcheck-tls-backend/package.json
index 27cdc204c..4c5d6ab5f 100644
--- a/plugins/healthcheck-tls-backend/package.json
+++ b/plugins/healthcheck-tls-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-tls-backend",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/integration-jira-backend/CHANGELOG.md b/plugins/integration-jira-backend/CHANGELOG.md
index e7e2ece23..fb7ea222a 100644
--- a/plugins/integration-jira-backend/CHANGELOG.md
+++ b/plugins/integration-jira-backend/CHANGELOG.md
@@ -1,5 +1,22 @@
 # @checkstack/integration-jira-backend
 
+## 0.7.20
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/automation-backend@0.11.9
+  - @checkstack/integration-backend@0.7.10
+  - @checkstack/integration-common@0.9.11
+  - @checkstack/integration-jira-common@0.2.11
+
 ## 0.7.19
 
 ### Patch Changes
diff --git a/plugins/integration-jira-backend/package.json b/plugins/integration-jira-backend/package.json
index 3a7a30f2d..92593485c 100644
--- a/plugins/integration-jira-backend/package.json
+++ b/plugins/integration-jira-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/integration-jira-backend",
-  "version": "0.7.19",
+  "version": "0.7.20",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/integration-jira-common/CHANGELOG.md b/plugins/integration-jira-common/CHANGELOG.md
index 0c36b9c2d..a06312b3a 100644
--- a/plugins/integration-jira-common/CHANGELOG.md
+++ b/plugins/integration-jira-common/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @checkstack/integration-jira-common
 
+## 0.2.11
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+
 ## 0.2.10
 
 ### Patch Changes
diff --git a/plugins/integration-jira-common/package.json b/plugins/integration-jira-common/package.json
index 688cba01f..36a9594dd 100644
--- a/plugins/integration-jira-common/package.json
+++ b/plugins/integration-jira-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/integration-jira-common",
-  "version": "0.2.10",
+  "version": "0.2.11",
   "type": "module",
   "sideEffects": [
     "**/*.css"
diff --git a/plugins/integration-script-backend/CHANGELOG.md b/plugins/integration-script-backend/CHANGELOG.md
index 6c79b3f73..1d8792ab8 100644
--- a/plugins/integration-script-backend/CHANGELOG.md
+++ b/plugins/integration-script-backend/CHANGELOG.md
@@ -1,5 +1,24 @@
 # @checkstack/integration-script-backend
 
+## 0.6.37
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/automation-common@0.10.3
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/automation-backend@0.11.9
+  - @checkstack/secrets-backend@0.3.10
+  - @checkstack/script-packages-backend@0.4.7
+  - @checkstack/script-packages-common@0.4.3
+  - @checkstack/secrets-common@0.3.4
+
 ## 0.6.36
 
 ### Patch Changes
diff --git a/plugins/integration-script-backend/package.json b/plugins/integration-script-backend/package.json
index a6ea9505d..b50852254 100644
--- a/plugins/integration-script-backend/package.json
+++ b/plugins/integration-script-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/integration-script-backend",
-  "version": "0.6.36",
+  "version": "0.6.37",
   "private": true,
   "type": "module",
   "main": "src/index.ts",
diff --git a/plugins/integration-teams-backend/CHANGELOG.md b/plugins/integration-teams-backend/CHANGELOG.md
index 3979b6689..f7fdd01a8 100644
--- a/plugins/integration-teams-backend/CHANGELOG.md
+++ b/plugins/integration-teams-backend/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @checkstack/integration-teams-backend
 
+## 0.2.27
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/automation-backend@0.11.9
+  - @checkstack/integration-backend@0.7.10
+
 ## 0.2.26
 
 ### Patch Changes
diff --git a/plugins/integration-teams-backend/package.json b/plugins/integration-teams-backend/package.json
index 41952067f..9c9d1a2cd 100644
--- a/plugins/integration-teams-backend/package.json
+++ b/plugins/integration-teams-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/integration-teams-backend",
-  "version": "0.2.26",
+  "version": "0.2.27",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/integration-webex-backend/CHANGELOG.md b/plugins/integration-webex-backend/CHANGELOG.md
index e56a3c4e2..3bc47e1a7 100644
--- a/plugins/integration-webex-backend/CHANGELOG.md
+++ b/plugins/integration-webex-backend/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @checkstack/integration-webex-backend
 
