changelog fixes (#1002)

* changelog

* move log formatting fixes to correct version

1 files changed, 14 insertions, 4 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 84c0ae8ac..f9867e815 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,7 +19,6 @@
 - Improvement: Trace viewer HTML/JS frontend bundled via `zen` frontend zip build rule; `ZipFs` moved from `zenserver` into `zenhttp` for reuse
 - Improvement: Replaced `OperationLogOutput` with `ProgressBase` in `zenutil`; logging and progress reporting are now separate concerns. Operation classes receive a `LoggerRef` for logging and a `ProgressBase&` for progress bars
 - Improvement: New `ZEN_SCOPED_LOG(Expr)` macro routes `ZEN_INFO`/`ZEN_WARN`/`ZEN_DEBUG` in the enclosing block through the given logger expression instead of the default
-- Improvement: Log formatting updated with elapsed timestamps, short level labels, and consistent field order
 - Improvement: `BuildContainer`, `SaveOplog`, and `LoadOplogContext` now take a caller-provided `LoggerRef` so diagnostic messages route through the caller's logger
 - Improvement: `zen` CLI progress bar pins to the bottom of the terminal so log output can scroll above it; `--verbose` no longer forces plain progress output
 - Improvement: `zen down --data-dir` probes lock-file liveness instead of presence; stale lock files are cleaned up and the command reports "nothing to do" instead of failing
@@ -40,12 +39,21 @@
 - Improvement: S3 client fails fast with a "no credentials available" error when AWS credentials are missing, instead of sending an unsigned request that S3 rejects with a generic 400
 - Improvement: IMDS credential provider retries transient connection failures (up to 3 attempts with backoff)
 - Improvement: HTTP clients with `RetryCount > 0` also retry on `CURLE_COULDNT_CONNECT`
-- Bugfix: Fix Windows service shutdown signalling so it works as intended again
+- Improvement: `zen cache` subcommand supersedes old flat style cache commands; old names remain as hidden deprecated aliases
+  - `zen cache info` replaces `zen cache-info`
+  - `zen cache stats` replaces `zen cache-stats`
+  - `zen cache details` replaces `zen cache-details`
+  - `zen cache gen` replaces `zen cache-gen`
+  - `zen cache get` replaces `zen cache-get`
+  - `zen cache drop` replaces `zen drop`
+  - `zen cache record <path>` replaces `zen rpc-record-start`
+  - `zen cache record stop` replaces `zen rpc-record-stop`
+  - `zen cache replay` replaces `zen rpc-record-replay`
 - Bugfix: `builds download` partial-block fetch decisions now account for build storage host latency
 - Bugfix: Transfer rate displays in `builds` commands now smooth correctly
 - Bugfix: Structured cache PUT errors with a detail body no longer write the HTTP response twice
 - Bugfix: Structured cache endpoints now return 405 Method Not Allowed for unsupported verbs instead of hanging the client
-- Bugfix: `exec$/replay-recording` now clamps `thread_count` to at most `max(HW concurrency * 4, 64)` so a bogus value cannot spawn an unbounded thread pool
+- Bugfix: `exec$/replay-recording` now clamps `thread_count` to at most `max(HW concurrency, 16)` so a bogus value cannot spawn an unbounded thread pool
 - Bugfix: `zen builds download --download-spec-path <file>` now resolves the manifest path relative to `--local-path` when relative; previously the computed absolute path was discarded and the file was looked up relative to the current working directory
 - Bugfix: `zen project oplog-export --builds-metadata-path <file>` now fails with a descriptive error when the metadata JSON is malformed; previously a JSON parse failure was silently ignored and a truncated compact-binary payload was shipped to the server
 - Bugfix: `zen project oplog-mirror` now rejects filenames from the remote oplog that could escape the mirror root (absolute paths, drive letters, UNC / device path prefixes, or `..` components); previously a malicious or compromised remote oplog could cause writes to arbitrary filesystem locations
@@ -54,6 +62,7 @@
 - Bugfix: `zen cache get` now requires `--output-path` unless `--as-text` is set; previously an empty path silently wrote a file named after the value key / attachment hash into the process's current working directory
 - Bugfix: `zen project oplog-export` and `oplog-import` "[builds] ..." description messages now print the actual builds URL; previously they showed the (often empty) cloud URL due to a copy-paste error
 - Bugfix: `zen` auth storage now uses a machine-specific random AES key/IV persisted to `<system-root>/auth/machinekey.dat` when `--encryption-aes-key`/`--encryption-aes-iv` are not supplied; previously a hardcoded constant visible in the source was used, letting anyone with source access decrypt persisted OIDC refresh tokens. Supplying only one of the two flags is now rejected rather than silently substituting the hardcoded default for the missing half. Existing auth state files will fail to decrypt once after upgrade and re-auth automatically.
+- Bugfix: Fix Windows service shutdown signalling so it works as intended again
 
 ## 5.8.5
 - Improvement: Session service and endpoint moved from storage server to base server class; now available in hub, compute, and proxy modes
@@ -88,7 +97,7 @@
 - Improvement: Dashboard paginated lists show a loading indicator while fetching data
 - Improvement: Hub dashboard navigates to and highlights newly provisioned instances
 - Improvement: `--consul-register-hub` option to disable hub parent service Consul registration while keeping instance registration active
-- Bugfix: Added logic to shared memory instance state management to ensure unclean shutdown followed by restart with identical pid doesn't lead to errors. Particularly likely to happen when running on k8s
+- Improvement: Log formatting updated with elapsed timestamps, short level labels, and consistent field order
 - Improvement: Dashboard service stats panes are now always visible on service pages (projects, cache, builds, workspaces) rather than hidden until data arrives
 - Improvement: Updated vendored MinIO test server from RELEASE.2025-07-23 to RELEASE.2025-09-07 (HTTP listener bugfixes, ListObject fix)
 - Improvement: HTTP client retries on `CURLE_PARTIAL_FILE` (truncated response) and logs the raw curl error code on retry
@@ -97,6 +106,7 @@
 - Bugfix: Dashboard stats tiles no longer flicker on page load when WebSocket updates arrive before all stats are available
 - Bugfix: Build storage operations now silence HTTP exceptions on aborted requests instead of logging spurious errors
 - Bugfix: Avoid use of `O_CLOEXEC` when operating on shared memory on Mac and Linux as it was reported to cause issues for MacOS 26.4 and later
+- Bugfix: Added logic to shared memory instance state management to ensure unclean shutdown followed by restart with identical pid doesn't lead to errors. Particularly likely to happen when running on k8s
 
 ## 5.8.3
 - Feature: Incremental CAS-based hydration/dehydration replacing the previous full-copy approach