Features

• firmware: report superseded rollout jobs; retire a removed device's job (809d6ee)
• authorize: decide idTokens in the backend, in shadow until enforced (46036b2)
• shared: carry the owning tenant on a PortalRequest (429e16a)
• firmware: hold a paused rollout's jobs; expire a job unsent after 7 days (b06d42f)

Bug Fixes

• ocppcore: retire the legacy smart-charging consumer (a807a79)
• ci: promote the image built from the promoted commit (e687b02)
• ci: run the ocpp-core v16, v21 and mock-db tests, and test feature branches (5229a21)
• firmware: fail a job the station goes silent on, and publish it (f1c582e)
• firmware: map every firmware status explicitly so failed installs fail the job (a0bed94)
• ocpp16: a late MeterValues or a repeated StopTransaction leaves a closed session alone (e7b0ab0)
• ocpp16: find a transaction by station and id, not by tenant (e7d8a79)
• ocpp16: the Ended event carries the stop register, and the session energy beside it (f22417c)
• ocpp201: bind NotifyEVChargingNeeds under the action name the gateway publishes (c134818)
• ocpp21: answer every station message with a schema-valid reply (497d3dd)
• ocpp21: carry the station's reply on 2.1 command results (f1a1c75)
• ocpp21: record 2.1 station state through the 2.0.1 persistence (3a40d1c)
• ocpp: check for a live gateway consumer with a passive declare (8d637af)
• ocppcore: a failed last_seen lookup no longer panics the consumer (9445188)
• ocppcore: a panic no longer stops an OCPP queue for good (2b4d9d6)
• ocppcore: always answer a station's CALL, and keep replies off request handlers (d17f701)
• ocppcore: answer a repeated 1.6 StartTransaction with the transaction it already opened (b9bfff2)
• ocppcore: bound the platform command action map (3dc0eed)
• ocppcore: carry TransactionEvent offline and seqNo into the platform event (41cc0ce)
• ocppcore: compile what the 2.1 core now shares with 2.0.1 (3892daf)
• ocppcore: defer a station's messages until its tenant is known (c10f3ba)
• ocppcore: deliver platform command results at least once (d21072b)
• ocppcore: give every platform command an expiry; never dispatch an expired one (be701d7)
• ocppcore: keep the 2.1 firmware status mapping as a test-only guard (1e30855)
• ocppcore: make sea-orm's mock an opt-in feature, not a dev-dependency (92c7975)
• ocppcore: never cache a failed tenant lookup; serve the last known tenant (e172998)
• ocppcore: prune published outbox rows, the OCPP audit log and meter values (597c486)
• ocppcore: report 1.6 RebootRequired and AcceptedCanceled as accepted (48564f2)
• ocppcore: report a platform command that cannot be sent, before dropping it (c1ccc53)
• ocppcore: stop labelling metrics by charge point (8638235)
• ocppcore: the 1.6 DataTransfer handler ignores replies to platform commands (c416396)
• ocpp: judge presence on the persisted last_seen and drop the online triggers nothing sent (2f33393)
• ocpp: meter_kwh is the Outlet energy register, whatever order and unit it comes in (f93c3f4)
• reconcile: outages no longer park stations, and one sweep runs at a time (f47e208)
• site-control: judge the site master stale on receive time and its real cadence (d5bacd2)
• site-control: send a changed cap on the recalculation that computes it (d048039)
• ocppcore: SmartCharging with no managed plan yet is not runtime drift (ed3cd4b)
• readiness: carry configuredMaxAmps and every undeclared key through to the platform (f4777f5)

Features

• firmware: report superseded rollout jobs; retire a removed device's job (809d6ee)
• authorize: decide idTokens in the backend, in shadow until enforced (46036b2)
• shared: carry the owning tenant on a PortalRequest (429e16a)
• firmware: hold a paused rollout's jobs; expire a job unsent after 7 days (b06d42f)

