diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7bbeaa1..a866326 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,44 @@
 # Changelog
 
+## 0.7.31 — 2026-09-01
+
+### Fixed
+- **A declared `id: integer` is server-assigned and out of the create body — exactly like an omitted `id` (#302).**
+  `docs/ai/00-designing.md` promised the two were equivalent; the generator honored it only for an *omitted* id, so a
+  declared integer pk leaked into `{Entity}Request` as required client data (`id: Set(item.id)`) — a client could not
+  `POST` and let the database assign the id, and a fixed-body bulk create collided on the pk. One shared discriminator
+  (`Entity::id_is_server_assigned`) now drives all six codegen sites (the model/DTO id default, both `active_sets`
+  variants, the OpenAPI component + create schema, and the testgen probes); `tenancy_create_pk_override` — the seed-dodge
+  that had kept this green — is gone. `string`/`uuid` pks are byte-identical.
+- **`migrate --from supabase`: native `CREATE TYPE … AS ENUM` columns translate to `field.values`, preserving their seed
+  data (#303).** A schema-defaulting asymmetry stored enum keys as `public.status` while an unqualified column type
+  resolved to bare `status`, so the common Supabase form never matched, hit the "no deterministic design type" dead end,
+  and left a hollow id-only entity that silently dropped those seed columns. Both enum forms now share the inline
+  `CHECK IN` path.
+- **`migrate --from supabase`: the `users` module + JWT auth are emitted only when `auth.users` is in the export.** They
+  were emitted unconditionally, handing a no-auth source `register`/`login`/JWT it never had. The gate also counts an fk
+  to `auth.users` or a `data/auth.users.csv` (a `--schema public` dump drops the DDL but keeps the references). A source
+  with RLS/tenancy but no `auth.users` keeps `jwt` without an identity surface and raises a blocking gap — never silently
+  dropped, never widened. Normal exports are byte-identical.
+- **`migrate --from supabase`: the pg_cron `jobname/schedule/command` dump the docs prescribe is accepted, alongside
+  `cron.schedule()`.** The documented `\copy … from cron.job` export emits TAB-separated rows the migrator rejected as a
+  blocking `cron_job` gap. Both forms share one `emit_job`; `cron.schedule()` output is byte-identical, line numbers
+  included.
+- **A multi-role `required_roles` emits a compilable `require_any_role` guard.** A 2+-role endpoint (accepted by
+  `check`) generated `require_role("admin", "editor")` — a call no signature accepts — steering an agent to a compile
+  error or to silently dropping roles. `jerrycan-auth` gains a free `require_any_role(actual, &[&str])` mirroring
+  `Tenant::require_any_role`; single-role output is byte-identical.
+- **`jerrycan-db`: the Postgres pool size is configurable via `JERRYCAN_DB_POOL_SIZE` (#305).** It was hardcoded to 5. A
+  positive value wins verbatim; unset, unparseable or zero falls back to `max(5, available_parallelism × 2)`. SQLite
+  stays single-connection.
+- **The manual matches shipped behavior.** A FK violation is `422 JC0422` (not `500`, since #296); the declarative field
+  constraints (`min`/`max`/`min_len`/`max_len`, #80) exist — `09-validation` claimed they did not; a non-`User` auth
+  identity is supported with full owner-scoping (#150) — `00-designing` said it MUST be `User`; the generated jobs
+  concurrency is 2. Embedded copies synced.
+- **`Cargo.lock`: `chacha20` 0.10.1 → 0.10.2.** The 0.10.1 release was yanked upstream (transitive via
+  `rand → tungstenite → jerrycan-realtime`) and `deny.toml`'s `yanked = "deny"` correctly failed every PR until the
+  bump. `jerrycan-auth`'s separate `chacha20 0.9.1` line is unaffected.
+
 ## 0.7.30 — 2026-08-10
 
 ### Fixed
diff --git a/Cargo.lock b/Cargo.lock
index 0eb2c71..7ec3813 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1382,7 +1382,7 @@ checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "jerrycan"
-version = "0.7.30"
+version = "0.7.31"
 dependencies = [
  "clap",
  "jerrycan-auth",
@@ -1408,7 +1408,7 @@ dependencies = [
 
 [[package]]
 name = "jerrycan-auth"
-version = "0.7.30"
+version = "0.7.31"
 dependencies = [
  "argon2",
  "base64",
@@ -1437,7 +1437,7 @@ dependencies = [
 
 [[package]]
 name = "jerrycan-core"
-version = "0.7.30"
+version = "0.7.31"
 dependencies = [
  "bytes",
  "criterion",
@@ -1455,7 +1455,7 @@ dependencies = [
 
 [[package]]
 name = "jerrycan-db"
-version = "0.7.30"
+version = "0.7.31"
 dependencies = [
  "jerrycan-core",
  "sea-orm",
@@ -1467,7 +1467,7 @@ dependencies = [
 
 [[package]]
 name = "jerrycan-jobs"
-version = "0.7.30"
+version = "0.7.31"
 dependencies = [
  "jerrycan-core",
  "jerrycan-db",
@@ -1479,11 +1479,11 @@ dependencies = [
 
 [[package]]
 name = "jerrycan-macros"
-version = "0.7.30"
+version = "0.7.31"
 
 [[package]]
 name = "jerrycan-observe"
-version = "0.7.30"
+version = "0.7.31"
 dependencies = [
  "jerrycan-core",
  "tokio",
@@ -1493,7 +1493,7 @@ dependencies = [
 
 [[package]]
 name = "jerrycan-ratelimit"
-version = "0.7.30"
+version = "0.7.31"
 dependencies = [
  "http",
  "jerrycan-core",
@@ -1503,7 +1503,7 @@ dependencies = [
 
 [[package]]
 name = "jerrycan-realtime"
-version = "0.7.30"
+version = "0.7.31"
 dependencies = [
  "bytes",
  "futures-core",
@@ -1523,7 +1523,7 @@ dependencies = [
 
 [[package]]
 name = "jerrycan-storage"
-version = "0.7.30"
+version = "0.7.31"
 dependencies = [
  "bytes",
  "hmac",
@@ -1547,7 +1547,7 @@ dependencies = [
 
 [[package]]
 name = "jerrycan-validate"
-version = "0.7.30"
+version = "0.7.31"
 dependencies = [
  "jerrycan-core",
  "serde",
diff --git a/Cargo.toml b/Cargo.toml
index eb84ed4..51ad4a5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -16,7 +16,7 @@ members = [
 exclude = ["fuzz"]
 
 [workspace.package]
-version = "0.7.30"
+version = "0.7.31"
 edition = "2024"
 license = "MIT"
 homepage = "https://jerrycan.cc"