@serve.zone/appstore 33.15.0 → 33.16.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/appstore",
-  "version": "33.15.0",
+  "version": "33.16.0",
   "private": false,
   "description": "serve.zone App Store: the signed runtime catalog and its consumer loader.",
   "type": "module",
@@ -12,13 +12,11 @@
   "author": "Task Venture Capital GmbH",
   "license": "MIT",
   "dependencies": {
-    "@serve.zone/interfaces": "32.58.0",
+    "@serve.zone/interfaces": "32.60.0",
     "modern-tar": "0.8.5"
   },
   "devDependencies": {
-    "@git.zone/tsbuild": "^6.0.2",
-    "@git.zone/tsdoc": "3.0.2",
-    "@git.zone/tstest": "8.0.0",
+    "@git.zone/tsrepo": "^1.1.1",
     "@types/node": "26.6.5"
   },
   "files": [
@@ -48,11 +46,11 @@
     "cloudly"
   ],
   "scripts": {
-    "test": "tstest test/ --verbose --logfile --timeout 60",
-    "build": "tsbuild tsfolders && node dist_ts_publisher/cli.js build",
-    "build:release": "tsbuild tsfolders && node dist_ts_publisher/cli.js build --release",
-    "catalog:lock": "tsbuild tsfolders && node dist_ts_publisher/cli.js lock",
-    "catalog:trustedkey": "tsbuild tsfolders && node dist_ts_publisher/cli.js trusted-key",
-    "buildDocs": "tsdoc"
+    "test": "tsrepo test test/ --verbose --logfile --timeout 60",
+    "build": "tsrepo build tsfolders && node dist_ts_publisher/cli.js build",
+    "build:release": "tsrepo build tsfolders && node dist_ts_publisher/cli.js build --release",
+    "catalog:lock": "tsrepo build tsfolders && node dist_ts_publisher/cli.js lock",
+    "catalog:trustedkey": "tsrepo build tsfolders && node dist_ts_publisher/cli.js trusted-key",
+    "buildDocs": "tsrepo docs"
   }
 }

package/readme.md

@@ -37,7 +37,7 @@ The catalog lists 19 apps. Every image is pinned to the digest of its multi-plat
 | App ID | Name | App Store category | Latest | Image | Port |
 | --- | --- | --- | --- | --- | --- |
 | `adminer` | Adminer | Dev Tools | `1.0.0` | `adminer@sha256:74f29c416e148b98305e84446a18db7cd2c1038264dec464359d36774ef080ce` | `8080` |
-| `cloudly` | Cloudly | Dev Tools | `1.30.3` | `code.foss.global/serve.zone/cloudly@sha256:81b959285ed18de92aaba8c6c84c64e1c7ae618af39d3905ef229d3c331807f6` | `3000` |
+| `cloudly` | Cloudly | Dev Tools | `1.30.4` | `code.foss.global/serve.zone/cloudly@sha256:e8e0f2b5a9e3d7aff4ba3201e358e99900b5c3792c24873b3dc0b3cb3f921439` | `3000` |
 | `ghost` | Ghost | CMS | `1.0.0` | `ghost@sha256:9482099b1c8700764dc3d38c293e09c16d70f8bacc14af589c47d90b4bebd017` | `2368` |
 | `gitea` | Gitea | Dev Tools | `1.0.0` | `gitea/gitea@sha256:a9dc25679ebdd33356242d2e0667cc220043745e8339922879f187c20329a42e` | `3000` |
 | `grafana` | Grafana | Monitoring | `1.0.0` | `grafana/grafana@sha256:b28bae15e219c998fb0e0424ed724930cc61b1f61fb404d47c862f9a23f9e572` | `3000` |
@@ -68,7 +68,7 @@ Some templates ask Onebox to provision local platform services and inject connec
 
 | App ID | Requirements | Notes |
 | --- | --- | --- |
-| `cloudly` | MongoDB, S3 | Versions `1.30.3` and `1.29.7` run the Cloudly `33.21.3` image, which adds the forward-only data step `retire-corestore-environment-secrets` (data version `0.31.0` to `0.32.0`): a service migrated from Swarm reaches its object storage at its node's Corestore endpoint again, because the step retires the service-owned secrets in scope `platform:cloudly-corestore` that the Secrets v2 cutover made of the nine object-storage endpoint names and the eleven `S3_RETENTION_*` names, which still named the Docker host `corestore` and replaced the binding's plain environment in the workload, and publishes each affected service's manifests again, so its replicas are replaced once. The step has no way back: Cloudly `33.21.2` and earlier refuse data version `0.32.0`, so a return to `1.29.6`, `1.30.2` or an earlier template means restoring the database backup taken before the upgrade. Version `1.29.7` is `1.29.6` with that image and is the newest target of a host that does not fulfil `storage.database.backup-exclusions`; version `1.30.3` is `1.29.7` with the ledger declaration of `1.30.0` and is the upgrade target of `1.30.2`, `1.30.1`, `1.30.0`, `1.29.7`, `1.29.6` and every version `1.30.0` upgrades from. Cloudly `33.21.3` adds no collection, no index and no setting and keeps the Onebox minimum `33.8.0`. Versions `1.30.2` and `1.29.6` run the Cloudly `33.21.2` image, a fixes-only patch over `33.21.1`: a recovery redeploy over a dead retained rollout plan is no longer refused by its reserve and promote preflights while its Corestore bindings wait for the credentials only a promotion can bring, since those preflights now defer the readiness of such a binding (`PLATFORM_BINDING_READINESS_DEFERRED`) as they did for a held service's first promotion, and the route preflight still requires it ready. Version `1.29.6` is `1.29.5` with that image and is the newest target of a host that does not fulfil `storage.database.backup-exclusions`; version `1.30.2` is `1.29.6` with the ledger declaration of `1.30.0` and is the upgrade target of `1.30.1`, `1.30.0`, `1.29.6`, `1.29.5` and every version `1.30.0` upgrades from. Cloudly `33.21.2` adds no data step, no collection, no index and no setting, keeps the data version `0.31.0` and the Onebox minimum `33.8.0`. Versions `1.30.1` and `1.29.5` run the Cloudly `33.21.1` image, which carries Cloudly `33.21.0` and its fixes: a greenfield reserve creates its Corestore bindings, a held service's binding waits for its first promotion, the gateway domain sync keeps the operator's activation and records the gateway listing in `gatewayListedAt`, a dead retained rollout plan is superseded at promotion, and a Pallet service that still carries its Swarm-era placement is granted its Corestore credentials again. Version `1.29.5` is `1.29.4` with that image and is the newest target of a host that does not fulfil `storage.database.backup-exclusions`; version `1.30.1` is `1.29.5` with the ledger declaration of `1.30.0` and is the upgrade target of `1.30.0`, `1.29.5` and every version `1.30.0` upgrades from. Cloudly `33.21.1` adds no data step, no collection and no index, keeps the data version `0.31.0` and the Onebox minimum `33.8.0`. Version `1.30.0` also declares Cloudly's runtime log ledger non-backup data: `databaseBackupExclusions` names the collections `cloudly_runtime_log_attempts`, `cloudly_runtime_log_batches`, `cloudly_runtime_log_captures`, `cloudly_runtime_log_inline_payloads`, `cloudly_runtime_log_node_discards` and `cloudly_runtime_log_queue` of its `mongodb` database, and `requiresFeatures` names `storage.database.backup-exclusions` beside `storage.object-storage.backup-exclusions`, so a host that does not fulfil the database feature lists it, refuses it as a target and keeps `1.29.7` as its newest; `1.30.1`, `1.30.2` and `1.30.3` carry the same declaration. A backup on a host that fulfils it exports those collections with their indexes and without their documents, so a restore brings them back empty; every Cloudly `33.21.0` start re-records the log attempts that still run. Version `1.30.0` is `1.29.4` with the Cloudly `33.21.0` image and the ledger declaration and is the upgrade target of `1.29.4`, `1.29.3`, `1.29.2`, `1.29.1`, `1.29.0`, `1.28.6`, `1.28.5` and `1.28.3`; Cloudly `33.21.0` adds no data step, no collection and no index and keeps the data version `0.31.0`. Versions `1.30.3`, `1.30.2`, `1.30.1`, `1.30.0`, `1.29.7`, `1.29.6`, `1.29.5`, `1.29.4`, `1.29.3`, `1.29.2`, `1.29.1`, `1.29.0`, `1.28.6` and `1.28.5` declare Cloudly's workload logs non-backup data: `backupExclusions` names the key prefix `runtime-logs/` of the `legacy-s3` bucket, and `requiresFeatures` names `storage.object-storage.backup-exclusions`, so a host that does not fulfil it lists them and refuses them as targets. A backup on a host that fulfils it leaves those objects out, and a restore brings back Cloudly's state, not its past workload logs. Version `1.29.4` is `1.29.3` with the Cloudly `33.20.4` image and is the upgrade target of `1.29.3`, `1.29.2`, `1.29.1`, `1.29.0`, `1.28.6`, `1.28.5` and `1.28.3`. Cloudly `33.20.4` keeps the runtime log sweep bounded by its own work: its reads no longer scan the whole runtime log ledger, each sweep step commits at most 16 rows under a 15 s deadline instead of retrying past the database's transaction lifetime, and each step first lets critical node requests (such as the managed VPN credential renewal) through, so a large ledger no longer stalls node credentials. It adds no data step, no collection and no index and keeps the data version `0.31.0`, so an upgrade from `1.29.3` or `1.29.2` runs none. Version `1.29.3` is `1.29.2` with the Cloudly `33.20.3` image and is the upgrade target of `1.29.2`, `1.29.1`, `1.29.0`, `1.28.6`, `1.28.5` and `1.28.3`. Cloudly `33.20.3` lets a service that already holds a Corestore binding of a capability adopt its own legacy resource of that capability into that binding: Corestore `34.1.4` and later refuse a binding beside an unauthorized legacy resource (`legacy-adoption-pending`), and `adoptCorestoreLegacyResources` refused such a service `binding-exists`, so the service stayed down; now the adoption is written onto the matching enabled canonical binding in the adoption's transaction, and every other binding still refuses `binding-exists`. It adds no data step and no collection and keeps the data version `0.31.0`, so an upgrade from `1.29.2` runs none; an upgrade from `1.29.1` or earlier also takes the changes of Cloudly `33.20.2` below. Version `1.29.2` is `1.29.1` with the Cloudly `33.20.2` image and is the upgrade target of `1.29.1`, `1.29.0`, `1.28.6`, `1.28.5` and `1.28.3`. Cloudly `33.20.2` keeps its registry storage bounded: a storage retention runs 3 minutes after start, then daily, prunes releases no plan, running tag, deployment operation or unfinished rollout needs beyond each service's 3 most recently promoted accepted releases and the last 7 days, and deletes manifests and blobs nothing reaches after 24 hours, in time-bounded holds of the registry mutation lock; the per-push prune is gone, and a service deletion deletes only its own repository's manifests and tags. A rollout of what a replica already runs keeps it running, and gateway, mail and CoreMail status reported under a service lifecycle lease is kept, one record per observer in `cloudly_service_reconciliation_stages`. Its startup runs the forward-only data step `service-reconciliation-observations` from `0.30.0` to `0.31.0`; every Cloudly before `33.20.2` refuses `0.31.0`, so a return to `1.29.1` or earlier means restoring the backup taken before the upgrade, and