1.15.13 — The nginx map wedge heals itself; capacity resize + batch plans; MojoSec authoritative cases

2026-08-21

Heals the nginx WebSocket-map wedge introduced by 1.15.10 end to end: a wedged node repairs itself on its first deploy of this release, edge generations adapt to whichever side of the node's graph declares the map, and a live generation can never again be rewritten in place. Also ships capacity resize actions with a two-phase batch plan/apply API, and MojoSec's opt-in authoritative mode that summarizes web/FIM evidence into cases instead of per-receipt events.

Added

• Capacity: resize_cache and resize_database actions on the existing apply contract — curated size ladders from the capacity report's new sizes block; database resizes are per named instance with the failover promotion tier riding in the same call.
• Capacity: two-phase batch plan/apply — POST /api/aws/capacity/plan validates, orders, words and prices an ordered set of capacity actions (an unpriced type is an honest null plus a warning, never a silent $0); POST /api/aws/capacity/plan/apply confirms by plan_id behind a structural fleet fingerprint (409 plan_stale) and a single-use lock (409 plan_already_applied); GET /api/aws/capacity/status now takes operation XOR batch. Both new endpoints carry apply's full permission gate — a plan leaks intent and cost.
• MojoSec: an opt-in authoritative enrollment mode routes policy-bound web observations and trusted expected-change FIM straight to summarized cases — no per-receipt event, the contribution owns the ack. Trusted deployment FIM coalesces into one case per sensor and deployment per UTC day, settling after a quiet window (new settle_mojosec_cases cron); promotions into high/critical project exactly one event per urgency step.
• MojoSec: the case list gains settled/family/deployment_id filters and rows carry deployment identity; case detail adds the breakdown, settled_at and the projection ratchet; case metrics report settled cases and suppressed per-receipt events.
• Admin fleet page: the Redis and database size dropdowns go live from the report's ladder, and the page renders the server's plan — wording, ordering and pricing all come from the server.

Changed

• Edge generation ids include the framework version, so a renderer change always stages into a fresh directory and passes the full validate → swap → revert gate.
• terminate_node of a node a completed drain removed from every group no longer 409s not_registered: fresh EC2 facts must prove it a tagged fleet member — an exact project+env identity match against a registered member, or the capacity clone stamp; a generic ownership tag alone never suffices, so one environment's portal cannot terminate another environment's box.
• When a MojoSec sensor is enrolled, deploy-owned writes into host config directories are journaled together with their parent directories, so routine deploy writes stop surfacing as unexplained FIM changes.

Fixed

• The nginx WebSocket-map wedge from 1.15.10: a node whose bootstrap predates the bootstrap-owned $connection_upgrade contract now self-heals — the deploy's nginx runtime fragment carries the map whenever nothing else in the graph declares it (and yields to any declaration elsewhere), and an edge generation probes the real nginx -t verdict to carry the map itself when that node needs it, flipping back automatically if the bootstrap later declares one. A node already wedged — every nginx -T failing, deploys and rollbacks dying at worker user; got [] — is repaired by its first deploy of this release.
• Deploy convergence failures quote nginx's own [emerg] line instead of the bare got [].
• A live edge generation can no longer be rewritten in place: identical re-stages are skipped and changed bytes are refused loudly. Previously a pending retry could silently rewrite the serving directory's config — the node broke on disk with no swap to revert while nginx kept serving from memory.
• The MojoSec case list 500ed on any non-empty page; datetimes nested in list payloads now serialize.

Upgrade notes

• One database migration (incident app) — the routine migrate on deploy covers it.
• On the first upgrade, every edge node re-stages its generation once (the framework version now moves the id), and a pre-contract node may gain the $connection_upgrade map in the deploy-owned nginx fragment — both are one-time, validated convergences.
• A node wedged by the 1.15.10 map move heals on its first deploy of this release; until that deploy lands, its rollback targets remain broken (older releases carry the same failing check).