+## 0.2.27
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/automation-backend@0.11.9
+  - @checkstack/integration-backend@0.7.10
+
 ## 0.2.26
 
 ### Patch Changes
diff --git a/plugins/integration-webex-backend/package.json b/plugins/integration-webex-backend/package.json
index ae1ec5af2..592de05a2 100644
--- a/plugins/integration-webex-backend/package.json
+++ b/plugins/integration-webex-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/integration-webex-backend",
-  "version": "0.2.26",
+  "version": "0.2.27",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/integration-webhook-backend/CHANGELOG.md b/plugins/integration-webhook-backend/CHANGELOG.md
index 1dc90c15d..05d949860 100644
--- a/plugins/integration-webhook-backend/CHANGELOG.md
+++ b/plugins/integration-webhook-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/integration-webhook-backend
 
+## 0.1.40
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/automation-backend@0.11.9
+
 ## 0.1.39
 
 ### Patch Changes
diff --git a/plugins/integration-webhook-backend/package.json b/plugins/integration-webhook-backend/package.json
index 3e70e48bb..fb65d83d4 100644
--- a/plugins/integration-webhook-backend/package.json
+++ b/plugins/integration-webhook-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/integration-webhook-backend",
-  "version": "0.1.39",
+  "version": "0.1.40",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/k8s-events-backend/CHANGELOG.md b/plugins/k8s-events-backend/CHANGELOG.md
index 00a7f8c4f..282326a0c 100644
--- a/plugins/k8s-events-backend/CHANGELOG.md
+++ b/plugins/k8s-events-backend/CHANGELOG.md
@@ -1,5 +1,22 @@
 # @checkstack/k8s-events-backend
 
+## 0.1.2
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/telemetry-common@0.2.0
+  - @checkstack/telemetry-backend@0.2.0
+  - @checkstack/k8s-events-common@0.1.2
+
 ## 0.1.1
 
 ### Patch Changes
diff --git a/plugins/k8s-events-backend/package.json b/plugins/k8s-events-backend/package.json
index c89161f6c..c457010b0 100644
--- a/plugins/k8s-events-backend/package.json
+++ b/plugins/k8s-events-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/k8s-events-backend",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/notification-backstage-backend/CHANGELOG.md b/plugins/notification-backstage-backend/CHANGELOG.md
index 6ac501244..f3523a08b 100644
--- a/plugins/notification-backstage-backend/CHANGELOG.md
+++ b/plugins/notification-backstage-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/notification-backstage-backend
 
+## 0.2.8
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/notification-backend@1.8.7
+
 ## 0.2.7
 
 ### Patch Changes
diff --git a/plugins/notification-backstage-backend/package.json b/plugins/notification-backstage-backend/package.json
index 7b26243a4..1f2e5de26 100644
--- a/plugins/notification-backstage-backend/package.json
+++ b/plugins/notification-backstage-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/notification-backstage-backend",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/notification-discord-backend/CHANGELOG.md b/plugins/notification-discord-backend/CHANGELOG.md
index 6440def33..99601da5a 100644
--- a/plugins/notification-discord-backend/CHANGELOG.md
+++ b/plugins/notification-discord-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/notification-discord-backend
 
+## 0.2.8
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/notification-backend@1.8.7
+
 ## 0.2.7
 
 ### Patch Changes
diff --git a/plugins/notification-discord-backend/package.json b/plugins/notification-discord-backend/package.json
index f2d19daef..c6d821f81 100644
--- a/plugins/notification-discord-backend/package.json
+++ b/plugins/notification-discord-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/notification-discord-backend",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/notification-gotify-backend/CHANGELOG.md b/plugins/notification-gotify-backend/CHANGELOG.md
index e2fdabd20..da58a249d 100644
--- a/plugins/notification-gotify-backend/CHANGELOG.md
+++ b/plugins/notification-gotify-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/notification-gotify-backend
 
+## 0.2.8
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/notification-backend@1.8.7
+
 ## 0.2.7
 
 ### Patch Changes
diff --git a/plugins/notification-gotify-backend/package.json b/plugins/notification-gotify-backend/package.json
index 93fb18ad7..06f1a5b83 100644
--- a/plugins/notification-gotify-backend/package.json
+++ b/plugins/notification-gotify-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/notification-gotify-backend",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/notification-pushover-backend/CHANGELOG.md b/plugins/notification-pushover-backend/CHANGELOG.md
index 3ad88a500..6cbc52b04 100644
--- a/plugins/notification-pushover-backend/CHANGELOG.md
+++ b/plugins/notification-pushover-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/notification-pushover-backend
 
