[Feature] MySQL Governor matured into a full plan-aware product: empty MySQL CPU/IO on packages and users inherit package limits; optional advanced overrides; per-plan/per-user disable MySQL Governor; independent vs shared package CPU policy.

[Feature] Governor session memory protection — configurable session buffer ceilings (sort_buffer, join_buffer, tmp/heap tables, query time) via init_connect + durable config. Plugin SET guard kills oversized session SETs and can restrict the account (cause=session_memory).

[Feature] Always-on max_user_connections for mapped MySQL logins while Governor is enabled, plus faster response to heavy patterns (e.g. ORDER BY RAND() fuse) and slow-query kill enabled by default.

[Feature] Usage model and UI split into Account | MySQL | Total (account cgroup vs MySQL/db cgroup — never labeled “web”). Admin monitor, enduser dashboard/resource usage, and governor state expose the same naming.

[Feature] Expanded simuzo_gov plugin matrix: MySQL 8.0 / 8.4 / 9.7 and MariaDB 10.6 / 10.11 / 11.4 / 11.8. MariaDB-safe query-time limits (max_statement_time vs MySQL max_execution_time). Multi-target Podman builds for portable plugin binaries.

[Feature] SecureLinks multi-OS build pipeline (Podman): AlmaLinux 8/9/10 and Ubuntu 22.04/24.04/26.04 targets, plus one-shot build for a specific client kernel for the Softaculous mirror catalog.

[Improvement] SecureLinks kernel policy updated for rootless Podman: capability checks use the process user namespace; image/rootfs symlinks owned by the host account (userns owner) are allowed for mapped subuids while cross-account foreign symlinks still deny.

[Improvement] Podman Compose security: structured (AST) YAML validation, bind-mount allowlist (home/project/named volumes only), host directories created as the enduser (not root), and the same checks on compose save and deploy/action workers.

[Improvement] cgroup placement no longer moves systemd --user, sd-pam, or user dbus into the Simuzo tree — they stay on stock user.slice / user@ paths so linger, user services, and Podman remain healthy. Workloads continue under simuzo/<user>-uid for limits.

[Improvement] Resource plan and Users admin UIs: MySQL Governor options (disable, MySQL CPU/IO override, CPU policy), Webuzo resource-limit conflict handling, and related theme polish.

[Improvement] Governor setup, dbmap, CLI (sync-session-limits, sync-connections, sync-all, feed-test), and automated tests expanded; rebuilt simuzo-procmon and plugin binaries as applicable.