Bug Fixes

• ocppcore: retire the legacy smart-charging consumer (a807a79)
• ci: promote the image built from the promoted commit (e687b02)
• ci: run the ocpp-core v16, v21 and mock-db tests, and test feature branches (5229a21)
• firmware: fail a job the station goes silent on, and publish it (f1c582e)
• firmware: map every firmware status explicitly so failed installs fail the job (a0bed94)
• ocpp16: find a transaction by station and id, not by tenant (e7d8a79)
• ocpp16: the Ended event carries the stop register, and the session energy beside it (f22417c)
• ocpp201: bind NotifyEVChargingNeeds under the action name the gateway publishes (c134818)
• ocpp21: answer every station message with a schema-valid reply (497d3dd)
• ocpp21: carry the station's reply on 2.1 command results (f1a1c75)
• ocpp21: record 2.1 station state through the 2.0.1 persistence (3a40d1c)
• ocpp: check for a live gateway consumer with a passive declare (8d637af)
• ocppcore: a failed last_seen lookup no longer panics the consumer (9445188)
• ocppcore: a panic no longer stops an OCPP queue for good (2b4d9d6)
• ocppcore: always answer a station's CALL, and keep replies off request handlers (d17f701)
• ocppcore: answer a repeated 1.6 StartTransaction with the transaction it already opened (b9bfff2)
• ocppcore: bound the platform command action map (3dc0eed)
• ocppcore: carry TransactionEvent offline and seqNo into the platform event (41cc0ce)
• ocppcore: compile what the 2.1 core now shares with 2.0.1 (3892daf)
• ocppcore: defer a station's messages until its tenant is known (c10f3ba)
• ocppcore: deliver platform command results at least once (d21072b)
• ocppcore: give every platform command an expiry; never dispatch an expired one (be701d7)
• ocppcore: keep the 2.1 firmware status mapping as a test-only guard (1e30855)
• ocppcore: make sea-orm's mock an opt-in feature, not a dev-dependency (92c7975)
• ocppcore: never cache a failed tenant lookup; serve the last known tenant (e172998)
• ocppcore: prune published outbox rows, the OCPP audit log and meter values (597c486)
• ocppcore: refuse a portal request for another tenant's station (e9ef67f)
• ocppcore: report a platform command that cannot be sent, before dropping it (c1ccc53)
• ocppcore: stop labelling metrics by charge point (8638235)
• ocpp: judge presence on the persisted last_seen and drop the online triggers nothing sent (2f33393)
• ocpp: meter_kwh is the Outlet energy register, whatever order and unit it comes in (f93c3f4)
• reconcile: outages no longer park stations, and one sweep runs at a time (f47e208)
• site-control: judge the site master stale on receive time and its real cadence (d5bacd2)
• site-control: send a changed cap on the recalculation that computes it (d048039)
• ocppcore: SmartCharging with no managed plan yet is not runtime drift (ed3cd4b)
• readiness: carry configuredMaxAmps and every undeclared key through to the platform (f4777f5)
• firmware: retire cancelled and superseded rollout jobs; record every attempt (0ed300a)
• firmware: stop probing a missing recovery queue on every offline retry (30d8f00)

Features

• rollout: accept the ocpp-core superseded device status; add superseded and removed to the enum (5dd29bb)
• rollout: consume fw.rollout.device_removed; a removed device stays removed (9dd9c1c)
• rollout: accept the ocpp-core expired device status as terminal and neutral (4121262)

Bug Fixes

• rollout: a paused rollout no longer allows devices (61e4c8d)
• rollout: a promote that resumes a paused rollout announces in_progress (4798baa)
• rollout: an approval never revives a paused, cancelled or completed rollout (b514adb)

Bug Fixes

• firmware: a late report that a job went ahead reopens the attempt closed without it (eab61e2)
• firmware: a re-allowed older rollout job yields to the station's newer one (60a08a5)
• firmware: let ocpp-core decide when a sent job has gone quiet (f20871e)
• firmware: stop timing out never-sent jobs; close them on cancel, supersession or silence (46f7dd7)
• firmware: an expiry closes the attempt its job was queued for (b2939d0)

Features

• firmware: announce a device's removal from a rollout (f9ff47d)
• firmware: record ocpp-core's superseded as a neutral rollout device status (52cd9a6)
• firmware: record expired firmware jobs as terminal, not failed (ba8297a)

Bug Fixes

• ci: keep the MR job cache under the runner helper storage limit (a7949bf)
• installer: act for customers only as a verified member of the installer org (bfe5493)
• roles: keep platform-only permissions out of customer tenants' role templates (e842f6b)
• tenants: a tenant admin cannot re-link its tenant to another org or login realm (88eb7b7)
• users: only the platform links a user to a FusionAuth user (7a0d44d)

Features

• amqp: stamp every tenant.events publish with tenant-api's broker user (547ef60)
• authz: catalogue OCPP_SECURITY_READ/WRITE and FACTORY_QA_WRITE (8772354)
• installer: give installer-created customers their own tenant behind a flag (482ad21)
• migration: add dry-run customer tenant migration tool (968936a)
• tenants: grant OCPP security event scopes to new tenants' role templates (587e992)