+## 0.1.72
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/notification-backend@1.8.7
+
 ## 0.1.71
 
 ### Patch Changes
diff --git a/plugins/notification-pushover-backend/package.json b/plugins/notification-pushover-backend/package.json
index 3c69675e9..e6c4b04ed 100644
--- a/plugins/notification-pushover-backend/package.json
+++ b/plugins/notification-pushover-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/notification-pushover-backend",
-  "version": "0.1.71",
+  "version": "0.1.72",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/notification-slack-backend/CHANGELOG.md b/plugins/notification-slack-backend/CHANGELOG.md
index 6ae60d7f7..352e691ad 100644
--- a/plugins/notification-slack-backend/CHANGELOG.md
+++ b/plugins/notification-slack-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/notification-slack-backend
 
+## 0.2.8
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/notification-backend@1.8.7
+
 ## 0.2.7
 
 ### Patch Changes
diff --git a/plugins/notification-slack-backend/package.json b/plugins/notification-slack-backend/package.json
index 747e36b72..6fcec4483 100644
--- a/plugins/notification-slack-backend/package.json
+++ b/plugins/notification-slack-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/notification-slack-backend",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/notification-smtp-backend/CHANGELOG.md b/plugins/notification-smtp-backend/CHANGELOG.md
index df7992950..05267c653 100644
--- a/plugins/notification-smtp-backend/CHANGELOG.md
+++ b/plugins/notification-smtp-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/notification-smtp-backend
 
+## 0.0.81
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/notification-backend@1.8.7
+
 ## 0.0.80
 
 ### Patch Changes
diff --git a/plugins/notification-smtp-backend/package.json b/plugins/notification-smtp-backend/package.json
index e4cbaa24f..99877830c 100644
--- a/plugins/notification-smtp-backend/package.json
+++ b/plugins/notification-smtp-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/notification-smtp-backend",
-  "version": "0.0.80",
+  "version": "0.0.81",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/notification-teams-backend/CHANGELOG.md b/plugins/notification-teams-backend/CHANGELOG.md
index d9a212a07..2c1dc5e4b 100644
--- a/plugins/notification-teams-backend/CHANGELOG.md
+++ b/plugins/notification-teams-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/notification-teams-backend
 
+## 0.0.80
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/notification-backend@1.8.7
+
 ## 0.0.79
 
 ### Patch Changes
diff --git a/plugins/notification-teams-backend/package.json b/plugins/notification-teams-backend/package.json
index 70363158f..e8a6ab31a 100644
--- a/plugins/notification-teams-backend/package.json
+++ b/plugins/notification-teams-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/notification-teams-backend",
-  "version": "0.0.79",
+  "version": "0.0.80",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/notification-telegram-backend/CHANGELOG.md b/plugins/notification-telegram-backend/CHANGELOG.md
index ba8d1cf1e..e3e0bd6e6 100644
--- a/plugins/notification-telegram-backend/CHANGELOG.md
+++ b/plugins/notification-telegram-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/notification-telegram-backend
 
+## 0.0.80
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/notification-backend@1.8.7
+
 ## 0.0.79
 
 ### Patch Changes
diff --git a/plugins/notification-telegram-backend/package.json b/plugins/notification-telegram-backend/package.json
index ce5d02e74..bf1da6dab 100644
--- a/plugins/notification-telegram-backend/package.json
+++ b/plugins/notification-telegram-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/notification-telegram-backend",
-  "version": "0.0.79",
+  "version": "0.0.80",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/notification-webex-backend/CHANGELOG.md b/plugins/notification-webex-backend/CHANGELOG.md
index ae0b32f4a..a735e3aa7 100644
--- a/plugins/notification-webex-backend/CHANGELOG.md
+++ b/plugins/notification-webex-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/notification-webex-backend
 
+## 0.0.80
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/notification-backend@1.8.7
+
 ## 0.0.79
 
