samgbafa · Nov 3, 2026 · Nov 3, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,8 +2,12 @@
 
 ## [Unreleased]
 
+## [1.25.17] - 2026-11-03
+
 ### Changes
 - A KV put or delete on `/invoke` records its invocation-replay row in the write's own transaction instead of before it. A write that rolls back (a lost connection before `COMMIT`, a refused authorization) no longer spends the signed request, so the identical request can be sent again. A write refused by its `If-None-Match`/`If-Match` precondition (`412`) commits only the replay row, so that request answers `409` from then on and cannot be resent without the unsigned header. A write that commits still answers the same request `409`, and identical requests racing each other commit once. Reads, decrypt and `space/info` are unchanged. A replayed write is now refused after its upload is staged rather than before it. Details: TC-2375
+- KV put authorization now runs before quota and hosting checks. Details: TC-2389 (#503)
+- Revocation refusals carry stable machine-readable codes, and delegation status reports Policy/v3 root revocation. Details: TC-2381 (#506)
 
 ## [1.25.16] - 2026-11-02
 

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/test/m1-realdata-e2e/Cargo.lock b/test/m1-realdata-e2e/Cargo.lock
diff --git a/tinycloud-node-server/Cargo.toml b/tinycloud-node-server/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "tinycloud-node"
 build = "build.rs"
-version = "1.25.16"
+version = "1.25.17"
 authors = ["TinyCloud Protocol"]
 edition = "2021"
 description = "TinyCloud Protocol Node"