4.3.0

Added

• The Kubernetes deployment probe observes the FerroTERM workload (#3328).
  scripts/deploy-probe-k8s.sh gains a terminology stage (P-K8S-TERM-*) that
  reads the chart's terminology.enabled claims off a running cluster: the
  absence of every terminology object while the gate is off, the rollout, the
  applied runtime posture from the container runtime's own spec, the shaped seed
  reaching the process through the ConfigMap volume, the NetworkPolicy refusing a
  pod the CDR's selector does not name in this namespace and in another while the
  CDR itself is admitted, and a value-set binding resolved through the Service. A
  mounted index is probed when K8S_TERM_INDEX_CLAIM names an existing claim,
  and is declared not exercised by probe id when it does not.
• Identifier-scanner rules for Germany and Switzerland, and the Swiss access-log
  retention floor (#3318, #3319). de-kvnr refuses the unchangeable part of a
  Krankenversichertennummer (a letter, eight digits and the GKV-Spitzenverband's
  check digit), ch-ahvn13 the AHV number in its plain and dotted display forms
  (AHVV Art. 133; the BSV's Wegleitung check digit) and ch-epd-pid the EPD
  patient identification number (EPDV-EDI Anhang 1, the fixed 76133761 prefix
  and its check digit), each transcribed from the issuing authority's own
  publication and tested against its worked examples. With a Swiss rule active,
  the server refuses to boot with an audit retention_days under the one year
  DSV Art. 4 Abs. 5 requires. The AHVV joins the vendored corpus at
  docs/law/ch/ahvv/.
• The regulation corpus gains the German and Swiss layers (#3293,
  #3294). docs/law/de/ carries the BDSG, SGB V (the ePA and telematics
  provisions, §§ 341–355 and 360–363), the GDNG and the StGB (§ 203) as the
  XML gesetze-im-internet.de publishes, pinned by the publisher's build stamp,
  plus the Digital-Gesetz as its Bundesgesetzblatt issue; docs/law/ch/
  carries the DSG/FADP and DSV/DPO in German and the non-binding English, and
  the EPDG, EPDV and EPDV-EDI in German, each at its current Fedlex
  consolidation. Two vendor scripts, provenance and digests per act, the
  publishers' no-copyright articles quoted in LICENSES/, and the compliance
  overview gains a Germany and a Switzerland section stating, provision by
  provision, what the software ships and what the deploying organisation must
  do.
• The Helm chart runs FerroTERM beside the CDR (#3305, chart 8.3.0).
  terminology.enabled renders the terminology server as its own workload —
  Deployment, ClusterIP Service, ServiceAccount, NetworkPolicy — under the same
  Restricted profile as the CDR, and points the CDR's
  config.terminology.external at its Service, so archetype bindings resolve at
  commit and AQL TERMINOLOGY() expands through it (the CDR's own
  /terminology/* extension routes stay a separate switch,
  config.terminology.api_enabled, and are off by default). Every values file
  that contradicts that injection is refused at render rather than silently
  overwritten: a default provider of your own, an external.enabled: false,
  a fail_on_error disagreeing with terminology.failOnError, and a provider
  with no external.routes entry naming it. The licence-free shaped seed ships with the chart and
  is mounted as a ConfigMap, so an install from the registry serves terminology
  with no checkout; a release you hold a licence for is an index built
  off-cluster and mounted from an existing claim named in
  terminology.index.persistentVolumeClaim — which also switches the workload
  to strategy: Recreate, because a rolling update's surge pod cannot attach a
  ReadWriteOnce volume the outgoing pod still holds. No Ingress is rendered for
  it and no value renders one: the CDR is its only caller, and its NetworkPolicy
  admits the CDR's pods alone. No boolean opens that port;
  terminology.networkPolicy.extraIngressFrom admits a peer you write, and the
  values schema refuses an empty one (a bare namespaceSelector: {} selects
  every namespace). Above one replica, the pods spread one per node and
  terminology.podDisruptionBudget guards them through a drain.

Fixed

• Under multi-tenancy an unset ferroehr.tenant_id no longer resolves to the
  reserved default tenant: the server stamps the tenancy posture at boot, every
  connection it opens declares its tenant explicitly, and the tenant reader
  refuses a connection that declares none. Single-tenant deployments are
  unchanged (#3341).
• Under multi-tenancy the AMQP outbox drainer and the FHIR outbound emitter
  drain every registered tenant's rows in turn, with a delivery cursor per
  tenant, instead of the default tenant's alone (#3355).
• The event-outbox retention prune stops at the lowest cursor of every active
  reader instead of deleting on age alone: the FHIR outbound emitter (and any
  future cursor reader) now owns a row in the new event_outbox_reader
  registry, reconciled from the configuration at boot, and a published row it
  has not reached survives the retention window. The singleton
  fhir_outbound_cursor table moves into the registry with its watermark
  (#3330).