registry objects the retention deleted do not come back with it. An upgrade from `1.29.0` or earlier also takes the changes of Cloudly `33.20.1` below. Version `1.29.1` is `1.29.0` with the Cloudly `33.20.1` image and is the upgrade target of `1.29.0`, `1.28.6`, `1.28.5` and `1.28.3`. Cloudly `33.20.1` no longer blanks a cluster's ingress routes when it restarts: its first table of a cluster is the full one, never an empty revocation, a node that only registers again keeps its routes because a route endpoint is a node instance's statement under its credential generation (`nodeInstanceNonce`), unreadable route sources keep the relay's table for at most 180 s after a start, and a revocation withdraws exactly the revoked routes. A Pallet registration Cloudly cannot serve for a reason of its own is refused as momentary (`controller-unavailable`, `controller-deadline`; @serve.zone/interfaces `32.57.0`), so the node registers again instead of ending its session, and a credential check whose store cannot be read fails closed. It adds no data step and no collection and keeps the data version `0.30.0`, so an upgrade from `1.29.0` runs none; an upgrade from `1.28.6` or earlier also takes the changes of Cloudly `33.20.0` below. Version `1.29.0` is `1.28.6` with the Cloudly `33.20.0` image and is the upgrade target of `1.28.6` and `1.28.5`. Cloudly `33.20.0` serves a non-public hostname from a node's cluster ingress to dcrouter alone once the setting `dcrouterForwardSourceAddresses` names dcrouter's forwarding sources (the cluster's Coreflow and CoreTraffic must run releases on `@serve.zone/interfaces` `32.55.0` or later), writes workload log payloads as one segment object per capture every few minutes, keeping a committed batch inline in the new collection `cloudly_runtime_log_inline_payloads` until its segment is written, and lets a service whose retained rollout plan cannot run be redeployed (`RECOVERY_REDEPLOY_OVER_FAILED_RUNTIME`). It adds no data step and keeps the data version `0.30.0`, so an upgrade from `1.28.6` runs none; its first start creates that collection, which after an unclean stop of the previous Cloudly fails with `EFENCE_BUSY` for up to 30 minutes on Corestore `32.2.4`. Cloudly `33.19.2` and earlier refuse the log ledger rows `33.20.0` writes, so a return to an earlier template needs the backup taken before the upgrade. `1.28.6` is `1.28.4` (Cloudly `33.19.2`) with that declaration; `1.28.5` is `1.28.3` (Cloudly `33.19.1`) with it, so a host on `1.28.3` moves its template without moving Cloudly. `1.28.5` sorts above `1.28.4` but runs the older image: from `1.28.4`, upgrade to `1.28.6`. Version `1.28.4` pins Cloudly `33.19.2` and keeps the `1.28.3` runtime contract, including the Onebox `33.8.0` minimum: its platform Corestore `32.2.4` runs NoSQLDB `10.6.1` with the D3 write-conflict fix, and on an earlier engine a node's network plan loses every commit to a `WriteConflict`, so Cloudly `33.15` must not run on it. Cloudly `33.19.2` is a fixes-only patch over `33.19.1`: a greenfield deployment, a legacy import's successor included, proves its namespace blank on the nodes of the Pallet clusters only, so a fleet that still keeps a Coreflow-owned Swarm cluster without a relay can reserve one, while a Pallet node whose inventory cannot be read still blocks; a greenfield rollout without a Pallet runtime spec is refused `GREENFIELD_PALLET_RUNTIME_SPEC_REQUIRED` instead of falling back to Coreflow placement (state the spec with `setServiceRuntimeSpec`, then promote again); and a node's network compilation proves each workload lease and each authority or eligibility proof once per transaction. It adds no data step and keeps the data version `0.30.0`, so an upgrade from `1.28.3` runs none. The `1.28.4` changelog carries the changes of `33.19.2` and of `33.18.3` to `33.19.1` and the earlier releases' upgrade path only, because a catalog changelog is bounded at 65536 characters; `1.28.2`'s carries the rest. From `1.28.2` or earlier, Cloudly `33.19.1`'s changes apply too: Cloudly `33.19.1` carries `33.18.3` to `33.19.1`: a node's log report costs one append transaction that queues the batch with its payload in the new collection `cloudly_runtime_log_queue`, and a background drain writes the payloads and commits the ledger rows without holding the node's request or fencing the controller record (a full queue refuses a report with the retryable `log-intake-saturated`), object writes list nothing, workload logs are kept for at least 30 days, route verification reads the certificate each route presents on a connection of its own, and `readServiceDeploymentStatus` (interfaces `32.54.0`) reads a deployment operation without changing it. Its first start creates `cloudly_runtime_log_queue`; on NoSQLDB `10.6.1` that creation waits at most 5 s for the open transactions on the Cloudly database, and a transaction an earlier Cloudly left open by exiting before its stop completed holds the database until its session expires 30 minutes later, so after an unclean stop of the previous Cloudly start the upgrade no earlier than 30 minutes after that exit. It adds no data step and keeps the data version `0.30.0`, so an upgrade from `1.28.2`, `1.28.1` or `1.28.0` runs none. From `1.28.1` or earlier, Cloudly `33.18.2`'s fixes apply too: Cloudly `33.18.2` is a fixes-only patch over `33.18.1`: a node's network configuration advances only once the node's application receipt names the projection it holds, so a node no longer receives a new version while it still applies the last one; upgrade every node to Pallet `36.3.0` or later (interfaces `32.50.0` or later) first, because a node that sends no receipt keeps the projection it holds and receives no successor. It adds no data step and keeps the data version `0.30.0`, so an upgrade from `1.28.1` or `1.28.0` runs none. From `1.28.0` or earlier, Cloudly `33.18.1`'s fixes apply too: Cloudly `33.18.1` is a fixes-only patch over `33.18.0`: a node's log batches append without its node fences, so they no longer miss their budget against the node's producer passes, and the deployment preflight answers within 25 s, past which it answers the retryable `DEPLOYMENT_PREFLIGHT_UNAVAILABLE`. It adds no data step and keeps the data version `0.30.0`, so an upgrade from `1.28.0` runs none. From `1.27.0` or earlier, Cloudly `33.18.0`'s changes apply too: Cloudly `33.18.0` loads the App Store catalog at runtime instead of bundling it, from the registries of its `appStoreCatalogRegistries` setting (empty means the npm registry), so a Cloudly template update needs an appstore release only; it ignores `APPSTORE_URL`, whose remote source is removed, and while no verified catalog is active it refuses App Store install details, upgrade preview and upgrade with `APPSTORE_CATALOG_UNAVAILABLE`. It adds no data step and keeps the data version `0.30.0`, so an upgrade from `1.27.0` runs none. From `1.26.0` or earlier, Cloudly `33.17.3`'s changes apply too: Cloudly `33.17.3` moves the data version from `0.28.0` to `0.30.0`: every upgrade from `1.26.0` or earlier runs the forward-only data steps `route-claim-absent-owners` to `0.29.0` (the stored nulls of absent owners are removed from every route claim) and `bounded-runtime-history` to `0.30.0` (every archived deployment record is deleted, the index `archiveState_1` is dropped and the accepted Spark observations are pruned to the rows the census reads), and every Cloudly before `33.17.3` refuses the `0.30.0` data. Runtime history is bounded from then on: a Coreflow report deletes the deployment records it no longer names instead of archiving them, `getDeployments` answers the current records whether or not it is asked to `includeArchived`, `deploymentArchiveRetentionDays` is accepted but has no effect, and the dashboard no longer offers archived deployments. A deployment preflight no longer fails `DEPLOYMENT_PREFLIGHT_UNAVAILABLE` on a route claim that stores an absent owner as `null`, and the deployment and adoption preflights log the cause of an unexpected failure. A node's requests no longer contend on the controller fence and share a 6 s budget below the cluster relay's 8 s forward deadline, a request out of budget is refused `controller-deadline`, which the node retries, and a node deletion refuses what a racing write bound to the node. Cloudly consumes the projection application receipts of Pallet `36.3.0`, so a flow a node's projection withdrew is granted again on the same leases once the node reports that it applied the withdrawal; an earlier Pallet keeps every withdrawal carried. Cloudly `33.17.2` starts a database below data version `0.25.0` that holds a runtime slot: the data step `runtime-log-attempts` read through models startup has not prepared and was refused, and now reads and writes through the driver; an install whose first start failed there stayed at data version `0.24.0` and upgrades to `1.28.4` normally. Cloudly `33.17.1` fixes the first start of `33.17.0`, which crash-looped on a database holding Pallet-era nodes: its first data step `cluster-node-hostname-intent` stated each intent through the node and cluster models, which startup has not prepared while it runs the data steps, and was refused before its first write; the step now reads and writes the stored node and cluster documents directly, like the other data steps. The migration ledger does not advance past a failed step, so an install on `1.25.0` whose first start failed stayed unchanged at data version `0.25.0` and upgrades to `1.28.4` normally. Cloudly `33.17.1` keeps the data steps of `33.17.0`, which move the data version from `0.25.0` to `0.28.0`: every upgrade from `1.24.0` or earlier, and from `1.25.0` whose first start failed, runs the forward-only data steps `cluster-node-hostname-intent` to `0.26.0` (every Pallet-era node gets the intent of the hostname it reports, and nothing is renamed), `deployment-operation-route-evidence` to `0.27.0` (a routeless deployment operation that succeeded records its empty route evidence) and `service-secret-target-predecessor` to `0.28.0` (a secret target state an earlier service deletion left behind is removed) before the `0.28.0` to `0.30.0` steps. The template stays marked breaking, migration-required, backup-before-upgrade and manual-review, because hosts read the flags from the target version alone and every upgrade from `1.26.0` or earlier runs the `0.28.0` to `0.30.0` steps, after the `0.25.0` to `0.28.0` steps from `1.24.0` or earlier; every upgrade from `1.19.0` or earlier runs the forward-only data step `runtime-log-attempts` from `0.24.0` to `0.25.0` before them (the log record of every slot's current attempt is written), and every upgrade from `1.15.0` or earlier runs `corestore-control-token-state` from `0.23.0` to `0.24.0` before that (a Corestore control token stored earlier is recorded as revision 1); every Cloudly before `33.17.3` refuses the migrated data: stop Cloudly and take a verified backup first, as rollback is full-restore-only. From `1.24.0` or earlier, Cloudly `33.17.0`'s changes apply too: Cloudly `33.17.0` lets a legacy import reserve: it takes over every route claim its legacy service holds in the import's organization, the cluster ingress keeps serving each hostname for the legacy service until the import's service declares it, and cleanup or rollback before promotion hands the claims back while the legacy service exists; `ROUTE_UNAVAILABLE` and `DEPLOYMENT_ROUTE_COLLISION` name each conflicting hostname and the services holding it. It owns the hostname a node should carry (interfaces `32.52.0`, `cloudly-worker-<name>` by default): `setClusterNodeHostname` renames a Pallet-era node and `resetClusterNodeHostname` sets the default, Spark reads the intent at `POST /spark/nodes/host`, and a Pallet service's gateway routes and inbound mail follow the node its runtime spec pins by id, so a rename moves no traffic. A routeless deployment records its empty route evidence when it succeeds; deleting a cluster's designated ingress service is refused `SERVICE_IS_CLUSTER_INGRESS`, `designateClusterIngress` recovers a designation whose bearer is no longer active, and a deleted service's secret target state goes with its row, so a service recreated under its id writes its secrets again. From `1.23.0` or earlier, Cloudly `33.16.0`'s changes apply too: Cloudly `33.16.0` captures a legacy service's runtime attestation from an administrator's host observation, without a Coreflow session: `captureLegacyServiceRuntimeAttestation` takes `hostObservation`, the legacy Swarm service's spec image and mode and, per replica, its node, Swarm task, container, image store, image id, `RepoDigests`, state and health, read at most 15 minutes before the capture; Cloudly judges it against the one root every replica runs, which it requires whole in its registry and which the legacy tag need not still name, and refuses incomplete evidence without storing anything. The registry prune keeps an attested root until a release's `cloudly-legacy-import` evidence names the attestation or the legacy service is retired. From `1.22.0` or earlier, Cloudly `33.15.3`'s changes apply too: Cloudly `33.15.3` serves a promoted route: a route's identity carried the service's runtime write fence `runtimeAuthorityFenceGeneration`, which every runtime write of the service advances, in a Pallet-born cluster the route join's own workload lease read included, so the route plan read after the cluster ingress's certificate fetch never matched the one before it and every refresh that fetched a certificate withdrew the cluster's whole route table; a route's identity now carries only the versions that change with its authority (the route intent, the runtime policy revision, and per endpoint its assignment, its node's session and its target), while a service being deleted or holding no runtime authority is still refused by the route join, so a revoked route is withdrawn as before, by name. A table withdrawn because its authority changed or its route sources could not be read names that withdrawal as the reason the cluster ingress serves none of its routes, so a failing route verification states it; that reason states facts about its own route only, because one table carries the routes of several organizations: a route whose authority changed names its changed field, every other route only that another route's authority (or the ingress designation) changed during the certificate fetch, and a source-read failure only that the route sources could not be read, its error staying in the operator log. From `1.21.0` or earlier, Cloudly `33.15.2`'s changes apply too: Cloudly `33.15.2` lets a promoted route reach CoreTraffic: a route's identity carries the route intent version `routeIntentGeneration` instead of the whole-document `routeStateGeneration`, so the status writes during the cluster ingress's certificate fetch no longer withdraw the cluster's route table, a plan change during the fetch withdraws it only when it revokes a route the table is about to serve, and the change is named by route and input. A cluster ingress flow that a compensated promotion withdrew and a later promotion wants again no longer stalls the node's network projection: Cloudly holds that flow back with its withdrawal carried and signs the rest of the node's network, while a workload or router grant wanted again while withdrawn withholds the node's projection as `withdrawn-grant-reissued` and any other contract refusal as `projection-rejected`, each naming what it holds; the cluster ingress leaves a route whose grant is held out by name, and a failed route verification states why no route is served for its hostname. A held flow is granted again only once the target or CoreTraffic runs under a new lease. From `1.20.0` or earlier, Cloudly `33.15.1`'s changes apply too: Cloudly `33.15.1` fixes the deployment preflight of an existing service Pallet runs: it read the current runtime from Coreflow alone and answered NO-GO (`CURRENT_RUNTIME_DIGEST_MISSING`, `RUNTIME_ATTESTATION_MISMATCH`) for a service whose rollout status was verified, and now reads the runs of the service's current plan, the evidence its deployment status reads, when Pallet executes that plan on every cluster it targets. It also lets a route promotion survive the status writes of its own gateway sync: the promotion fenced on `routeStateGeneration`, the service's whole-document version, which the route status its gateway sync records, Coreflow's reconciliation reports and its own verified-route status all advance, so every promotion failed `DEPLOYMENT_ROUTE_FENCE_CONFLICT` with no route evidence; it now fences on `routeIntentGeneration`, which only a write that changes the service's domains advances, so a concurrent route change, a change and back included, still fails it fenced, and a promotion interrupted under `33.15.0` is recovered as fenced (retryable), without a rollback. From `1.19.0` or earlier, Cloudly `33.15.0`'s changes apply too: Cloudly `33.15.0` keeps workload logs: a Pallet node's log batches are kept per attempt, their payloads in Cloudly's own bucket (the template's `S3_BUCKET`) under `runtime-logs/`, bounded to 8 MiB and 8192 batches per attempt and the newest 8 attempts per slot, each batch for its config's `logs.retentionMs`, and read with `getServiceRuntimeLogAttempts` and `getRuntimeAssignmentLogs` (interfaces `32.47.0`) or the service page's Logs tab. A Pallet-executed rollout that succeeded stays succeeded when a replica later fails or is replaced; a failing service runtime pass names its step, and a database error its code name and number. A launcher secret written before a service's first image plan no longer leaves the service refused `secrets-unsupported`, because every image plan is written with the service's secret deployment plan in one transaction. The designated cluster ingress runs with `SERVEZONE_CLUSTER_RELAY_ORIGIN` and `SERVEZONE_CLUSTER_NODE_ID`, which Cloudly writes into that workload's environment (a cluster without a valid relay refuses it `cluster-relay-missing`); the template sets neither. From `1.18.0` or earlier, Cloudly `33.14.1` and `33.14.2`'s changes apply too: Cloudly `33.14.2` completes a rollout Pallet executes: Cloudly reports on every rollout whose target clusters are all on Pallet, one reporter per cluster (`pallet/<clusterId>`) over the runs of exactly the current desire, so it moves to `succeeded` (or `ready-for-route`) once its runs are ready at the requested digest and fails when a run fails, and `getServiceDeploymentStatus` reads its runtime tasks from the runtime manager instead of Coreflow, so tsdeploy no longer times out on a Pallet-attached service. A launcher-secret run admitted after a Cloudly restart, reconnect or credential rotation gets its material again instead of waiting `secret-mount-uncertain` (`secret-recipient-inactive`) until its node process restarts, because a node's secret recipient is active for every session of the node process that enrolled it. A failing producer pass is logged under its producer's subject once per change of cause, with how long it ran and a value-free cause naming the failing step and check (such as `network-projection-rejected`), and its recovery once; a failed sweep the timer started is no longer dropped. From `1.17.0` or earlier, Cloudly `33.14.0`'s changes apply too: it gives a platform-owned service's published ports infrastructure-administrator authority: an administrator designates a platform organization's service (an organization id carrying `:`) with `designatePlatformOwnedService`, withdraws it with `undesignatePlatformOwnedService` and reads it with `getServicePlatformOwnership` (interfaces `32.45.0`), after which only a verified administrator reads and writes its published ports, any other organization id is refused `organization-not-platform`, and the designation, stored on the service document, is read inside the published-port request's one admitted operation; every organization service keeps the organization-owner rule. It also names and logs every assignment dispatch outcome under a closed, value-free reason, pushes a refused or unanswered push again on the next pass, and keeps a run its node refused (cause `refused`) instead of replacing it on the failure backoff until its input changes. From `1.16.0` or earlier, Cloudly `33.13.3` and `33.13.4`'s changes apply too: Cloudly `33.13.4` delivers a run's secret material through the WorkloadInit launcher again (Corestore's `MONGODB_URI` included), remembers a successful WorkloadInit approval verification per artifact, and names the check of every refused material request with a closed, value-free `reason`; since Cloudly `33.13.3` a node's session is pushed each assignment revision once instead of on every delivery pass. From `1.15.0` or earlier, Cloudly `33.11.0` to `33.13.2`'s changes apply too: they let an administrator set the Corestore control token without an exec into Cloudly's container (`setCorestoreControlToken`, interfaces `32.42.0`, with its revision and value-free receipts in the new collections `cloudly_corestore_control_token_state` and `cloudly_corestore_control_token_receipts`, and `servezone corestore set-control-token`), keep every managed VPN member across a protected-authority step that only adds, retire a node and its egress owner (`retireClusterNode`, interfaces `32.43.0`), ask a retiring node on interfaces `32.44.0` to withdraw its allocation protection so that a stopped or offline node no longer blocks allocation, and keep a stopping workload's lease in its node's projection until the node's stop receipt is accepted. From `1.14.0` or earlier, Cloudly `33.10.0`'s changes apply too: it lets an operator obtain a cluster relay's bearer without an exec into Cloudly's process: `exportClusterRelayAuthorization` (interfaces `32.41.0`) requires a freshly signed-in administrator, proves the delivered credential version against the hash its generation issued, commits an audit receipt fenced at that generation before it answers the bearer, and never logs it; the receipts live in the new collection `cloudly_cluster_relay_authorization_exports`, installed at startup and listed by `getClusterRelayAuthorizationExports`, and `servezone relay export-authorization` (`@serve.zone/cli` `33.10.0`) writes the bearer as a new `0600` file. From `1.14.0` or earlier, Cloudly `33.9.0`'s changes apply too: a node's managed VPN member is kept across its network projection changes instead of being withdrawn from the hub network on every workload change (`bindGetRuntimeManagedVpnCredentialSuccessor`, interfaces `32.39.0`), the failure cause a node reports with a failed run (interfaces `32.40.0`) is stored and shown in the runtime assignment views and the dashboard's Cause column, and `deleteServiceById` answers success once a service is marked for deletion while another deleting service drains, naming its refusals `SERVICE_LIFECYCLE_BUSY`, `SERVICE_ORGANIZATION_AUTHORITY_REQUIRED` and `SERVICE_MANAGER_STOPPING` instead of an internal error. From `1.13.0` or earlier, Cloudly `33.8.3`'s fix applies too: it lets `deleteServiceById` retire a legacy service whose Corestore resources a successor adopted: its live Corestore bindings are tombstoned with the ordinary config push once every claimed legacy resource of each binding's capability has passed to the successor's live adopting binding, while a service without such a handover is still refused `CORESTORE_CLEANUP_TARGET_AUTHORITY_REQUIRED`. A legacy service whose runtime attestation a legacy-import operation still uses (`reserving`, `reserved`, `provisioning` or `awaiting-image`) is refused `SERVICE_LEGACY_IMPORT_PENDING` (retryable) and keeps running; import and deletion are serialized on the registry repository, so an import that starts after the check refuses as `LEGACY_IMPORT_SOURCE_MISMATCH`, and a deletion that proceeds deletes the attestations no release consumed. From `1.12.0` or earlier, Cloudly `33.8.2`'s fix applies too: Cloudly names why it refused a node's report: a refused `reportRuntimeNetworkProtection`, `reportRuntimeAssignmentTerminalReceipt`, `reportRuntimeAssignmentObservation` or `reportRuntimeAssignmentLogs` is logged as a warning once per node, report and distinct reason, and the node is answered with the unchanged error text plus `{ code: 'runtime-session-report-refused', reason }` as the error's data. From `1.11.0` or earlier, Cloudly `33.8.1`'s fix applies too: deploy before any Pallet that sends `discardedCaptures` or a `not-kept` log loss reaches a fleet node, since it accepts those log batch fields of interfaces `32.38.0`, which Cloudly `33.8.0` refuses on every retry, and still keeps no workload logs. From `1.10.0` or earlier, Cloudly `33.8.0`'s changes apply too: deploy before any Pallet that captures workload output reaches a fleet node, since Cloudly `33.8.0` answers a Pallet's `reportRuntimeAssignmentLogs` (interfaces `32.37.0`) with `not-kept`, which an earlier Cloudly leaves unhandled. Cloudly `33.8.0` lets a legacy `deployOnPush` service without deployable source move to a greenfield successor that runs the exact image it ran (`captureLegacyServiceRuntimeAttestation`, a `legacyImport` reservation under the capability `deployment:import-legacy`, and `importServiceDeploymentLegacyImage` in place of a push), judges promotion against the platforms of the service's rollout target, refuses a registry repository that belongs to another service as `REGISTRY_REPOSITORY_MISMATCH`, promotes and routes a service with a Corestore `database` or `objectstorage` binding again, and reads a node whose last report is older than 180 seconds as `offline`. Its web UI moved to path URLs and a regrouped menu, so bookmarks of the old UI locations open the not-found screen; server paths such as `/status` and the OIDC callback are unchanged. From `1.9.0` or earlier, Cloudly `33.7.0`'s changes apply: Cloudly `33.7.0` lets a fresh greenfield service take over a legacy service's Corestore database and bucket with their data and retention intact: an `adoptCorestoreLegacyResources` selection entry may name `successorServiceId` (interfaces `32.34.0`, carried out by Corestore `33.2.0` or later), the successor must share the owner's organization, be an immutable-deployment service, own no legacy resource of the capability and hold no other binding of it, and each legacy resource is adopted by one service only (`legacy-resource-adopted-elsewhere`, `successor-organization-mismatch`, `successor-not-greenfield`, `successor-owns-legacy-resource`). Since Cloudly `33.6.1`, a deployment reservation whose release tag the registry already holds is refused `DEPLOYMENT_RELEASE_TAG_OCCUPIED` instead of waiting for its image forever, an administrator's manifest push to a release tag a deployment operation reserved is refused `409 release-tag-reserved`, and a binding status report reaches its cluster relay only when it changed what the relay reads. From `1.8.0` or earlier, startup runs the forward-only data step `deployment-machine-user-grants` from `0.22.0` to `0.23.0`, which keeps on every deployment machine user only the grants a capability check reads and permanently removes the rest (such as the `{ serviceId, capabilities }` grants of Cloudly 11); stop Cloudly and take a verified backup first, as the way back is the pre-upgrade backup. Cloudly `33.6.0`'s changes apply too: Cloudly stops gracefully on SIGTERM and SIGINT within 8 seconds, below the 10-second stop grace of Docker and Swarm, so a stop or restart no longer leaves a database transaction held and the next start no longer crash-loops on `EFENCE_BUSY`; a process ended by SIGKILL still holds its database session until the server's session timeout. Every new service gets its own deployment namespace, so two services of one project reserve without `DEPLOYMENT_RESOURCE_COLLISION`, while a deployed service keeps its namespace, and `getDeploymentMachineUsers` lists users configured under Cloudly 11 again. From `1.7.0` or earlier, Cloudly `33.5.0`'s changes apply: Cloudly reserves a deployment only for a deployment machine user: `reserveServiceDeployment` refuses an administrator with `DEPLOYMENT_MACHINE_IDENTITY_REQUIRED`, including a deployer that signs in with a username and password (such as tsdeploy with `TSDEPLOY_CLOUDLY_USERNAME`/`TSDEPLOY_CLOUDLY_PASSWORD`), so before upgrading create a deployment machine user per deployer (`mutateDeploymentMachineUser`, or Security → Access → Deployment machine users in the dashboard), attach its grants with `configureServiceDeploymentMachineUser` and switch the deployer to its token; an existing `api` machine user with its grants already qualifies. A machine identity or registry bearer issued by an earlier release is refused until its holder exchanges its token again with `getIdentityByToken`, and removing a token now ends the sessions opened with it. Let no deployment run during the upgrade: a run in progress keeps its pre-upgrade identity and is refused for the rest of that run (rerun it, or resume it with `deploy-retry`). From `1.3.0` through `1.6.0`, startup runs the forward-only data step `runtime-session-protocol-offer` from `0.21.0` to `0.22.0`, which states `protocol: null` on every Pallet session row recorded before Cloudly stored its node's protocol offer; stop Cloudly and take a verified backup first, as rollback is full-restore-only. From `1.6.0`, Cloudly `33.4.0`'s changes apply: Cloudly `33.4.0` lets `setServicePublishedPorts` publish a contiguous range through `hostPortEnd` (at most 1024 ports in 64 entries per protocol) and same-port outbound through `symmetric: true`, which needs public egress (`published-port-symmetric-without-egress`) and owns its inside ports (`published-port-symmetric-inside-overlap`). New handoff leases translate outbound flows only into `49152-65535`, whose ports are refused `published-port-reserved`; a node keeps its `1024-65535` lease until its router is re-created. A policy write for a service being deleted is refused `service-deleting`. A projection carrying a range or a symmetric entry is withheld as `node-contract-behind` from a Pallet node whose session states a release below interfaces `32.31.0`, or an unrecorded one, so ranges and symmetric entries take effect on a node only once it runs a Pallet release built on interfaces `32.31.0` or later. From `1.5.0`, Cloudly `33.3.0`'s changes apply: Cloudly `33.3.0` lets an administrator set a service's network egress with `setServiceNetworkEgress` (public internet, and the platform endpoints of the protected authority), and refuses a workload whose database or object-storage binding sits on a node whose Corestore endpoint its network does not select as `database-endpoint-unselected` or `objectstorage-endpoint-unselected`; a replica already running keeps running while its target reports the refusal. From `1.4.0`, Cloudly `33.2.0`'s changes apply: Cloudly takes a dcrouter admin token once through `bootstrapExternalGatewayCredential` to provision its own gateway-client credential, starts a first enrollment with the gateway settings, and stages a gateway settings change the held credential cannot carry until the next bootstrap. From `1.2.1` or earlier, startup runs the forward-only migration from `0.20.0` to `0.21.0` before that step, dropping the relay certificate and DNS collections of Cloudly's retired Cloudflare and Let's Encrypt integration and logging every relay name whose A record Cloudly had written at Cloudflare, which the operator removes at the provider. dcrouter holds every cluster relay name's A record and certificate from then on, `SERVEZONE_SSLMODE=letsencrypt` is refused, and the typed API changes as the Cloudly 33.0.0 changelog lists. Stop Cloudly and take a verified backup before upgrading; rollback is full-restore-only. Roll out Cloudly `33.19.2` before Coreflow `33.2.0`; Coreflow `33.1.0` is the minimum. From `1.3.0`, also roll out Cloudly before Coreflow and Corestore `33.0.0`, and set every node's Corestore database endpoint, because a database binding on a node without one is not granted and its service is refused `database-endpoint-missing`, and existing database bindings return no credentials until they are granted again for the endpoint. From `1.1.10` or earlier, startup first runs the `1.2.0` steps from `0.10.0` and needs completed Secrets v2 cutover retirement. Both the existing Secrets v2 keyring and operator-approved WorkloadInit authority are required encrypted inputs delivered as separate root-owned `0400` files; the public environment contains only their fixed paths. |
