docs(changelog): fold Unreleased into 0.7.0, and write up the thirty PRs it was missing

[rainmanjam]

Found while checking for deltas before tagging v0.7.0. Two problems, and the first would have shipped a release whose own changelog contradicted its security advisories.

1. [Unreleased] sat above [0.7.0]

Keep a Changelog puts newest first, so its contents were newer than the release below them. What was sitting there: the stream-key sealing, the scrub fixes, and Twitch Enhanced Broadcasting — precisely what GHSA-7jqx-76vq-hvfc names as "fixed in 0.7.0".

Tagging as it stood would have published an advisory pointing at a release whose changelog did not mention the fix.

2. The file stopped at issue #326

Verified by concept rather than by number, because entries cite issues and not pull requests — a PR-number check reports a false 60/60 missing:

Concept	Occurrences before
maxrate / bufsize (#341)	0
fps_mode (#342)	0
"strength meter" (#346)	0
secret.key (#347)	0
"Rumble" (#312)	0

Roughly thirty merged PRs, including a data-loss guard on upgrade an operator needs to read before upgrading.

Checking below #327 for the same reason found two more: the services platform registry, and the five live acceptance suites — a headline of this release, since each of the first three found a defect on its first live run that no unit test could reach.

What this does

• Folds [Unreleased]'s Security and Added into [0.7.0], leaving Nothing yet.
• Writes up test(engine): a respawn gate that waits on a feed which has not started yet (#290) #327–ci: a skipped matrix job creates no per-leg contexts, so #351 made docs-only PRs unmergeable #357 across Security, Added, Changed, Fixed and Testing
• Adds the services registry, Rumble, and the five live suites

Net: 70 bullets in 0.7.0, up from 45.

The prose is moved, not retyped

The fold is done programmatically and asserts:

old lines dropped:                 0
0.6.0-and-older byte-identical:    True
malformed links:                   0

Both assertions hold. Nothing in the existing changelog was rewritten by hand, so nothing could be silently reworded.

One correction worth recording

Five entries cited /issues/N for what are actually pull requests. My first check used gh issue view, which resolves a pull request happily — so it passed. The check that caught it asks the API whether the object carries a pull_request field. All 33 links in the diff are now verified against that.

Still open, and stated in the file rather than omitted

Nothing proves an OAuth refresh succeeds, and no chat suite performs a valid login. Both steps are written and skipping until an account is connected, so the hour-four token failure is bounded from one side only. The Testing section says so.

https://claude.ai/code/session_01HeLrWaDmsNeeNSbHQfEofX

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Updates the project changelog in preparation for tagging v0.7.0, ensuring the release notes accurately reflect fixes (including security-related items) and the full set of merged work included in the release.

Changes:

• Moves the prior [Unreleased] Security/Added entries into the [0.7.0] section and leaves [Unreleased] as “Nothing yet.”
• Expands the [0.7.0] notes to cover the previously missing set of items (#327–#357) across multiple categories (Security/Added/Changed/Fixed/Testing).
• Updates/aligns the version comparison links so [Unreleased] now compares from v0.7.0.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.