Bug Fixes

• gateway: apply provisioning events only from their real publishers (42f7ca8)
• gateway: refuse other services' provisioning events; accept unsigned ones until required (16be57d)
• ci: promote the image built from the promoted commit (e687b02)
• ci: run the ocpp-core v16, v21 and mock-db tests, and test feature branches (5229a21)
• gateway: an unrecognised auth_status is Pending, not Approved (1ac2e1e)
• gateway: answer a CALL that cannot be claimed with a CALLERROR (02584dc)
• gateway: cap inbound WebSocket messages at 1 MiB, refuse larger with 1009 (81bd29f)
• gateway: key inbound CALL claims on a SHA-256 of the frame, not the frame (8628e65)
• gateway: make the WebSocket idle timeout fire, and ping quiet stations (cd9a1be)
• gateway: requeue provisioning events that fail transiently (ecba19d)
• gateway: run station-driven Argon2 on the blocking pool (d1cfe9f)
• gateway: trust ingress certificate headers only from a trusted proxy (0847723)
• ocpp-gateway: report a queued command that expired instead of sending it (bd087df)
• ocpp16: the Ended event carries the stop register, and the session energy beside it (f22417c)
• ocpp21: carry the station's reply on 2.1 command results (f1a1c75)
• ocppcore: carry TransactionEvent offline and seqNo into the platform event (41cc0ce)
• ocppcore: give every platform command an expiry; never dispatch an expired one (be701d7)
• ocppgateway: share the claim tests' connection instead of cloning it (265babb)
• ocppgateway: share the database connection so --all-features builds (f0a7123)
• readiness: carry configuredMaxAmps and every undeclared key through to the platform (f4777f5)

Features

• shared: carry the owning tenant on a PortalRequest (429e16a)

Bug Fixes

• event-bus: keep the fan-out subscription across its keep-alive ping (0436bae)
• amqp: retry a failed delivery once, then dead-letter it; settle payloads that are not JSON (bd357e8)
• analytics: report tenant costs from settled session costs, on London days (62e70a2)
• api: reject reversed or unbounded from/to ranges (49f9646)
• auth: verify v2 signed identities bound to an organisation (2701ff9)
• bootstrap: quarantine legacy global history instead of handing it on (dac46b7)
• costs: book session energy with the meter rules, per connector, whoever owns the samples (83b4488)
• costs: keep tariff history right when settings events arrive out of order (e95cfd0)
• costs: price each meter interval on the tariff in force when the session started (c45c3d3)
• health: cheap dependency checks, a real readiness probe, bounded metric labels (1dee1ec)
• ingest: sessions keyed by station, unknown energy, ordered live state, delayed retries (a3bf5de)
• meter-backfill: fetch two baseline readings, and audit with meter-api's readings only (9f6861d)
• meter-data: serve consumed energy at every granularity, local days, and validated pages (31ad5f0)
• meter-retention: delete whole UTC days, keep each connector's baseline, one replica per pass (542390c)
• meter-shadow: reject misaligned, future and tenantglobal aggregates; one replica per comparison (e67f4ab)
• meter: count consumed energy once, and stop the backfill deleting history it cannot rebuild (08db061)
• report-runs: cap on-demand report runs per subject (0f05b6d)
• reporting: widen to sibling tenants only on a signed organisation grant (23f4871)
• reports: retire the fake /reports/generate endpoints (560a114)
• sse: fan dashboard events out to every replica; bound and cap streams (d43341f)
• amqp: believe tenant changes only from their publisher's broker user (6dfdcf9)
• event-bus: seal the dashboard fan-out and never publish it unsealed (b2249eb)

Features

• amqp: replay a dead letter by moving it back onto its source queue (f908c74)
• meter-backfill: recompute aggregates from reporting's own samples, dry-run first (c4d676b)

Bug Fixes

• events: apply device.tenant_changed only from chargepoint-api, not future-dated, and from the stored tenant (4298fd0)
• events: refuse other services' tenant changes; accept unsigned ones until required (fd8254b)
• events: stamp every publish with device-api's broker user (57d7640)
• idempotency: replay a stored response only to the caller that made it (614f655)
• setup: allow only platform administrators to call setup-existing (14e0338)

Features

• devices: follow a charger's tenant when chargepoint-api moves it (c452569)

