- Shared pgx/GORM pool, ICU locale fail, and isolated plugin migrations - Seven-stage middleware order, missing-guard boot failure, typed 404s - Adversarial JWT matrix including alg:none, empty secret, and no leak Co-authored-by: Cursor <cursoragent@cursor.com>
- Reject identifiers and directions outside the caller allow-list - Emit ordinary ORDER BY without COLLATE so ICU pl-PL applies Co-authored-by: Cursor <cursoragent@cursor.com>