+| `cloudly` | MongoDB, S3 | Versions `1.30.4` and `1.29.8` run the Cloudly `33.21.4` image, a fixes-only patch over `33.21.3` (a launcher-environment secret file is owned by the identity the workload runs as, AGL-459; `@serve.zone/interfaces` `32.60.0`), and set `CLOUDLY_BACKUP_CRON` to `15 2 * * *`, so Cloudly registers its `backup-all-services` task and backs up the databases of its workload services daily at 02:15 UTC, keeping the newest 24 backups of each service; a workload's object storage is not part of these backups (AGL-473). Version `1.29.8` is `1.29.7` with that image and variable and is the newest target of a host that does not fulfil `storage.database.backup-exclusions`; version `1.30.4` is `1.29.8` with the ledger declaration of `1.30.0` and is the upgrade target of `1.30.3`, `1.30.2`, `1.30.1`, `1.30.0`, `1.29.8`, `1.29.7` and every version `1.30.0` upgrades from. Cloudly `33.21.4` adds no data step, no collection, no index and no setting and keeps the Onebox minimum `33.8.0`. Versions `1.30.3` and `1.29.7` run the Cloudly `33.21.3` image, which adds the forward-only data step `retire-corestore-environment-secrets` (data version `0.31.0` to `0.32.0`): a service migrated from Swarm reaches its object storage at its node's Corestore endpoint again, because the step retires the service-owned secrets in scope `platform:cloudly-corestore` that the Secrets v2 cutover made of the nine object-storage endpoint names and the eleven `S3_RETENTION_*` names, which still named the Docker host `corestore` and replaced the binding's plain environment in the workload, and publishes each affected service's manifests again, so its replicas are replaced once. The step has no way back: Cloudly `33.21.2` and earlier refuse data version `0.32.0`, so a return to `1.29.6`, `1.30.2` or an earlier template means restoring the database backup taken before the upgrade. Version `1.29.7` is `1.29.6` with that image and is the newest target of a host that does not fulfil `storage.database.backup-exclusions`; version `1.30.3` is `1.29.7` with the ledger declaration of `1.30.0` and is the upgrade target of `1.30.2`, `1.30.1`, `1.30.0`, `1.29.7`, `1.29.6` and every version `1.30.0` upgrades from. Cloudly `33.21.3` adds no collection, no index and no setting and keeps the Onebox minimum `33.8.0`. Versions `1.30.2` and `1.29.6` run the Cloudly `33.21.2` image, a fixes-only patch over `33.21.1`: a recovery redeploy over a dead retained rollout plan is no longer refused by its reserve and promote preflights while its Corestore bindings wait for the credentials only a promotion can bring, since those preflights now defer the readiness of such a binding (`PLATFORM_BINDING_READINESS_DEFERRED`) as they did for a held service's first promotion, and the route preflight still requires it ready. Version `1.29.6` is `1.29.5` with that image and is the newest target of a host that does not fulfil `storage.database.backup-exclusions`; version `1.30.2` is `1.29.6` with the ledger declaration of `1.30.0` and is the upgrade target of `1.30.1`, `1.30.0`, `1.29.6`, `1.29.5` and every version `1.30.0` upgrades from. Cloudly `33.21.2` adds no data step, no collection, no index and no setting, keeps the data version `0.31.0` and the Onebox minimum `33.8.0`. Versions `1.30.1` and `1.29.5` run the Cloudly `33.21.1` image, which carries Cloudly `33.21.0` and its fixes: a greenfield reserve creates its Corestore bindings, a held service's binding waits for its first promotion, the gateway domain sync keeps the operator's activation and records the gateway listing in `gatewayListedAt`, a dead retained rollout plan is superseded at promotion, and a Pallet service that still carries its Swarm-era placement is granted its Corestore credentials again. Version `1.29.5` is `1.29.4` with that image and is the newest target of a host that does not fulfil `storage.database.backup-exclusions`; version `1.30.1` is `1.29.5` with the ledger declaration of `1.30.0` and is the upgrade target of `1.30.0`, `1.29.5` and every version `1.30.0` upgrades from. Cloudly `33.21.1` adds no data step, no collection and no index, keeps the data version `0.31.0` and the Onebox minimum `33.8.0`. Version `1.30.0` also declares Cloudly's runtime log ledger non-backup data: `databaseBackupExclusions` names the collections `cloudly_runtime_log_attempts`, `cloudly_runtime_log_batches`, `cloudly_runtime_log_captures`, `cloudly_runtime_log_inline_payloads`, `cloudly_runtime_log_node_discards` and `cloudly_runtime_log_queue` of its `mongodb` database, and `requiresFeatures` names `storage.database.backup-exclusions` beside `storage.object-storage.backup-exclusions`, so a host that does not fulfil the database feature lists it, refuses it as a target and keeps `1.29.7` as its newest; `1.30.1`, `1.30.2` and `1.30.3` carry the same declaration. A backup on a host that fulfils it exports those collections with their indexes and without their documents, so a restore brings them back empty; every Cloudly `33.21.0` start re-records the log attempts that still run. Version `1.30.0` is `1.29.4` with the Cloudly `33.21.0` image and the ledger declaration and is the upgrade target of `1.29.4`, `1.29.3`, `1.29.2`, `1.29.1`, `1.29.0`, `1.28.6`, `1.28.5` and `1.28.3`; Cloudly `33.21.0` adds no data step, no collection and no index and keeps the data version `0.31.0`. Versions `1.30.3`, `1.30.2`, `1.30.1`, `1.30.0`, `1.29.7`, `1.29.6`, `1.29.5`, `1.29.4`, `1.29.3`, `1.29.2`, `1.29.1`, `1.29.0`, `1.28.6` and `1.28.5` declare Cloudly's workload logs non-backup data: `backupExclusions` names the key prefix `runtime-logs/` of the `legacy-s3` bucket, and `requiresFeatures` names `storage.object-storage.backup-exclusions`, so a host that does not fulfil it lists them and refuses them as targets. A backup on a host that fulfils it leaves those objects out, and a restore brings back Cloudly's state, not its past workload logs. Version `1.29.4` is `1.29.3` with the Cloudly `33.20.4` image and is the upgrade target of `1.29.3`, `1.29.2`, `1.29.1`, `1.29.0`, `1.28.6`, `1.28.5` and `1.28.3`. Cloudly `33.20.4` keeps the runtime log sweep bounded by its own work: its reads no longer scan the whole runtime log ledger, each sweep step commits at most 16 rows under a 15 s deadline instead of retrying past the database's transaction lifetime, and each step first lets critical node requests (such as the managed VPN credential renewal) through, so a large ledger no longer stalls node credentials. It adds no data step, no collection and no index and keeps the data version `0.31.0`, so an upgrade from `1.29.3` or `1.29.2` runs none. Version `1.29.3` is `1.29.2` with the Cloudly `33.20.3` image and is the upgrade target of `1.29.2`, `1.29.1`, `1.29.0`, `1.28.6`, `1.28.5` and `1.28.3`. Cloudly `33.20.3` lets a service that already holds a Corestore binding of a capability adopt its own legacy resource of that capability into that binding: Corestore `34.1.4` and later refuse a binding beside an unauthorized legacy resource (`legacy-adoption-pending`), and `adoptCorestoreLegacyResources` refused such a service `binding-exists`, so the service stayed down; now the adoption is written onto the matching enabled canonical binding in the adoption's transaction, and every other binding still refuses `binding-exists`. It adds no data step and no collection and keeps the data version `0.31.0`, so an upgrade from `1.29.2` runs none; an upgrade from `1.29.1` or earlier also takes the changes of Cloudly `33.20.2` below. Version `1.29.2` is `1.29.1` with the Cloudly `33.20.2` image and is the upgrade target of `1.29.1`, `1.29.0`, `1.28.6`, `1.28.5` and `1.28.3`. Cloudly `33.20.2` keeps its registry storage bounded: a storage retention runs 3 minutes after start, then daily, prunes releases no plan, running tag, deployment operation or unfinished rollout needs beyond each service's 3 most recently promoted accepted releases and the last 7 days, and deletes manifests and blobs nothing reaches after 24 hours, in time-bounded holds of the registry mutation lock; the per-push prune is gone, and a service deletion deletes only its own repository's manifests and tags. A rollout of what a replica already runs keeps it running, and gateway, mail and CoreMail status reported under a service lifecycle lease is kept, one record per observer in `cloudly_service_reconciliation_stages`. Its startup runs the forward-only data step `service-reconciliation-observations` from `0.30.0` to `0.31.0`; every Cloudly before `33.20.2` refuses `0.31.0`, so a return to `1.29.1` or earlier means restoring the backup taken before the upgrade, and registry objects the retention deleted do not come back with it. An upgrade from `1.29.0` or earlier also takes the changes of Cloudly `33.20.1` below. Version `1.29.1` is `1.29.0` with the Cloudly `33.20.1` image and is the upgrade target of `1.29.0`, `1.28.6`, `1.28.5` and `1.28.3`. Cloudly `33.20.1` no longer blanks a cluster's ingress routes when it restarts: its first table of a cluster is the full one, never an empty revocation, a node that only registers again keeps its routes because a route endpoint is a node instance's statement under its credential generation (`nodeInstanceNonce`), unreadable route sources keep the relay's table for at most 180 s after a start, and a revocation withdraws exactly the revoked routes. A Pallet registration Cloudly cannot serve for a reason of its own is refused as momentary (`controller-unavailable`, `controller-deadline`; @serve.zone/interfaces `32.57.0`), so the node registers again instead of ending its session, and a credential check whose store cannot be read fails closed. It adds no data step and no collection and keeps the data version `0.30.0`, so an upgrade from `1.29.0` runs