Bug Fixes

• amqp: retry and dead-letter copies drop another publisher's user_id (552489b)
• auth: platform support is platform mode plus PLATFORM_ADMIN, not the scope alone (6e6b48c)
• customer-migration: refuse chargers that changed hands; never move another user's card; send owed events only while still true (0dbc5bc)
• device-move: only a stock charger moves unforced; a forced move leaves the household behind (068a23e)
• devices: return-to-stock takes back the household and replaces the claim codes (2894a40)
• events: claim, transfer, commission and return-to-stock commit device.tenant_changed to the outbox (bc1e9bc)
• ownership: a charger that left a tenant drops out of its ownership register (140e6e1)
• notifications: do not push late transaction events as live news (031a12c)
• notifications: report a session's energy, not the meter's lifetime register (b7adf29)
• amqp: retry a failed delivery once, then dead-letter it instead of dropping it (23c8cd0)
• notifications: a late Ended with nothing to sum up still tells the driver the session ended (fa6be88)
• notifications: an Ended without a reading reports the energy the row already holds (13be2ea)
• readiness: keep currentRmsA / currentPeakMethodA and any new key in the stored payload (70386c8)
• transactions: prefer ocpp-core's explicit session energy to the 1.6 Ended special case (e02f174)
• adoption: a label code no longer hands over someone else's charger (ac50e0a)
• auth: compare the internal token in constant time; refuse empty tokens (d684050)
• auth: report the edge identity mode only when serving requests (a8eee73)
• auth: verify auth-api's signature on edge identity headers (aac15dc)
• cors: send no CORS headers unless CORS_ALLOW_ORIGINS is set (debd7fa)
• device-model: send overrides apart from the mode and allow deleting one (697310a)
• device-users: assign only real users of the charger's tenant; keep the recorded owner (05cf15a)
• devices: stop claim codes leaking through search and sort (e9b383b)
• emobility: drop the per-pod OCPI dedupe; republish when a connector changes (04e9f7c)
• factory-qa: only the factory identity records QA results, on server time (d83b8b9)
• id-tokens: mask card numbers for callers who cannot manage them (9df760c)
• ingest: a device upsert never overwrites a rotated adoption or activation code (e19c02e)
• ingest: ack a redelivered websocket event instead of dead-lettering it (03c8b07)
• ingest: an older readiness or site-control frame no longer overwrites a newer one (d2227cb)
• ingest: commit pushes and status refreshes with the state they follow (29a0253)
• ingest: compute readiness once per event and publish changes a retry can re-derive (e46d399)
• ingest: judge presence at the event's time; push with the stored device id (175b693)
• ingest: retry failures through delayed-retry queues for ~30 minutes (e3242b0)
• ingest: supervise the consumer, isolate each delivery, report it in health (398d01e)
• installer-diagnostics: only a charger's own installer drives its diagnostics (42e6930)
• installer: a handover link only redeems the charger's current commission (f7f4fe7)
• installer: an installer may re-commission its own unclaimed charger (e2de2d7)
• installer: commissioning follows the claim rules (a533933)
• installer: one answer for an unknown serial or a wrong code, and a limit on guesses (02d931e)
• installer: verify a commission against the charger, and keep drafts to your own ids (a34a1b2)
• log-pulls: end finished pulls, store big bundles in batches, hide the token (ba29027)
• mode-sync: dispatch off the AMQP consumer and off the settings PUTs (dd38ed6)
• mode-sync: hold back only the ChargingType during a charging session (0c92ee9)
• mode-sync: retry with a new key per attempt, back off, and stop at needs_attention (3426670)
• mode-sync: Smart Charging with no plan yet is synced, not a failure (2d1a862)
• network-onboarding: provider credentials and hosts come from a platform allowlist (f0a0eac)
• network-profiles: confirm slots before prioritising and keep pushes and syncs apart (b3a22ac)
• ocpp: send every command as the station's registered OCPP version (641c7cd)
• performance: require the internal token or a signed service identity (2fdea85)
• provider-migration: act only on the key's tenant's chargers; let failed operations retry (9add4a4)
• publisher: confirm every publish on one reused channel, persistent (e860b9c)
• readiness: trust the firmware frame for as long as it is current (a8a2dc0)
• schedule: refuse turning the schedule off while Schedule mode is selected (56040b1)
• schedule: validate the schedule timezone as an IANA zone (735df7e)
• tenant-api-client: percent-encode every id put in a tenant-api path (b6a9d25)
• transactions: apply events in stream order, not processing order (d7d4100)
• transactions: carry stored metadata forward instead of replacing it (ca9b599)
• transactions: close on Available with one guarded UPDATE; sweep only what Available ended (f5609ce)
• transactions: one station cannot write another's session; key 1.6 ids by station (98e827e)
• mode-sync: selecting the same mode again restarts a sync that gave up (93c9385)
• adoption: check claims against the activation code the charger holds (8800f2f)
• transfers: address transfer notifications to whoever can act on them (566281b)
• id-tokens: a token presented as Central matches its registration of any type (3ed1ef7)

