docs: record rstack dev recovery, error envelope and run keys in the changelogs

The platform changelog names what rstack dev gained before its first
release: stop --recover, the registry.rstack.error.v1 envelope with its three
classes and exit codes, and a per-run key for projects with encrypted fields.

The BReg entry for the long-envelope fix is rewrapped and names the history
journal capture of reviewed migrations, which reads through the same decoder.
The field-encryption flip test now seals values whose envelopes PostgreSQL
wraps, so that path is covered.

The PostGIS provisioning test also checks that the bbox role batch keeps the
SQLSTATE of a refused statement.

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Author: jeremi

crates/registry-breg/tests/postgres_migration.rs

@@ -4481,8 +4481,11 @@ async fn real_postgres_field_encryption_flip_seals_resumes_and_drops_the_plainte
     let active = apply(&database, &initial, ApplyPrecondition::InitialActivation)
         .await
         .expect("flip scenario initial package activates");
+    // Each value seals to an envelope longer than 57 bytes, whose base64
+    // PostgreSQL breaks across lines, so the journal capture of every sealed
+    // chunk decodes a wrapped projection.
     let secrets = (0..5)
-        .map(|index| format!("flip-secret-{index}"))
+        .map(|index| format!("flip-secret-{index}-{}", "long-envelope-".repeat(6)))
         .collect::<Vec<_>>();
     seed_flip_rows(&database, &prior, &secrets, true).await;
 

crates/registry-breg/tests/postgres_spatial_migration.rs

@@ -29,9 +29,9 @@ use registry_breg::package::{
 };
 use registry_breg::postgres::{
     begin_record_transaction, install_compiled_schema, managed_schema_fingerprint,
-    provision_postgis_prerequisites, verify_catalog_identity_for_catalog, verify_postgis,
-    ClaimContext, ExpectedManagedCatalog, ExpectedRegistryIdentity, PostgresFailure,
-    PostgresKernelError, RegistryLockKey, SqlIdentifier,
+    provision_postgis_prerequisites, provision_spatial_bbox_role,
+    verify_catalog_identity_for_catalog, verify_postgis, ClaimContext, ExpectedManagedCatalog,
+    ExpectedRegistryIdentity, PostgresFailure, PostgresKernelError, RegistryLockKey, SqlIdentifier,
 };
 use registry_breg::startup::{prepare_startup, StartupError};
 use registry_breg::CompiledRegistry;
@@ -2693,15 +2693,28 @@ async fn postgis_provisioning_keeps_the_sqlstate_of_a_refused_statement() {
     )
     .await
     .expect_err("a role without schema creation rights cannot provision PostGIS");
+    assert_insufficient_privilege(&error);
+    // Nor may it create roles, so the bbox role batch is refused too.
+    let error = provision_spatial_bbox_role(
+        &unprivileged,
+        &database.migration_role,
+        &database.runtime_role,
+    )
+    .await
+    .expect_err("a role without role creation rights cannot provision the bbox role");
     task.abort();
-    match &error {
+    assert_insufficient_privilege(&error);
+    database.cleanup().await;
+}
+
+fn assert_insufficient_privilege(error: &PostgresKernelError) {
+    match error {
         PostgresKernelError::Statement(failure) => {
             assert_eq!(failure.sqlstate.as_deref(), Some("42501"));
         }
         other => panic!("expected a statement failure, got {other:?}"),
     }
     assert!(error.to_string().contains("42501"), "{error}");
-    database.cleanup().await;
 }
 
 async fn cleanup_postgis_prerequisites(database: &TestDatabase, bbox_role: &SqlIdentifier) {

products/breg/CHANGELOG.md

@@ -25,8 +25,11 @@
   field encryption failed a record, list, snapshot or revision read with
   `503 source.unavailable` once a stored value was long enough for its
   encrypted envelope to exceed 57 bytes, and the value could not be read
-  until this fix. Writes and shorter values were unaffected. The fault was in the read path since v0.33.0, through v0.46.0; no
-  stored data changes and nothing needs migrating.
+  until this fix. A reviewed migration whose history journal capture read
+  such a value, such as a field-encryption flip that sealed one, failed its
+  apply, because the capture uses the same decoder. Writes and shorter values
+  were unaffected. The fault was in the read path since v0.33.0, through
+  v0.46.0; no stored data changes and nothing needs migrating.
 
 ## 0.46.0 - 2026-11-08
 

products/platform/CHANGELOG.md

@@ -6,6 +6,18 @@
   projects together against a PostgreSQL server you supply. See
   [PROJECT-DEV.md](PROJECT-DEV.md). It is an alpha developer tool and may
   change.
+- `rstack dev stop RUN_ID --recover` releases a run whose supervisor is gone.
+  It stops each recorded process group whose leader still has the start time
+  recorded for it, drops the run's databases and roles, and removes the run
+  directory. Running it again after a partial failure is safe.
+- With `--json`, every `rstack dev` refusal or failure prints one
+  `registry.rstack.error.v1` object, published as
+  `schemas/rstack-dev-error.v1.schema.json`. Its `error.class` is `domain`
+  (exit 1), `usage` (exit 2) or `operational` (exit 3); a run that still holds
+  resources adds its `run_id` and a `recovery` object.
+- A BReg project with encrypted fields runs under `rstack dev` without extra
+  setup. Each run draws its own development data key into its run directory,
+  readable only by your user, and the key is removed with the run.
 
 ## 0.46.0 - 2026-11-08