1.37.4 — Shared ACME validation and optional durable chat cursors

2026-10-20

Adds shared ACME validation, guided DNS setup and optional PostgreSQL chat cursors. Repairs certificate-job recovery, Assistant readers and mixed-family threat-feed refreshes.

Added

• Shared ACME validation v2 supports controller-authorized project participants while each deployment retains its private keys.
• Shared DNS readiness, connection, verification and wildcard-request actions are available through REST, aws-check and approval-gated Assistant tools.
• Optional PostgreSQL chat cursors provide batched unread positions, committed read hooks and sparse unread preservation across merge and revert.
• A public User-key locking helper supports host transactions before chat room locks.

Changed

• Cursor reads are cumulative; sending acknowledges earlier arrivals through the sender’s own message. Deletion, flagging and expiry retain arrival count slots.
• Prepared shared connections guard certificate routing immediately; missing trust or failed proof cannot silently fall back to direct DNS.
• DNS readiness distinguishes valid serving material from blocked renewal, unavailable key custody and held jobs.

Fixed

• Concurrent DNS setup, verification and restart operations cannot revive stale connection generations.
• Temporary certificate ownership collisions receive bounded retries without reviving cancelled work or retrying unrelated CA failures.
• Assistant group/member readers use the correct account models.
• Assistant job histories serialize the actual event, details and log fields.
• Mixed IPv4/IPv6 threat feeds retain supported IPv4 entries; IPv6-only refreshes preserve the previous usable cache.

Security

• ACME operations revalidate credential, project and participant authority, with allocation-locked challenge isolation and permanent trust revocation.

Upgrade notes

• Apply DNSMan migrations 0005 and 0006. Drain old hub HTTP writers and sweep workers before migrating; resume only upgraded hub processes before enabling shared validation.
• Drain and restart old downstream issuance workers before accepting shared connections. The participant migration is irreversible; retain upgraded routing guards once shared connections exist.
• Apply chat migration 0005. Chat stays in legacy mode unless CHAT_READ_STATE_BACKEND is explicitly set to cursor.
• Before cursor activation, audit and drain every message, membership and maintenance writer, including host transaction lock order. Run activate_initial() to clear existing unread once, then enable cursor mode consistently.
• Cursor mode does not dual-write receipts. Retain the cursor provider during application rollback after activation.