Features

• amqp: stamp chargepoint.provisioning messages with the publisher's RabbitMQ user (7dc6ade)
• amqp: replay a dead letter by moving it back onto the ingest queue (9092454)
• id-tokens: a registry of driver credentials, and the lookup ocpp-core authorises against (6fbbf45)
• installer: commission into delegated customer tenants behind a flag (fa33631)
• migration: add dry-run customer tenant device migration tool (14856a4)
• adoption: push staged activation codes to chargers (SetClaimCredentials) (6793bfb)
• migration: record the activation code each charger holds (f399e68)
• tools: backfill factory activation codes, dry run by default (90ba6b7)
• events: say why a charger changed tenant on device.tenant_changed (9c8449d)
• devices: let a platform admin move a stock charger into another tenant (4aa1279)

Bug Fixes

• jwt: never sign the platform scope for a customer-mode identity (1fca887)
• verify: trust only the ingress's X-Original-URL for the request path (5667905)
• verify: let a charger's log upload PUT through the edge (ef22389)
• verify: match public paths exactly instead of by suffix (cd91fc1)

Features

• auth: resolve customer and delegated tenants through tenant-api behind flags (43c38a7)

Bug Fixes

• orchestrator: retire the legacy events queue in a way quorum queues accept (20ad2e5)
• ci: promote the image built from the promoted commit (e687b02)
• ci: run the ocpp-core v16, v21 and mock-db tests, and test feature branches (5229a21)
• ocpp16: the Ended event carries the stop register, and the session energy beside it (f22417c)
• ocpp21: carry the station's reply on 2.1 command results (f1a1c75)
• ocppcore: carry TransactionEvent offline and seqNo into the platform event (41cc0ce)
• ocppcore: give every platform command an expiry; never dispatch an expired one (be701d7)
• orchestrator: a charger not heard from since restart is Unknown, not Offline (c381660)
• orchestrator: bound the events queue and set a consumer prefetch (db07c04)
• orchestrator: cool down typed rule actions, like legacy ones (266932d)
• orchestrator: ignore the events it publishes itself (93acc3e)
• orchestrator: keep rule updates across restarts and database errors (af8b0b5)
• orchestrator: learn a charger's OCPP version only from its own frames (710276d)
• orchestrator: publish persistently and wait for real broker confirms (4a50f99)
• orchestrator: queue a scheduled action once, not once per evaluation (cc6657b)
• orchestrator: say what a command timeout means, and count late results (06097c5)
• orchestrator: send rule commands in the charger's OCPP version (8af11f9)
• orchestrator: set the charging state from status and transaction events (fae14c6)
• readiness: carry configuredMaxAmps and every undeclared key through to the platform (f4777f5)

Features

• shared: carry the owning tenant on a PortalRequest (429e16a)

Bug Fixes

• recompute: keep a bucket whose baseline raw retention has deleted (5c82992)
• aggregation: count consumed energy once, whatever order samples arrive in (eefeb71)
• bus: treat tenantglobal as the platform tenant alias (1f0aff3)
• retention: delete whole UTC days and keep each connector's baseline readings (2133329)

Features

• aggregation: recompute canonical buckets the previous release got wrong, dry-run first (bba424e)

