[qfeuilla]

From a user's update to 0.2.282 and their report of 2026-10-30.

Postgres roles. PostgresDatabase gets a roles input. On every start the superuser makes each listed role (never a superuser, never one that makes roles) and grants it to app, so a program can set role. A login role signs in through the pooler with its own password and its own pooler lines. A role marked bypassRowLevelSecurity writes past FORCE policies. A role taken off the list loses app's membership, signing in and the bypass; the role and what it owns stay. Each pooler door is capped with max_db_connections, so several roles' pools stay within the door's share. Measured on PgBouncer 1.25: another role's idle connection is evicted rather than waited for.

One model for every password the node holds. A password is readable until it is taken, by a run storing it, weft infra env writing it, or the card's copy button. After that the card shows it handed over until its Reset button mints a new one. Infra cards carry this as taken (the press a reader sends with the value as proof) and handedOver (an explicit marker), which weft infra env reads instead of guessing from a line's shape.

Cloud dispatcher memory. One byte-bounded cache of parsed programs per process, which the search pass shares. The build-file cache is capped at 64 MiB where Cloud Run holds files in memory. Each role's memory, and the holders', is a Terraform variable set from repository variables, so a hand-set value is no longer reset by the install.

Deploys.

• The install stores the CLI it used, keyed by source tree. GET /install/cli/{tree} answers a signed link and its sha256, and the deploy template tries that first, then weft's release, then a build.
• The standard worker the install pushed is trusted when it has no ledger record, so the first stock project after an update does not rebuild it.

Local install.

• container_link gives a project's own container a link it can open (through host.docker.internal and the internal port's files door).
• The internal port listens on loopback and on the address Docker gives containers for this machine, which the runtime asks Docker on every start, never on every interface.
• launchctl failures carry everything launchctl printed.
• The runtime keeps its stdout and stderr on its log across a roll.

Tangle. Specialists may run read-only grep and rg, ffprobe, ffmpeg into their scratch folder (with each input's format named), a read-only psql transaction, and weft stop. The four matchers refuse every shell construct they cannot read the way bash and zsh do, and their suites now run in CI.

Ran locally on this branch:

• every check this PR runs: nextest, doc tests, clippy -D warnings, the parse-only build, the examples, hakari, Terraform validate, the CLI lookup test, every database test, every JS package and extension check, the bridge, the credential container, the Tangle suites and the docs;
• the Postgres node tests;
• the e2e tests for roles, the password env file, an outside client, a project's own Postgres, the container link and the stock worker.