2.19.0

Investigations are now charged a hold when queued and settled when they finish. ai_credit_cost() prices an investigation at its hold — eight times the persona weight, plus the per-reference surcharge, plus one credit per allowed web search — so the charge triggers, the reprice and the balance check all reserve the most an investigation can cost. The new service-role-only settle_investigation_credits() works out the real cost from the provider's token counts and search count (ai_investigation_credit_settlement(): one persona weight per 7,000 tokens of input plus five times output, plus one credit per search, never below the old flat price and never above the hold) and returns the rest as a refund linked to the charge through the new ai_credit_entries.settles_entry_id. Settling twice refunds nothing more, and a failure after settling still refunds the rest. New task_investigations.pricing, max_output_tokens and web_search_limit columns record the budget each charge covered. A new set_investigation_budget() trigger sets them from the persona whenever a row is queued or queued again (4,800 tokens, and three searches for a paid Anthropic, OpenAI or OpenRouter persona) and ignores values a client sends. Rows queued before this migration keep the flat price, a 1,200-token budget and no search. The claim now also requires a metered_pricing capability for a metered row (investigation_row_capabilities()), so a worker built before this change leaves those rows in pending instead of never settling them. Apply the migration before deploying the web app. (#622)

Added the admin-only user_ai_spend_report() function. It totals the credit ledger per account for one of the last six UTC calendar months, by when each entry was recorded, with a bounded page and totals taken over every account before the page is cut. A month is accepted with five minutes' tolerance for clock differences between the web server and the database, and an account's subscription status is its entitling subscription's, as billing chooses it. ai_credit_entries.created_at is now indexed for it. Neither this report nor system_ai_spend_report() goes back before August 2026, when AI spend metering began, so the platform report no longer lists earlier months as zero spend. (#608)

Added task_investigations.page_urls, the web pages an investigation references. A CHECK constraint (investigation_page_urls_are_valid()) accepts only distinct http(s) URLs without whitespace, up to 2,048 characters, none of them also listed in images, and at most ten links across images and page_urls together — the same budget the route enforces, repeated here because the table is writable through PostgREST. ai_credits_charge_investigation() counts pages in the per-reference surcharge alongside images and attachments. A new guard_investigation_references() trigger refuses a signed-in user's change to images, attachment_ids or page_urls unless the same update queues the row again, so the worker can no longer be handed references that were added to a pending row after it was charged; that gap already existed for images and attachments. Both page_urls and attachment_ids must now be one-dimensional, since a multidimensional array was priced on its first dimension only. claim_next_capable_task_investigation(text[]) hands a row to a worker only when the worker lists every capability the row needs (investigation_required_capabilities(): page_urls for a row with pages), and the no-argument claim_next_task_investigation() now claims only rows that need none, so a worker deployed before this change leaves page investigations in pending instead of answering them without the pages. Apply the migration before deploying the web app; the web app and the worker can then deploy in either order. (#601)

Added party_emails and feedback_emails to notification_preferences, both on by default. update_my_notification_preferences() accepts both, and the one-click unsubscribe function accepts the party and feedback categories. The new service-role-only prepare_notification_email() tells the web app whether it may email an account now — only confirmed, live, non-anonymous, unbanned accounts with an address that have not turned the category off — and returns the address, display name and unsubscribe token to use, creating the preference row the first time it is needed. The new add_guild_to_quest_party_seats() seats a guild roster with the same checks as add_guild_to_quest_party() but returns the seats that call created, so the app emails exactly those accounts even when another add or invite runs at the same time; add_guild_to_quest_party() still returns a count, for deployments built before it. Apply both migrations before deploying the web app. (#571)

Added feedback.notification_claimed_at, a service-role-only reservation for the feedback status email. A request claims the row before sending, so two concurrent triage updates can no longer both email the submitter; a claim older than ten minutes can be taken over. Apply the migration before deploying the web app. (#628)

investigation_page_urls.sql covers the page shape rules, the charge for every mix of images, attachments and pages, refusals of invalid page lists written straight through PostgREST, the reference guard in both directions, and the refund when the worker fails a page investigation. pgTAP also covers one-dimensional reference lists and the capability-gated claim, including that the legacy claim never hands out a page investigation. Worker tests cover compressed responses, cancellation, page text extraction, character-set decoding, ordering, truncation, unreadable pages and the prompt the model receives; route and dialog tests cover link classification, pricing, the shared budget and the legacy field. (#601)

pgTAP covers the report's admin check, month window, UTC boundaries, both funding origins, refunds, excluded top-ups and adjustments, idle accounts, ordering, pagination bounds and totals; Vitest covers the query and page states; and a live Playwright spec covers the admin view and the non-admin redirect. (#608)

party_and_feedback_emails.sql covers who prepare_notification_email() will and will not email, token creation and reuse, the two new categories through the preference function and their unsubscribe links, and the function's privileges, and that a guild add reports only the seats it created; rls.sql adds the privilege boundary. Vitest covers the Resend wrapper, the template registry, sendNotification() with an opted-out recipient, missing configuration and provider failures, the bounded concurrency of sendNotifications(), the feedback path refactored onto it, both Party Quest add paths, and the preference form and parser. The Playwright preference spec covers the new unsubscribe categories and the profile in each flag state. (#571)

rls.sql covers the new claim column and that an admin client cannot write it; Vitest covers the claim, the lost race, a failed claim, the release after a skipped, failed or thrown send, and the stamp that clears the claim. (#628)

docs/ai-investigations.md describes how a reference link becomes an image or a page, what the worker refuses to fetch, and how pages are priced and refunded. (#601)

docs/admin-user-ai-spend.md sets out the report's accounting rules: estimated spend only, refunds counted in the month they are recorded, top-ups and adjustments excluded, and plan status as it stands today. It also lists what reporting actual cost and revenue would require. (#608)

docs/notifications.md describes both email senders, the per-category preferences, the web app's send path and how to add an email; .env.example and docs/ops/deployments.md document NEXT_PUBLIC_FEATURE_PARTY_EMAILS and the web app's use of RESEND_API_KEY and FROM_EMAIL. (#571)