Bug Fixes

• auth: keep a token's 2.1 type, and never default a session token to Central (ccc4e3e)
• audit: follow long calls, and audit the WebSocket client task (6099bc3)
• auth: a pending RemoteStart wins over the auto token in every mode (4013e7a)
• auth: a reset hold lapses if the reboot never comes (30bf1ad)
• auth: admit a group's members to a group reservation (de2601c)
• auth: keep the station's auto token when SendLocalList replaces the list (c34c573)
• auth: report a session's idToken with the type it was authorised as (0b4436c)
• evse: a network drop no longer ends a running start-of-session wait (8471d70)
• evse: Charge now after a stop resumes the open transaction (d66d4ef)
• evse: EVConnectionTimeOut defaults to 120 s (d931abc)
• evse: hold authorisation from a reset's end of session until the reboot (15873ca)
• evse: hold the connector after an unlock only if it released (9a0048f)
• evse: time out a remote start whose EV never connects, and clear it whole (8dfe3c1)
• hal: the WiFi scan worker no longer stops the radio from its PSRAM stack (6df2b5c)
• ocpp16: a CSMS transactionId of -1 is a transaction, not a given-up start (4b18ce3)
• ocpp16: a failed routing read no longer closes a session that is still charging (c36101a)
• ocpp16: deliver every transaction record, once, whatever the CSMS answers (1de588f)
• ocpp16: keep the transaction id of a StartTransaction.conf with no usable status (bddb199)
• ocpp16: record nothing a given-up start can never send, and drop the rest at once (2cf4f96)
• ocpp21: apply an AuthorizeResponse to the session it answers (01e50fe)
• ocpp21: keep 2.1 profiles enforced on older links, and say so (fafbc37)
• ocpp21: let a dynamic schedule update raise its profile's limit (134a6ab)
• ocpp21: measure charging-profile offline time on the monotonic clock (1871876)
• ocpp21: measure transaction limits and session time on one monotonic clock (c4f46fd)
• ocpp21: only pull dynamic schedule updates on a 2.1 link (1eed514)
• ocpp: a broken 1.6 store no longer disables the 2.x journal or blocks 1.6 for good (a9a387e)
• ocpp: a remote start never re-points a running session (b948402)
• ocpp: a transaction event carried as its frame keeps its place in line (0b3ac3c)
• ocpp: accept a 1.6 Charge now on a running session, as 2.x does (9581378)
• ocpp: an exception in a journal divert no longer taints later sends (c1ffc36)
• ocpp: deliver the transaction events older firmware parked for ever (b07bc4f)
• ocpp: end transactions with a stoppedReason the schemas define (dfec9b5)
• ocpp: journal transaction events when they happen, not when sent (8d794e4)
• ocpp: never spend transaction delivery attempts on a dead link (b9d0971)
• ocpp: report authorisation and charging-state changes truthfully; end a session before a reset (7976afd)
• ocpp: report remote starts and stops as RemoteStart and RemoteStop again (b828414)
• ocpp: report the AuthCtrlr behaviour the station actually has (394901d)
• ocpp: report this boot's reason only until a CSMS accepts it (7100c50)
• smartcharging: a CSMS TxDefaultProfile can only lower the UK default in RegulationCompliance (8e1cf0f)
• smartcharging: an expired profile no longer conflicts with its successor (def362c)
• smartcharging: apply CSMS TxDefaultProfiles at stack levels the product does not own (3cd7aa6)
• smartcharging: clear only the purpose asked for in the shared station-limit bucket (75fc6bc)
• smartcharging: convert watt limits with the phases this station draws on (3f97e44)
• smartcharging: delete a transaction's TxProfiles when it ends (909d11f)
• smartcharging: fall through to the next stack level when a profile is not running (86c4e55)
• smartcharging: hold the SQLite gate across charging-profile transactions (0ff0770)
• smartcharging: include the station's own ceiling in GetCompositeSchedule (8cbc042)
• smartcharging: keep a station-wide TxDefaultProfile at evseId 0 (2df0d70)
• smartcharging: let an accepted Charge Now start the session it was sent into (24c0082)
• smartcharging: re-evaluate the start-of-session profile wait while waiting (d90203e)
• smartcharging: stop accepting profiles the station would mis-apply (fc8952d)
• system-monitor: websocket_task's stack is in PSRAM (e14ce95)
• websocket: a deliberate client teardown takes the link down (0f21746)
• websocket: divert to the journal under the queue-ops lock, not across flash (a61adea)
• websocket: keep command replies across a reconnect to the same CSMS (7b15dfc)
• websocket: keep failover usable and register with each new CSMS (c287db1)
• ocpp16: count an unanswered transaction record, and return one the queue drops (a397032)
• ocpp16: name the session in readiness by the id the CSMS stops it by (6eeb08b)
• ocpp21: report a transactionLimit stop as the limit, and end it with the limit's reason (c820fa7)
• ocpp21: resume a transaction when the CSMS raises the limit that suspended it (e2a9968)
• smartcharging: never report an expired charging profile (08f2baf)
• websocket: answer a CSMS CALL only on the CSMS that sent it (8ae0ab9)
• websocket: hold the station's own messages at the Pending gate (def20ee)
• smartcharging: apply the UK default in SmartCharging until a managed plan is valid (38a92d0)

Features

• ocpp16: expose the charging mode as the ChargingMode configuration key (b276426)
• ocpp: accept the CSMS's rotated claim code (SetClaimCredentials) (a4c13c7)