 ### Patch Changes
diff --git a/plugins/notification-webex-backend/package.json b/plugins/notification-webex-backend/package.json
index ebf7334ac..7cb17c03c 100644
--- a/plugins/notification-webex-backend/package.json
+++ b/plugins/notification-webex-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/notification-webex-backend",
-  "version": "0.0.79",
+  "version": "0.0.80",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/notification-webhook-backend/CHANGELOG.md b/plugins/notification-webhook-backend/CHANGELOG.md
index 520bc26c3..76d03140b 100644
--- a/plugins/notification-webhook-backend/CHANGELOG.md
+++ b/plugins/notification-webhook-backend/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @checkstack/notification-webhook-backend
 
+## 0.1.8
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/notification-backend@1.8.7
+
 ## 0.1.7
 
 ### Patch Changes
diff --git a/plugins/notification-webhook-backend/package.json b/plugins/notification-webhook-backend/package.json
index 6879aa6ac..7343ccabe 100644
--- a/plugins/notification-webhook-backend/package.json
+++ b/plugins/notification-webhook-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/notification-webhook-backend",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/queue-bullmq-backend/CHANGELOG.md b/plugins/queue-bullmq-backend/CHANGELOG.md
index 82b97f13f..5e2819d1c 100644
--- a/plugins/queue-bullmq-backend/CHANGELOG.md
+++ b/plugins/queue-bullmq-backend/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @checkstack/queue-bullmq-backend
 
+## 0.5.13
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/queue-api@0.4.1
+  - @checkstack/queue-bullmq-common@0.1.29
+
 ## 0.5.12
 
 ### Patch Changes
diff --git a/plugins/queue-bullmq-backend/package.json b/plugins/queue-bullmq-backend/package.json
index 09bf63d35..84d2d6b1b 100644
--- a/plugins/queue-bullmq-backend/package.json
+++ b/plugins/queue-bullmq-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/queue-bullmq-backend",
-  "version": "0.5.12",
+  "version": "0.5.13",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/queue-bullmq-common/CHANGELOG.md b/plugins/queue-bullmq-common/CHANGELOG.md
index ee00fa121..d650a1e5a 100644
--- a/plugins/queue-bullmq-common/CHANGELOG.md
+++ b/plugins/queue-bullmq-common/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @checkstack/queue-bullmq-common
 
+## 0.1.29
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+
 ## 0.1.28
 
 ### Patch Changes
diff --git a/plugins/queue-bullmq-common/package.json b/plugins/queue-bullmq-common/package.json
index 2cb0a128f..04986a9e5 100644
--- a/plugins/queue-bullmq-common/package.json
+++ b/plugins/queue-bullmq-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/queue-bullmq-common",
-  "version": "0.1.28",
+  "version": "0.1.29",
   "type": "module",
   "sideEffects": [
     "**/*.css"
diff --git a/plugins/queue-memory-backend/CHANGELOG.md b/plugins/queue-memory-backend/CHANGELOG.md
index 0957d136f..5131eb966 100644
--- a/plugins/queue-memory-backend/CHANGELOG.md
+++ b/plugins/queue-memory-backend/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @checkstack/queue-memory-backend
 
+## 0.4.37
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+  - @checkstack/backend-api@0.35.0
+  - @checkstack/queue-api@0.4.1
+  - @checkstack/queue-memory-common@0.1.29
+
 ## 0.4.36
 
 ### Patch Changes
diff --git a/plugins/queue-memory-backend/package.json b/plugins/queue-memory-backend/package.json
index 613268c2c..ca8cf2ff1 100644
--- a/plugins/queue-memory-backend/package.json
+++ b/plugins/queue-memory-backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/queue-memory-backend",
-  "version": "0.4.36",
+  "version": "0.4.37",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
diff --git a/plugins/queue-memory-common/CHANGELOG.md b/plugins/queue-memory-common/CHANGELOG.md
index bf4ec4dc8..1b4be9082 100644
--- a/plugins/queue-memory-common/CHANGELOG.md
+++ b/plugins/queue-memory-common/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @checkstack/queue-memory-common
 
+## 0.1.29
+
+### Patch Changes
+
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [88f4333]
+- Updated dependencies [1deaac5]
+  - @checkstack/common@0.24.0
+
 ## 0.1.28
 
 ### Patch Changes
diff --git a/plugins/queue-memory-common/package.json b/plugins/queue-memory-common/package.json
index 51a4fc559..cae928374 100644
--- a/plugins/queue-memory-common/package.json
+++ b/plugins/queue-memory-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/queue-memory-common",
-  "version": "0.1.28",
+  "version": "0.1.29",
   "type": "module",
   "sideEffects": [
     "**/*.css"