---
title: "1.37.4 — Shared ACME validation and optional durable chat cursors"
description: "Adds shared ACME validation, guided DNS setup and optional PostgreSQL chat cursors. Repairs certificate-job recovery, Assistant readers and mixed-family threat-feed refreshes."
date: "2026-10-20"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-37-4/"
---

Adds shared ACME validation, guided DNS setup and optional PostgreSQL chat cursors. Repairs certificate-job recovery, Assistant readers and mixed-family threat-feed refreshes.

### Added
- Shared ACME validation v2 supports controller-authorized project participants while each deployment retains its private keys.
- Shared DNS readiness, connection, verification and wildcard-request actions are available through REST, aws-check and approval-gated Assistant tools.
- Optional PostgreSQL chat cursors provide batched unread positions, committed read hooks and sparse unread preservation across merge and revert.
- A public User-key locking helper supports host transactions before chat room locks.

### Changed
- Cursor reads are cumulative; sending acknowledges earlier arrivals through the sender’s own message. Deletion, flagging and expiry retain arrival count slots.
- Prepared shared connections guard certificate routing immediately; missing trust or failed proof cannot silently fall back to direct DNS.
- DNS readiness distinguishes valid serving material from blocked renewal, unavailable key custody and held jobs.

### Fixed
- Concurrent DNS setup, verification and restart operations cannot revive stale connection generations.
- Temporary certificate ownership collisions receive bounded retries without reviving cancelled work or retrying unrelated CA failures.
- Assistant group/member readers use the correct account models.
- Assistant job histories serialize the actual event, details and log fields.
- Mixed IPv4/IPv6 threat feeds retain supported IPv4 entries; IPv6-only refreshes preserve the previous usable cache.

### Security
- ACME operations revalidate credential, project and participant authority, with allocation-locked challenge isolation and permanent trust revocation.

### Upgrade notes
- Apply DNSMan migrations 0005 and 0006. Drain old hub HTTP writers and sweep workers before migrating; resume only upgraded hub processes before enabling shared validation.
- Drain and restart old downstream issuance workers before accepting shared connections. The participant migration is irreversible; retain upgraded routing guards once shared connections exist.
- Apply chat migration 0005. Chat stays in legacy mode unless CHAT_READ_STATE_BACKEND is explicitly set to cursor.
- Before cursor activation, audit and drain every message, membership and maintenance writer, including host transaction lock order. Run activate_initial() to clear existing unread once, then enable cursor mode consistently.
- Cursor mode does not dual-write receipts. Retain the cursor provider during application rollback after activation.