Bug Fixes

• managed-charging: recognise a manual tariff source as chargepoint-api sends it (74e0ecd)
• commands: refuse a SetChargingProfile TxProfile with no transaction (e7a4b97)
• manual-session: send a 1.6 Charge Now as a RemoteStartTransaction with a valid idTag (8177dbf)
• charging-profiles: clear a deleted profile from the station (77bb498)
• charging-profiles: keep platform profile ids off 0, 1 and the site cap (b68ba61)
• portal-requests: refuse a device the path tenant does not own (4ae00ff)
• api: authenticate the internal performance-test route (5fb4e63)
• auth: never accept unsigned identity headers when any env says production (a7ba258)
• auth: time out the auth-api service identity request (08485c4)
• commands: a real result replaces ocpp-api's own expiry; sweep without holding the lock (5c3ae4c)
• commands: an accepted withdrawal clear no longer marks managed charging applied (7b173da)
• commands: an idempotency takeover cannot be undone by the original failing (6402448)
• commands: an Idempotency-Key is no longer stranded in_progress by a cancel or crash (311418c)
• commands: bound the command queue view and batch requests (15f89f2)
• commands: fail a poison outbox row alone, cap publish attempts, never reconnect on a return (5eb20d7)
• commands: hand a self-concluded result to the results queue when applying it fails (ff8f932)
• commands: let a real result replace a provisional timeout; gate side effects (d258bed)
• commands: match a tenant-mismatched result by command id and device (b5820e3)
• commands: prune old command_dispatch and published outbox rows (2e4d178)
• commands: renew the outbox lease per row and skip commands already closed (fe55817)
• commands: retry command results with backoff instead of dead-lettering on the second try (d79d398)
• commands: return the newest command history rows, oldest first (5417ebb)
• commands: scope caller-chosen command ids to the tenant and device (ff1484d)
• commands: sweep commands that never get a result; mark dispatched on publish (b02a444)
• hardware-config: send what is asked to unknown units, per registered version (5d02e3a)
• health: return generic dependency errors and log the cause (179ce7b)
• managed-charging: a preview no longer wipes the plan the station holds (ae11f52)
• managed-charging: address each station at its registered OCPP version (8e260fd)
• managed-charging: applying a plan keeps the Octopus Go boost in the state (227d544)
• managed-charging: count only the part of each Octopus Go window before departure (fd5354f)
• managed-charging: install every managed plan under the device's fixed id (cfde4bc)
• managed-charging: one fixed-id boost slot, shared and tracked by owner (8e5afd3)
• managed-charging: record a plan only once it is queued, and back off failed Sense runs (8757b2a)
• managed-charging: size plans to the charger's current ceiling, not its nameplate (c82366d)
• managed-charging: time out calls to chargepoint-api, vehicle-api and tariff-api (8d6ee59)
• migration: close the workflow state machine and stop leaking DB errors (3855461)
• mode-reconcile: re-send a managed plan under the device's fixed id (e50a826)
• mode-reconcile: registered version, checks before commands, truthful managed state (68e1198)
• portal-requests: send the owning tenant, so ocpp-core checks it too (e614426)
• profiles: refuse a create before storing it; send an update to the station (9730a17)
• profiles: require CHARGEPOINT_CONTROL to write charging profiles (d80b94c)
• rules: page include_global listings in the database (f5ffc9e)
• rules: publish rule events through a transactional outbox (ddf651b)
• rules: validate rule JSON as ocpp-orchestrator runs it, and cap its size (fb43191)
• schedule: send local windows as UTC, re-send before clock changes, fixed id (060723b)
• security-events: acknowledge under a write scope, as the signed caller (79e3d28)
• session-indicator: a stale revision is a failure, and resyncs the revision (315ca60)
• session-indicator: show progress only for a plan in force, on a fixed target (526ad8a)
• session-indicator: skip an unhandled event instead of panicking the consumer (e7d1d85)
• vehicle-sense: auto-apply only while the charger is in Smart Charging (72265bb)
• vehicle-sense: Charge Now holds Sense off only when its start took effect (5e3194e)
• managed-charging: forward empty tenant headers to chargepoint-api (185adf7)

Features

• profiles: express a 2.x charging-profile payload for the station's version (ac1b0d3)
• profiles: one fixed id per device for each platform profile, and the clear that moves a device onto it (af3577a)
• rules: add RULE_EVENTS_PUBLISH_ENABLED to switch off platform.rules events (320eeca)

Performance Improvements

• api: drop the discarded per-request tenant-api organisation lookups (c964d89)

Bug Fixes

• sync: keep only the direct-debit rate when Octopus publishes both (a769b20)
• auth: accept auth-api's v2 signed identity and refuse repeated identity headers (3f86d63)
• external-api: forward the caller's signed identity to chargepoint-api unchanged (b2308eb)

Features

• octopus: publish each location's tariff for reporting (837e13e)

1.21.0 (2026-09-26)

Bug Fixes

• events: acknowledge unsupported event types instead of requeueing them (b088780)