none; an upgrade from `1.28.6` or earlier also takes the changes of Cloudly `33.20.0` below. Version `1.29.0` is `1.28.6` with the Cloudly `33.20.0` image and is the upgrade target of `1.28.6` and `1.28.5`. Cloudly `33.20.0` serves a non-public hostname from a node's cluster ingress to dcrouter alone once the setting `dcrouterForwardSourceAddresses` names dcrouter's forwarding sources (the cluster's Coreflow and CoreTraffic must run releases on `@serve.zone/interfaces` `32.55.0` or later), writes workload log payloads as one segment object per capture every few minutes, keeping a committed batch inline in the new collection `cloudly_runtime_log_inline_payloads` until its segment is written, and lets a service whose retained rollout plan cannot run be redeployed (`RECOVERY_REDEPLOY_OVER_FAILED_RUNTIME`). It adds no data step and keeps the data version `0.30.0`, so an upgrade from `1.28.6` runs none; its first start creates that collection, which after an unclean stop of the previous Cloudly fails with `EFENCE_BUSY` for up to 30 minutes on Corestore `32.2.4`. Cloudly `33.19.2` and earlier refuse the log ledger rows `33.20.0` writes, so a return to an earlier template needs the backup taken before the upgrade. `1.28.6` is `1.28.4` (Cloudly `33.19.2`) with that declaration; `1.28.5` is `1.28.3` (Cloudly `33.19.1`) with it, so a host on `1.28.3` moves its template without moving Cloudly. `1.28.5` sorts above `1.28.4` but runs the older image: from `1.28.4`, upgrade to `1.28.6`. Version `1.28.4` pins Cloudly `33.19.2` and keeps the `1.28.3` runtime contract, including the Onebox `33.8.0` minimum: its platform Corestore `32.2.4` runs NoSQLDB `10.6.1` with the D3 write-conflict fix, and on an earlier engine a node's network plan loses every commit to a `WriteConflict`, so Cloudly `33.15` must not run on it. Cloudly `33.19.2` is a fixes-only patch over `33.19.1`: a greenfield deployment, a legacy import's successor included, proves its namespace blank on the nodes of the Pallet clusters only, so a fleet that still keeps a Coreflow-owned Swarm cluster without a relay can reserve one, while a Pallet node whose inventory cannot be read still blocks; a greenfield rollout without a Pallet runtime spec is refused `GREENFIELD_PALLET_RUNTIME_SPEC_REQUIRED` instead of falling back to Coreflow placement (state the spec with `setServiceRuntimeSpec`, then promote again); and a node's network compilation proves each workload lease and each authority or eligibility proof once per transaction. It adds no data step and keeps the data version `0.30.0`, so an upgrade from `1.28.3` runs none. The `1.28.4` changelog carries the changes of `33.19.2` and of `33.18.3` to `33.19.1` and the earlier releases' upgrade path only, because a catalog changelog is bounded at 65536 characters; `1.28.2`'s carries the rest. From `1.28.2` or earlier, Cloudly `33.19.1`'s changes apply too: Cloudly `33.19.1` carries `33.18.3` to `33.19.1`: a node's log report costs one append transaction that queues the batch with its payload in the new collection `cloudly_runtime_log_queue`, and a background drain writes the payloads and commits the ledger rows without holding the node's request or fencing the controller record (a full queue refuses a report with the retryable `log-intake-saturated`), object writes list nothing, workload logs are kept for at least 30 days, route verification reads the certificate each route presents on a connection of its own, and `readServiceDeploymentStatus` (interfaces `32.54.0`) reads a deployment operation without changing it. Its first start creates `cloudly_runtime_log_queue`; on NoSQLDB `10.6.1` that creation waits at most 5 s for the open transactions on the Cloudly database, and a transaction an earlier Cloudly left open by exiting before its stop completed holds the database until its session expires 30 minutes later, so after an unclean stop of the previous Cloudly start the upgrade no earlier than 30 minutes after that exit. It adds no data step and keeps the data version `0.30.0`, so an upgrade from `1.28.2`, `1.28.1` or `1.28.0` runs none. From `1.28.1` or earlier, Cloudly `33.18.2`'s fixes apply too: Cloudly `33.18.2` is a fixes-only patch over `33.18.1`: a node's network configuration advances only once the node's application receipt names the projection it holds, so a node no longer receives a new version while it still applies the last one; upgrade every node to Pallet `36.3.0` or later (interfaces `32.50.0` or later) first, because a node that sends no receipt keeps the projection it holds and receives no successor. It adds no data step and keeps the data version `0.30.0`, so an upgrade from `1.28.1` or `1.28.0` runs none. From `1.28.0` or earlier, Cloudly `33.18.1`'s fixes apply too: Cloudly `33.18.1` is a fixes-only patch over `33.18.0`: a node's log batches append without its node fences, so they no longer miss their budget against the node's producer passes, and the deployment preflight answers within 25 s, past which it answers the retryable `DEPLOYMENT_PREFLIGHT_UNAVAILABLE`. It adds no data step and keeps the data version `0.30.0`, so an upgrade from `1.28.0` runs none. From `1.27.0` or earlier, Cloudly `33.18.0`'s changes apply too: Cloudly `33.18.0` loads the App Store catalog at runtime instead of bundling it, from the registries of its `appStoreCatalogRegistries` setting (empty means the npm registry), so a Cloudly template update needs an appstore release only; it ignores `APPSTORE_URL`, whose remote source is removed, and while no verified catalog is active it refuses App Store install details, upgrade preview and upgrade with `APPSTORE_CATALOG_UNAVAILABLE`. It adds no data step and keeps the data version `0.30.0`, so an upgrade from `1.27.0` runs none. From `1.26.0` or earlier, Cloudly `33.17.3`'s changes apply too: Cloudly `33.17.3` moves the data version from `0.28.0` to `0.30.0`: every upgrade from `1.26.0` or earlier runs the forward-only data steps `route-claim-absent-owners` to `0.29.0` (the stored nulls of absent owners are removed from every route claim) and `bounded-runtime-history` to `0.30.0` (every archived deployment record is deleted, the index `archiveState_1` is dropped and the accepted Spark observations are pruned to the rows the census reads), and every Cloudly before `33.17.3` refuses the `0.30.0` data. Runtime history is bounded from then on: a Coreflow report deletes the deployment records it no longer names instead of archiving them, `getDeployments` answers the current records whether or not it is asked to `includeArchived`, `deploymentArchiveRetentionDays` is accepted but has no effect, and the dashboard no longer offers archived deployments. A deployment preflight no longer fails `DEPLOYMENT_PREFLIGHT_UNAVAILABLE` on a route claim that stores an absent owner as `null`, and the deployment and adoption preflights log the cause of an unexpected failure. A node's requests no longer contend on the controller fence and share a 6 s budget below the cluster relay's 8 s forward deadline, a request out of budget is refused `controller-deadline`, which the node retries, and a node deletion refuses what a racing write bound to the node. Cloudly consumes the projection application receipts of Pallet `36.3.0`, so a flow a node's projection withdrew is granted again on the same leases once the node reports that it applied the withdrawal; an earlier Pallet keeps every withdrawal carried. Cloudly `33.17.2` starts a database below data version `0.25.0` that holds a runtime slot: the data step `runtime-log-attempts` read through models startup has not prepared and was refused, and now reads and writes through the driver; an install whose first start failed there stayed at data version `0.24.0` and upgrades to `1.28.4` normally. Cloudly `33.17.1` fixes the first start of `33.17.0`, which crash-looped on a database holding Pallet-era nodes: its first data step `cluster-node-hostname-intent` stated each intent through the node and cluster models, which startup has not prepared while it runs the data steps, and was refused before its first write; the step now reads and writes the stored node and cluster documents directly, like the other data steps. The migration ledger does not advance past a failed step, so an install on `1.25.0` whose first start failed stayed unchanged at data version `0.25.0` and upgrades to `1.28.4` normally. Cloudly `33.17.1` keeps the data steps of `33.17.0`, which move the data version from `0.25.0` to `0.28.0`: every upgrade from `1.24.0` or earlier, and from `1.25.0` whose first start failed, runs the forward-only data steps `cluster-node-hostname-intent` to `0.26.0` (every Pallet-era node gets the intent of the hostname it reports, and nothing is renamed), `deployment-operation-route-evidence` to `0.27.0` (a routeless deployment operation that succeeded records its empty route evidence) and `service-secret-target-predecessor` to `0.28.0` (a secret target state an earlier service deletion left behind is removed) before the `0.28.0` to `0.30.0` steps. The template stays marked breaking, migration-required, backup-before-upgrade and manual-review, because hosts read the flags from the target version alone and every upgrade from `1.26.0` or earlier runs the `0.28.0` to `0.30.0` steps, after the `0.25.0` to `0.28.0` steps from `1.24.0` or earlier; every upgrade from `1.19.0` or earlier runs the forward-only data step `runtime-log-attempts` from `0.24.0` to `0.25.0` before them (the log record of every slot's current attempt is written), and every upgrade from `1.15.0` or earlier runs `corestore-control-token-state` from `0.23.0` to `0.24.0` before that (a Corestore control token stored earlier is recorded as revision 1); every Cloudly before `33.17.3` refuses the migrated data: stop Cloudly and take a verified backup first, as rollback is full-restore-only. From `1.24.0` or earlier, Cloudly `33.17.0`'s changes apply too: Cloudly `33.17.0` lets a legacy import reserve: it takes over every route claim its legacy service holds in the import's organization, the cluster ingress keeps serving each hostname for the legacy service until the import's service declares it, and cleanup or rollback before promotion hands the claims back while the legacy service exists; `ROUTE_UNAVAILABLE` and `DEPLOYMENT_ROUTE_COLLISION` name each conflicting hostname and the services holding it. It owns the hostname a node should carry (interfaces `32.52.0`, `cloudly-worker-<name>` by default): `setClusterNodeHostname` renames a Pallet-era node and `resetClusterNodeHostname` sets the default, Spark