Changelog

• Cross-site writes to /api/rpc are refused. A write whose Origin is neither the request's origin nor BETTER_AUTH_URL's now gets HTTP 403. So does a write with no Origin that Sec-Fetch-Site marks as cross-site or same-site. This covers the OpenAPI mirror. A PR preview on a sibling subdomain can no longer write with a production cookie. The native app, scripts and server-to-server calls send neither header and are unaffected. See API.
• Production no longer trusts <scheme>-dev://. No production app registers the development build's scheme, so any app could claim a password-reset token sent there. The scheme is trusted in development, and on previews through the new preview-only switch NATIVE_DEV_SCHEME=1. Set it in apps/web/.dev.vars to sign a development build into a local built Worker. See Runtime switches.
• Only owners and admins can purge the trash, and purge now checks the database session. The files gateway also no longer reuses a snapshot-authorized tenant where it asked for the database session. See Files.
• BETTER_AUTH_SECRET must be at least 32 characters. pnpm setup already generates 44. A shorter secret now fails the production deploy before migrations, and the preview secrets step refuses it, so the running Worker is never replaced by one that refuses to boot. Changing a short secret signs every user out.
• The cron tick is observable. Each failed job logs one jobs.step_failed line with the type and code of its cause, never a message. Every tick logs one jobs.tick line: settled with counts, interrupted by the deadline, or failed. See Scheduled jobs.
• Job and migration lock waits end on the server. The job pool's lock_timeout (1 s) and statement_timeout (1.5 s) now fire before its 2 s client timeout. A claim reported as failed can no longer commit later. The migration runner takes a transaction-scoped advisory lock per folder, which is safe on a pooled connection, and gives up a table lock after 5 seconds instead of queueing traffic behind it. See Database.

PR #201

Credential endpoints are now rate limited in production. The Worker previously left the limiter off because it does not set NODE_ENV. get-session and jwks remain free of rate-limit database writes. See Rate limits and PR #196.

Server requests use the signed Session snapshot for up to 60 seconds, avoiding one session statement on a todo.list cache hit. The scenario B latency change was within local noise. Revocation on another device can take up to a minute for ordinary data. Membership removal remains immediate. Webhook endpoint changes and OAuth connection revocation read the current database session. The files gateway reads the membership directly. See Session reads and PR #195.