Features

• events: deliver chargepoint-api device transfer notifications (232cd27)

1.69.1 (2026-09-15)

Bug Fixes

• thermal: never build a readiness frame on the temp_case task (3c329aa)

Bug Fixes

• ocpp: stop platform outbox retry storm (d2b03e9)
• ocppcore: answer OCPP calls before running reconcile follow-ups (4c0d43f)
• ocppcore: align runtime overrides and apply message effects once (af0e0a6)

Features

• readiness: carry the die temperature, thermistor mV and current pair (02397ae)
• hardware-telemetry: carry the payload opaquely so readings stay firmware-only (eeaaf85)

Bug Fixes

• ocpp: stop platform outbox retry storm (d2b03e9)
• ocppcore: answer OCPP calls before running reconcile follow-ups (4c0d43f)
• ocppcore: align runtime overrides and apply message effects once (af0e0a6)

Features

• readiness: carry the die temperature, thermistor mV and current pair (02397ae)
• hardware-telemetry: carry the payload opaquely so readings stay firmware-only (eeaaf85)

Bug Fixes

• ocpp: stop platform outbox retry storm (d2b03e9)
• ocppcore: answer OCPP calls before running reconcile follow-ups (4c0d43f)
• ocppcore: align runtime overrides and apply message effects once (af0e0a6)

Features

• readiness: carry the die temperature, thermistor mV and current pair (02397ae)
• hardware-telemetry: carry the payload opaquely so readings stay firmware-only (eeaaf85)

Features

• telemetry: publish which slots of the CT window read at the midpoint (568ca40)
• thermal: cap a unit with an unusable temperature sensor at 16 A, not 8 A (f598e61)
• readiness: publish the ESP32 die temperature and raw thermistor mV (f03d2d6)
• readiness: publish the line current both ways from one ADC window (2bb4863)
• telemetry: publish the raw sensor evidence during a bounded capture (3936c93)
• hal: per-unit calibration gain for the outlet CT (7e25220)
• telemetry: publish the line CT's raw sample window (6eaa256)

Bug Fixes

• recovery: stamp a recovered Ended with the last journaled event's time, not boot time (24acdde)
• meter: integrate the interval that actually elapsed, not a nominal second (b9fc323)
• metering: timeSpentCharging counted milliseconds as seconds (488379e)
• ocpp: defer client certificate alarms until clock readiness (eff317a)
• adc: place each result in the sweep it belongs to, and publish the window's shape (33a4e20)
• websocket: answer CSMS calls ahead of the station's in-flight call (6d088ea)

Bug Fixes

• mode-sync: send one effective value per runtime variable (d0e27b1)

Features

• thermal: store and serve the ESP32 die temperature and raw thermistor mV (177ea37)
• hardware-telemetry: store the capture as jsonb and serve its history (76cfdd3)

Features

• catalog: seed the outlet CT calibration control (ce86a01)
• controls: expose the hardware telemetry capture under Device Controls (3e3679d)

Features

• support unassigned worklists and live Resend attachment CDN (546f00b)
• notifications: add fresh tenant-scoped message context (a947a5e)
• notifications: project revisioned delivery results (5def0c7)
• inbound: add bounded receiving and reply-token primitives (f58e551)
• email: project reconciled outcomes and resolve tenant senders (9db973a)
• inbound: add internal enquiry pilot and explicit email replies (7c4101d)
• inbound: review all sender classes without granting customer access (be79cc1)
• email: add tenant-bound CC contribution and reply threading (5637696)
• sla: add versioned business clocks and scoped SLA search (dbda735)
• attachments: expose tenant-scoped metadata for support UI (cbd7acc)
• queues: add scoped member reads and verified self enrollment (ee9235d)
• service: import inbound attachments and extend support context contracts (8c6cc5a)

Bug Fixes

• security: remove unused legacy S3 TLS dependencies (731cb6a)
• security: upgrade Service Rust toolchain and patched S3 SDK (4c39808)
• inbound: bound CID retrieval and clarify routing trust (b28747a)
• inbound: qualify expired lease cleanup by tenant and provider (b6ff6b4)
• email: exclude public support addresses from CC contributors (c9297c6)
• email: fence stale CC drafts with private case revisions (8d99938)
• inbound: normalize Resend reply references and forwarding hops (58575cc)
• auth: require SLA read scope on search projections (38d47d3)
• sla: bind item responses to the concrete route context (8d06157)

Features

• hardware-telemetry: carry the payload opaquely so readings stay firmware-only (eeaaf85)
• readiness: carry the die temperature, thermistor mV and current pair (02397ae)