reads the intent at `POST /spark/nodes/host`, and a Pallet service's gateway routes and inbound mail follow the node its runtime spec pins by id, so a rename moves no traffic. A routeless deployment records its empty route evidence when it succeeds; deleting a cluster's designated ingress service is refused `SERVICE_IS_CLUSTER_INGRESS`, `designateClusterIngress` recovers a designation whose bearer is no longer active, and a deleted service's secret target state goes with its row, so a service recreated under its id writes its secrets again. From `1.23.0` or earlier, Cloudly `33.16.0`'s changes apply too: Cloudly `33.16.0` captures a legacy service's runtime attestation from an administrator's host observation, without a Coreflow session: `captureLegacyServiceRuntimeAttestation` takes `hostObservation`, the legacy Swarm service's spec image and mode and, per replica, its node, Swarm task, container, image store, image id, `RepoDigests`, state and health, read at most 15 minutes before the capture; Cloudly judges it against the one root every replica runs, which it requires whole in its registry and which the legacy tag need not still name, and refuses incomplete evidence without storing anything. The registry prune keeps an attested root until a release's `cloudly-legacy-import` evidence names the attestation or the legacy service is retired. From `1.22.0` or earlier, Cloudly `33.15.3`'s changes apply too: Cloudly `33.15.3` serves a promoted route: a route's identity carried the service's runtime write fence `runtimeAuthorityFenceGeneration`, which every runtime write of the service advances, in a Pallet-born cluster the route join's own workload lease read included, so the route plan read after the cluster ingress's certificate fetch never matched the one before it and every refresh that fetched a certificate withdrew the cluster's whole route table; a route's identity now carries only the versions that change with its authority (the route intent, the runtime policy revision, and per endpoint its assignment, its node's session and its target), while a service being deleted or holding no runtime authority is still refused by the route join, so a revoked route is withdrawn as before, by name. A table withdrawn because its authority changed or its route sources could not be read names that withdrawal as the reason the cluster ingress serves none of its routes, so a failing route verification states it; that reason states facts about its own route only, because one table carries the routes of several organizations: a route whose authority changed names its changed field, every other route only that another route's authority (or the ingress designation) changed during the certificate fetch, and a source-read failure only that the route sources could not be read, its error staying in the operator log. From `1.21.0` or earlier, Cloudly `33.15.2`'s changes apply too: Cloudly `33.15.2` lets a promoted route reach CoreTraffic: a route's identity carries the route intent version `routeIntentGeneration` instead of the whole-document `routeStateGeneration`, so the status writes during the cluster ingress's certificate fetch no longer withdraw the cluster's route table, a plan change during the fetch withdraws it only when it revokes a route the table is about to serve, and the change is named by route and input. A cluster ingress flow that a compensated promotion withdrew and a later promotion wants again no longer stalls the node's network projection: Cloudly holds that flow back with its withdrawal carried and signs the rest of the node's network, while a workload or router grant wanted again while withdrawn withholds the node's projection as `withdrawn-grant-reissued` and any other contract refusal as `projection-rejected`, each naming what it holds; the cluster ingress leaves a route whose grant is held out by name, and a failed route verification states why no route is served for its hostname. A held flow is granted again only once the target or CoreTraffic runs under a new lease. From `1.20.0` or earlier, Cloudly `33.15.1`'s changes apply too: Cloudly `33.15.1` fixes the deployment preflight of an existing service Pallet runs: it read the current runtime from Coreflow alone and answered NO-GO (`CURRENT_RUNTIME_DIGEST_MISSING`, `RUNTIME_ATTESTATION_MISMATCH`) for a service whose rollout status was verified, and now reads the runs of the service's current plan, the evidence its deployment status reads, when Pallet executes that plan on every cluster it targets. It also lets a route promotion survive the status writes of its own gateway sync: the promotion fenced on `routeStateGeneration`, the service's whole-document version, which the route status its gateway sync records, Coreflow's reconciliation reports and its own verified-route status all advance, so every promotion failed `DEPLOYMENT_ROUTE_FENCE_CONFLICT` with no route evidence; it now fences on `routeIntentGeneration`, which only a write that changes the service's domains advances, so a concurrent route change, a change and back included, still fails it fenced, and a promotion interrupted under `33.15.0` is recovered as fenced (retryable), without a rollback. From `1.19.0` or earlier, Cloudly `33.15.0`'s changes apply too: Cloudly `33.15.0` keeps workload logs: a Pallet node's log batches are kept per attempt, their payloads in Cloudly's own bucket (the template's `S3_BUCKET`) under `runtime-logs/`, bounded to 8 MiB and 8192 batches per attempt and the newest 8 attempts per slot, each batch for its config's `logs.retentionMs`, and read with `getServiceRuntimeLogAttempts` and `getRuntimeAssignmentLogs` (interfaces `32.47.0`) or the service page's Logs tab. A Pallet-executed rollout that succeeded stays succeeded when a replica later fails or is replaced; a failing service runtime pass names its step, and a database error its code name and number. A launcher secret written before a service's first image plan no longer leaves the service refused `secrets-unsupported`, because every image plan is written with the service's secret deployment plan in one transaction. The designated cluster ingress runs with `SERVEZONE_CLUSTER_RELAY_ORIGIN` and `SERVEZONE_CLUSTER_NODE_ID`, which Cloudly writes into that workload's environment (a cluster without a valid relay refuses it `cluster-relay-missing`); the template sets neither. From `1.18.0` or earlier, Cloudly `33.14.1` and `33.14.2`'s changes apply too: Cloudly `33.14.2` completes a rollout Pallet executes: Cloudly reports on every rollout whose target clusters are all on Pallet, one reporter per cluster (`pallet/<clusterId>`) over the runs of exactly the current desire, so it moves to `succeeded` (or `ready-for-route`) once its runs are ready at the requested digest and fails when a run fails, and `getServiceDeploymentStatus` reads its runtime tasks from the runtime manager instead of Coreflow, so tsdeploy no longer times out on a Pallet-attached service. A launcher-secret run admitted after a Cloudly restart, reconnect or credential rotation gets its material again instead of waiting `secret-mount-uncertain` (`secret-recipient-inactive`) until its node process restarts, because a node's secret recipient is active for every session of the node process that enrolled it. A failing producer pass is logged under its producer's subject once per change of cause, with how long it ran and a value-free cause naming the failing step and check (such as `network-projection-rejected`), and its recovery once; a failed sweep the timer started is no longer dropped. From `1.17.0` or earlier, Cloudly `33.14.0`'s changes apply too: it gives a platform-owned service's published ports infrastructure-administrator authority: an administrator designates a platform organization's service (an organization id carrying `:`) with `designatePlatformOwnedService`, withdraws it with `undesignatePlatformOwnedService` and reads it with `getServicePlatformOwnership` (interfaces `32.45.0`), after which only a verified administrator reads and writes its published ports, any other organization id is refused `organization-not-platform`, and the designation, stored on the service document, is read inside the published-port request's one admitted operation; every organization service keeps the organization-owner rule. It also names and logs every assignment dispatch outcome under a closed, value-free reason, pushes a refused or unanswered push again on the next pass, and keeps a run its node refused (cause `refused`) instead of replacing it on the failure backoff until its input changes. From `1.16.0` or earlier, Cloudly `33.13.3` and `33.13.4`'s changes apply too: Cloudly `33.13.4` delivers a run's secret material through the WorkloadInit launcher again (Corestore's `MONGODB_URI` included), remembers a successful WorkloadInit approval verification per artifact, and names the check of every refused material request with a closed, value-free `reason`; since Cloudly `33.13.3` a node's session is pushed each assignment revision once instead of on every delivery pass. From `1.15.0` or earlier, Cloudly `33.11.0` to `33.13.2`'s changes apply too: they let an administrator set the Corestore control token without an exec into Cloudly's container (`setCorestoreControlToken`, interfaces `32.42.0`, with its revision and value-free receipts in the new collections `cloudly_corestore_control_token_state` and `cloudly_corestore_control_token_receipts`, and `servezone corestore set-control-token`), keep every managed VPN member across a protected-authority step that only adds, retire a node and its egress owner (`retireClusterNode`, interfaces `32.43.0`), ask a retiring node on interfaces `32.44.0` to withdraw its allocation protection so that a stopped or offline node no longer blocks allocation, and keep a stopping workload's lease in its node's projection until the node's stop receipt is accepted. From `1.14.0` or earlier, Cloudly `33.10.0`'s changes apply too: it lets an operator obtain a cluster relay's bearer without an exec into Cloudly's process: `exportClusterRelayAuthorization` (interfaces `32.41.0`) requires a freshly signed-in administrator, proves the delivered credential version against the hash its generation issued, commits an audit receipt fenced at that generation before it answers the bearer, and never logs it; the receipts live in the new collection `cloudly_cluster_relay_authorization_exports`, installed at startup and listed by `getClusterRelayAuthorizationExports`, and `servezone relay export-authorization` (`@serve.zone/cli` `33.10.0`) writes the bearer