omnigateway 0.10.3 → 0.11.0

package/README.md

@@ -265,6 +265,23 @@ Several replicas behind a load balancer are **cluster mode** on Postgres and
 Redis. All of it, with the nginx block and the Kubernetes base, is in
 [docs/deploying.md](docs/deploying.md).
 
+### Upgrading past v0.10.3 — action required
+
+The first release after v0.10.3 drops two columns from `credential_health`
+that every earlier gateway writes on **every successful request**. The moment
+the new version migrates the database, every older gateway still running fails
+each request *after* the upstream call has completed and been billed: the
+client gets its content and then an aborted connection with no terminal frame.
+
+- **Cluster mode:** a rolling deploy does not protect you — the surviving old
+  replica is the one that breaks. Scale to **one replica** before deploying
+  this release, then scale back up, or accept that every old replica serves
+  only failures until it is replaced.
+- **Single process (SQLite):** the upgrade itself is safe; the rollback is not.
+- **Rollback is unsafe on both.** An older version cannot re-add the columns
+  and fails the same way against the new schema. Take a snapshot **before** the
+  deploy; restoring it is the only way back.
+
 ## Configuration
 
 Configuration is environment variables, read from the installation's `.env`:
@@ -290,6 +307,7 @@ Configuration is environment variables, read from the installation's `.env`:
 | `OMNI_CLUSTER_MODE` | No | unset | `true` selects [cluster mode](docs/deploying.md#running-more-than-one-gateway) and requires the two URLs below; unset is one process on SQLite, and then the URLs must be unset too |
 | `OMNI_DATABASE_URL` | In cluster mode | — | The shared Postgres store |
 | `OMNI_REDIS_URL` | In cluster mode | — | The coordinator every process of a cluster shares: rate-limit counters, sessions, leases, push fan-out |
+| `OMNI_DAY_OFFSET_MINUTES` | No | host's UTC offset at boot | Fixed minutes east of UTC for daily usage buckets; set explicitly and identically on every replica |
 
 `OMNI_ROOT` is the one variable read from your shell and never from a root's `.env`, for the
 reason it has to be: a variable that selects the installation cannot live inside the installation
@@ -357,8 +375,8 @@ Worth knowing before you deploy it:
   password and a per-key client dashboard exist; there is no multi-tenancy —
   every provider account is the operator's, whoever is looking.
 - **Two grains of usage history.** Detailed request logs are pruned after 30
-  days by default; a daily rollup is kept for 400 days. A day is your host's
-  local midnight, fixed when the row is written.
+  days by default; a daily rollup is kept for 400 days. A day uses a fixed UTC
+  offset, defaulting to the host's current offset; fleets must set it explicitly.
 - **Body capture is forensics, not an archive.** It is off unless you turn it on
   with both keys, it expires on the request-log window, and it is capped at
   100,000 rows. `omni bodies` reads one request's capture; nothing searches