Changes

• Feed and chat text is escaped by default: one FeedMarkdown builder for every feed and chat sink
  • PR: #4539
• fix(permissions): a write's new parents and listed records follow the caller's read, and a create keeps to its permission's scope
  • PR: #4540
• fix(sso): new projects and provider writes by filter keep a way in; changes that let people sign in reach every server
  • PR: #4545
• feat(ai-insights): create a monitor from an insight, and sort the insights list
  • PR: #4544
• Say when an AI request outgrew the model's context window (Ollama num_ctx)
  • PR: #4547
• A failed state change gives its lock back, and a saved one always updates its event
  • PR: #4548
• fix(push): browsers register for push notifications again, and Register Device says what to do when they can't
  • PR: #4549
• fix(notification-methods): the verify dialog says what really happened to the code, sends a new one itself, and an SMS-verified number is verified for calls
  • PR: #4550
• fix(metrics): a chart filtered to no resource overlays only the incidents and alerts raised on its metric
  • PR: #4546
• Show synthetic monitor screenshots in Slack and Microsoft Teams
  • PR: #4551
• fix(scheduled-maintenance): a state of your own between Ongoing and Ended counts as in progress everywhere
  • PR: #4554
• fix(dashboard): drop the page-load service worker registration every browser refused
  • PR: #4555
• The record a write names, and a change of labels, keep to the caller's permissions
  • PR: #4552
• fix(sso): sign-in changes write only the rows they checked, and hold their locks until written
  • PR: #4556
• Terraform: server-owned monitor step ids, natural type names, lookups by any argument, and docs from the provider's schema
  • PR: #4557
• Web push: renew a browser's subscription when it changes, and stop sending to gone ones
  • PR: #4558
• feat: evaluate synthetic/custom-code monitor criteria against object/array result fields
  • PR: #4553
• fix(permissions): who owns a record, and the settings a record names, stay inside the caller's reach
  • PR: #4560
• More settings is one card: its cards are sections with dividers, everywhere
  • PR: #4565
• feat(workflows): Send Message to IRC
  • PR: #4561
• fix(markdown): a notification goes out whatever size of text it carries
  • PR: #4566
• fix(sso): a change to who can sign in with SSO keeps what its check saw until it is written
  • PR: #4567
• feat(network): a simpler Network area - health verdict Overview, one-page Add Device, two-step scans, five-row menu
  • PR: #4568
• AI Insights pages lead with what is worth knowing about your system, not a log of AI's work
  • PR: #4570
• The pull-request switches are children of "Fix new incidents/alerts automatically" and turn on with it
  • PR: #4572
• Terraform knows custom_code_monitor_options: a Result Value filter's field path survives apply, import and export
  • PR: #4573
• Phone numbers follow the incoming call policy roles; Slack and Teams create forms act as the connected member
  • PR: #4574
• Docs overhaul, part 1: components, diagrams, a nine-section sidebar and 70 rewritten pages
  • PR: #4559
• Release gate for 14.0.23 (DO NOT MERGE)
  • PR: #4562