as a new `0600` file. From `1.14.0` or earlier, Cloudly `33.9.0`'s changes apply too: a node's managed VPN member is kept across its network projection changes instead of being withdrawn from the hub network on every workload change (`bindGetRuntimeManagedVpnCredentialSuccessor`, interfaces `32.39.0`), the failure cause a node reports with a failed run (interfaces `32.40.0`) is stored and shown in the runtime assignment views and the dashboard's Cause column, and `deleteServiceById` answers success once a service is marked for deletion while another deleting service drains, naming its refusals `SERVICE_LIFECYCLE_BUSY`, `SERVICE_ORGANIZATION_AUTHORITY_REQUIRED` and `SERVICE_MANAGER_STOPPING` instead of an internal error. From `1.13.0` or earlier, Cloudly `33.8.3`'s fix applies too: it lets `deleteServiceById` retire a legacy service whose Corestore resources a successor adopted: its live Corestore bindings are tombstoned with the ordinary config push once every claimed legacy resource of each binding's capability has passed to the successor's live adopting binding, while a service without such a handover is still refused `CORESTORE_CLEANUP_TARGET_AUTHORITY_REQUIRED`. A legacy service whose runtime attestation a legacy-import operation still uses (`reserving`, `reserved`, `provisioning` or `awaiting-image`) is refused `SERVICE_LEGACY_IMPORT_PENDING` (retryable) and keeps running; import and deletion are serialized on the registry repository, so an import that starts after the check refuses as `LEGACY_IMPORT_SOURCE_MISMATCH`, and a deletion that proceeds deletes the attestations no release consumed. From `1.12.0` or earlier, Cloudly `33.8.2`'s fix applies too: Cloudly names why it refused a node's report: a refused `reportRuntimeNetworkProtection`, `reportRuntimeAssignmentTerminalReceipt`, `reportRuntimeAssignmentObservation` or `reportRuntimeAssignmentLogs` is logged as a warning once per node, report and distinct reason, and the node is answered with the unchanged error text plus `{ code: 'runtime-session-report-refused', reason }` as the error's data. From `1.11.0` or earlier, Cloudly `33.8.1`'s fix applies too: deploy before any Pallet that sends `discardedCaptures` or a `not-kept` log loss reaches a fleet node, since it accepts those log batch fields of interfaces `32.38.0`, which Cloudly `33.8.0` refuses on every retry, and still keeps no workload logs. From `1.10.0` or earlier, Cloudly `33.8.0`'s changes apply too: deploy before any Pallet that captures workload output reaches a fleet node, since Cloudly `33.8.0` answers a Pallet's `reportRuntimeAssignmentLogs` (interfaces `32.37.0`) with `not-kept`, which an earlier Cloudly leaves unhandled. Cloudly `33.8.0` lets a legacy `deployOnPush` service without deployable source move to a greenfield successor that runs the exact image it ran (`captureLegacyServiceRuntimeAttestation`, a `legacyImport` reservation under the capability `deployment:import-legacy`, and `importServiceDeploymentLegacyImage` in place of a push), judges promotion against the platforms of the service's rollout target, refuses a registry repository that belongs to another service as `REGISTRY_REPOSITORY_MISMATCH`, promotes and routes a service with a Corestore `database` or `objectstorage` binding again, and reads a node whose last report is older than 180 seconds as `offline`. Its web UI moved to path URLs and a regrouped menu, so bookmarks of the old UI locations open the not-found screen; server paths such as `/status` and the OIDC callback are unchanged. From `1.9.0` or earlier, Cloudly `33.7.0`'s changes apply: Cloudly `33.7.0` lets a fresh greenfield service take over a legacy service's Corestore database and bucket with their data and retention intact: an `adoptCorestoreLegacyResources` selection entry may name `successorServiceId` (interfaces `32.34.0`, carried out by Corestore `33.2.0` or later), the successor must share the owner's organization, be an immutable-deployment service, own no legacy resource of the capability and hold no other binding of it, and each legacy resource is adopted by one service only (`legacy-resource-adopted-elsewhere`, `successor-organization-mismatch`, `successor-not-greenfield`, `successor-owns-legacy-resource`). Since Cloudly `33.6.1`, a deployment reservation whose release tag the registry already holds is refused `DEPLOYMENT_RELEASE_TAG_OCCUPIED` instead of waiting for its image forever, an administrator's manifest push to a release tag a deployment operation reserved is refused `409 release-tag-reserved`, and a binding status report reaches its cluster relay only when it changed what the relay reads. From `1.8.0` or earlier, startup runs the forward-only data step `deployment-machine-user-grants` from `0.22.0` to `0.23.0`, which keeps on every deployment machine user only the grants a capability check reads and permanently removes the rest (such as the `{ serviceId, capabilities }` grants of Cloudly 11); stop Cloudly and take a verified backup first, as the way back is the pre-upgrade backup. Cloudly `33.6.0`'s changes apply too: Cloudly stops gracefully on SIGTERM and SIGINT within 8 seconds, below the 10-second stop grace of Docker and Swarm, so a stop or restart no longer leaves a database transaction held and the next start no longer crash-loops on `EFENCE_BUSY`; a process ended by SIGKILL still holds its database session until the server's session timeout. Every new service gets its own deployment namespace, so two services of one project reserve without `DEPLOYMENT_RESOURCE_COLLISION`, while a deployed service keeps its namespace, and `getDeploymentMachineUsers` lists users configured under Cloudly 11 again. From `1.7.0` or earlier, Cloudly `33.5.0`'s changes apply: Cloudly reserves a deployment only for a deployment machine user: `reserveServiceDeployment` refuses an administrator with `DEPLOYMENT_MACHINE_IDENTITY_REQUIRED`, including a deployer that signs in with a username and password (such as tsdeploy with `TSDEPLOY_CLOUDLY_USERNAME`/`TSDEPLOY_CLOUDLY_PASSWORD`), so before upgrading create a deployment machine user per deployer (`mutateDeploymentMachineUser`, or Security → Access → Deployment machine users in the dashboard), attach its grants with `configureServiceDeploymentMachineUser` and switch the deployer to its token; an existing `api` machine user with its grants already qualifies. A machine identity or registry bearer issued by an earlier release is refused until its holder exchanges its token again with `getIdentityByToken`, and removing a token now ends the sessions opened with it. Let no deployment run during the upgrade: a run in progress keeps its pre-upgrade identity and is refused for the rest of that run (rerun it, or resume it with `deploy-retry`). From `1.3.0` through `1.6.0`, startup runs the forward-only data step `runtime-session-protocol-offer` from `0.21.0` to `0.22.0`, which states `protocol: null` on every Pallet session row recorded before Cloudly stored its node's protocol offer; stop Cloudly and take a verified backup first, as rollback is full-restore-only. From `1.6.0`, Cloudly `33.4.0`'s changes apply: Cloudly `33.4.0` lets `setServicePublishedPorts` publish a contiguous range through `hostPortEnd` (at most 1024 ports in 64 entries per protocol) and same-port outbound through `symmetric: true`, which needs public egress (`published-port-symmetric-without-egress`) and owns its inside ports (`published-port-symmetric-inside-overlap`). New handoff leases translate outbound flows only into `49152-65535`, whose ports are refused `published-port-reserved`; a node keeps its `1024-65535` lease until its router is re-created. A policy write for a service being deleted is refused `service-deleting`. A projection carrying a range or a symmetric entry is withheld as `node-contract-behind` from a Pallet node whose session states a release below interfaces `32.31.0`, or an unrecorded one, so ranges and symmetric entries take effect on a node only once it runs a Pallet release built on interfaces `32.31.0` or later. From `1.5.0`, Cloudly `33.3.0`'s changes apply: Cloudly `33.3.0` lets an administrator set a service's network egress with `setServiceNetworkEgress` (public internet, and the platform endpoints of the protected authority), and refuses a workload whose database or object-storage binding sits on a node whose Corestore endpoint its network does not select as `database-endpoint-unselected` or `objectstorage-endpoint-unselected`; a replica already running keeps running while its target reports the refusal. From `1.4.0`, Cloudly `33.2.0`'s changes apply: Cloudly takes a dcrouter admin token once through `bootstrapExternalGatewayCredential` to provision its own gateway-client credential, starts a first enrollment with the gateway settings, and stages a gateway settings change the held credential cannot carry until the next bootstrap. From `1.2.1` or earlier, startup runs the forward-only migration from `0.20.0` to `0.21.0` before that step, dropping the relay certificate and DNS collections of Cloudly's retired Cloudflare and Let's Encrypt integration and logging every relay name whose A record Cloudly had written at Cloudflare, which the operator removes at the provider. dcrouter holds every cluster relay name's A record and certificate from then on, `SERVEZONE_SSLMODE=letsencrypt` is refused, and the typed API changes as the Cloudly 33.0.0 changelog lists. Stop Cloudly and take a verified backup before upgrading; rollback is full-restore-only. Roll out Cloudly `33.19.2` before Coreflow `33.2.0`; Coreflow `33.1.0` is the minimum. From `1.3.0`, also roll out Cloudly before Coreflow and Corestore `33.0.0`, and set every node's Corestore database endpoint, because a database binding on a node without one is not granted and its service is refused `database-endpoint-missing`, and existing database bindings return no credentials until they are granted again for the endpoint. From `1.1.10` or earlier, startup first runs the `1.2.0` steps from `0.10.0` and needs completed Secrets v2 cutover retirement. Both the existing Secrets v2 keyring and operator-approved WorkloadInit authority are required encrypted inputs delivered as separate root-owned `0400` files; the public environment contains only their fixed paths. |
 | `ghost` | MariaDB | Uses MySQL-style `database__connection__*` environment variables. |
 | `gitea` | MariaDB | Uses Gitea database environment variables with `${MARIADB_*}` placeholders. |
 | `nextcloud` | MariaDB, Valkey | Uses MySQL-compatible database variables. Valkey is declared as a platform requirement. |