v2.9.0

Connect onboarding return lands on /stripe-connect, not the portal root

crash-proof the Stripe webhooks and stop them double-sending or lying to Stripe

do not ack a Stripe webhook we could not durably record

drain gracefully on SIGTERM instead of dying mid-request on every deploy

keep WebSocket sessions alive with a server heartbeat, so guest live-updates stop dying

merchant.freeze(false) never unfroze anyone, freezing was a one-way door

publish the wallet-UI session gauge per pod, so it stops racing, drifting and expiring

route Connect onboarding return through /login?redirectPage=/stripe-connect

wire WebSocket onclose so closed sockets stop leaking, and stop dead sockets crashing the pod

make Stripe webhooks idempotent and durably logged

restore the one-way merchant freeze, it is an intentional security kill-switch