BridgesLLM Portal 4.0.3
Hotfix. 4.0.1 and 4.0.2 are withdrawn — do not install them. 4.0.3 supersedes both.
curl -fsSL https://bridgesllm.ai/install.sh | sudo bashFixed
Portals installed before the 4.0 migration baseline can now update. The update candidate verified the database by requiring the applied migration history to exactly equal the migrations bundled with the release. Databases created before the baseline was squashed legitimately retain their original pre-baseline rows, so that comparison could never balance and the update aborted with Database migration inventory does not match the bundled Portal runtime. The candidate now proves that every bundled migration is applied, in order, with a matching checksum, and that nothing unknown was applied from the baseline onward. Tampered, missing, rolled-back, and drifted schemas are still rejected.
HTTPS readiness probes the addresses Caddy actually serves. The readiness probes pinned themselves to 127.0.0.1:443. When Caddy is bound to specific addresses, nothing listens on loopback, so the probe could never connect and every update and rollback stalled for the full 90-second timeout before failing. Certificate and hostname validation are unchanged.
A failed verification no longer stops a healthy Portal. If verification failed after a rollback had already restored and started the previous Portal, recovery re-fenced the service and killed it, leaving the machine with no Portal running at all. Recovery now leaves a serving Portal in service and only fences when nothing is serving.
Portals whose Caddy site was customised by hand can now update. The managed Caddy converger only recognised a Portal site that still carried its installer ownership marker. On a host where that marker had been edited away — commonly while adding a webhook route, static asset handling, or a custom security header — the converger appended a second site block for the same hostname, Caddy rejected the whole file with ambiguous site definition, and the update aborted before it could start. The converger now adopts an operator-managed Portal site untouched, preserving hand-written routes, headers, and matchers byte for byte. A hostname genuinely claimed by a non-Portal site, or by more than one site, stops the update with an explicit message instead of an opaque parse error.
Withdrawn
4.0.1 and 4.0.2 carried the update fixes above, but were built from a branch cut before the final 4.0.0 assembly. Their runtime omitted code that shipped in 4.0.0 — the ask-a-question broker and plugin route, Project Chat restart recovery, and legacy Project continuity adoption among them — so installing either would have moved a 4.0.0 Portal backwards. 4.0.3 carries the same fixes on top of the complete 4.0.0 source.
Full detail in the changelog.