Add CHANGELOG; switch runbook rollback to tags

- CHANGELOG.md started (Keep a Changelog style), with the v0.1.0 release
  notes; versions track the git tags and __version__.
- Runbook §7 now deploys a specific tag (git fetch --tags && checkout
  vX.Y.Z) and rolls back to the previous tag, with a note that rollback
  reverts code not data (restore the data backup if a migration ran).

(The deploy kickoff brief lives in planning/, which is gitignored — it's a
local hand-to-the-agent note, not shipped in the repo.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -0,0 +1,48 @@
+# Changelog
+
+All notable changes to Daybook are recorded here. Format loosely follows
+[Keep a Changelog](https://keepachangelog.com/); versions are SemVer and match
+the git tags (`vX.Y.Z`) and `daybook_project.__version__`.
+
+## [Unreleased]
+
+_Nothing yet._
+
+## [0.1.0] — 2026-09-03
+
+First tagged release.
+
+### Artifacts & rendering
+- Artifact kinds: `markdown`, `html_fragment`, `html_full`, `deck`, `json`,
+  `csv`, `image`, `pdf`, `binary`.
+- `.xlsx` uploads convert server-side to a `csv` artifact (active sheet,
+  saved formula results).
+- Markdown code blocks get syntax highlighting; tables (markdown &
+  html_fragment) render styled — monospace cells, sans-serif headers.
+- `json`/`csv` render as an interactive collapsible tree / sortable table
+  (Grid.js + renderjson, vendored locally).
+- Unified off-white document background; system sans-serif body text.
+
+### API
+- `POST/GET/PATCH/DELETE /api/artifacts`, list filters (source/label/day/
+  kind/q), `/api/assets` image upload, `/api/capabilities` (reports
+  `version`). Per-user bearer-token ingest; session-authed reads.
+- Server-side validation: per-kind content shape, field length limits,
+  string-typed source fields, valid-JSON for `json`.
+
+### Sharing, quotas, security
+- Per-artifact public share links (`/s/{token}`), owner-toggled, revocable.
+- Per-user disk quotas with oldest-unkept auto-eviction and a Keep flag.
+- Allowlist HTML sanitization (nh3) + `script-src 'none'` CSP for the themed
+  kinds; deep-JSON parse errors return 400 (not 500).
+
+### UI
+- Multi-user auth; feed with source sidebar + label filtering; settings area
+  (Account, Storage, Demo Data, Users, About); light/dark toggle; app icon.
+
+### Deployment
+- Dockerised (Gunicorn + whitenoise), SQLite, `git`-based deploy with a
+  runbook (`deploy/cloud_agent_deploy.md`) and health check.
+
+[Unreleased]: https://git.cygnus.systems/peter/daybook/compare/v0.1.0...HEAD
+[0.1.0]: https://git.cygnus.systems/peter/daybook/releases/tag/v0.1.0

deploy/cloud_agent_deploy.md

@@ -202,25 +202,33 @@ Confirm the response includes `id`, `url`, and `api_url`, and that opening
 
 ## 7. Redeploy Loop (routine updates)
 
-This is the command you run every time you're asked to ship a new version:
+Releases are tagged `vX.Y.Z` (SemVer). Deploy a specific tag rather than a
+moving branch, so what's live is always a known, named version — and note
+the currently-deployed one before switching, for a clean rollback target:
 
 ```bash
 cd /opt/daybook
-PREV_SHA=$(git rev-parse HEAD)
+PREV_TAG=$(git describe --tags --exact-match 2>/dev/null || git rev-parse HEAD)  # what's live now
-git pull
+git fetch --tags
+git checkout v0.1.0        # the tag you were told to deploy (latest: git tag -l | sort -V | tail -1)
 docker compose -f deploy/docker-compose.yml up -d --build
 ```
 
-Then repeat the verification in step 6 (capabilities check at minimum). If it
+Then repeat the verification in step 6 (and confirm `/api/capabilities`
-fails:
+reports the `version` you expect). If it fails, roll back to the previous
+version and report the failure (build log / migration error / failed health
+check) rather than retrying blindly:
 
 ```bash
-git checkout "$PREV_SHA"
+git checkout "$PREV_TAG"
 docker compose -f deploy/docker-compose.yml up -d --build
 ```
 
-to roll back, then report the failure (build log / migration error / failed
+Caveat: rollback reverts code, not data — a release that already applied a
-health check) back to the operator rather than retrying blindly.
+DB migration may not cleanly downgrade against the migrated `db.sqlite3`.
+For a routine forward release that's fine; if a rollback is needed after a
+migration, restore the pre-deploy `deploy/data` backup (see §9) alongside
+the code checkout.
 
 `deploy/.env` and the data directory (wherever `DAYBOOK_HOST_DATA_DIR` points,
 or `deploy/data` by default) are untracked, so `git pull` never touches them —