LIA

Latent-debt hardening (CA-1, CA-4, CA-5) — a maintenance release closing three independent residual debts surfaced by the 2026-07 codebase audit. No user-facing feature change, prompt-free, no DB migration; each item was fixed test-first (a failing test before the fix).

🔒 Privacy (CA-1)

13 more field names added to the INFO-level PII log-redaction net — uploaded file names, HITL replies, calendar/task titles, reminder & edited-message bodies, and bulk-operation exclusion text no longer reach INFO logs. Contents stay at DEBUG or redacted; counters and IDs remain at INFO.

⚡ Performance (CA-4)

Seven blocking file reads/writes on hot async paths (generated-image PNG writes, attachment & RAG uploads, document text extraction, skill endpoints, LLM vision image reads) are offloaded via asyncio.to_thread — a multi-MB write no longer freezes concurrent requests (SSE included) during an image generation or a RAG upload.

🛡️ Security (CA-5)

JSON-LD SEO scripts now escape < to its U+003C JSON form through a shared serializeJsonLd helper (every sink + the blog article page), neutralizing </script> breakout from app-compiled dynamic fields (FAQ questions, blog titles/excerpts), with a systemic CI guard against any future raw JSON.stringify in a script.

Tests: red-first for each item; Ruff / Black / MyPy strict clean; full backend and frontend suites green; i18n key parity across all 6 locales. Docs: docs/technical/PII_LOGGING_SECURITY.md and docs/technical/SECURITY.md updated.

Full technical changelog: CHANGELOG.md