4.3.4

Added

• A usage report to FerroPULSE, on by default (#3578). At each process
  start and once a day, an instance sends one small JSON report to
  https://report.ferropulse.eu/v1/report, the collector Cadasto B.V. runs in
  the EU. It carries a random instance id (created once and stored in the
  database, so every replica shares it), the version and commit, the
  specification profile, the licence grant type (non-commercial or
  commercial, never the licence id), the deployment kind (helm, compose,
  binary or unknown), uptime, whether the database answers and carries
  its migrations, the PostgreSQL major version, coarse CPU and memory
  buckets, and in the daily report a bucketed request count with latency
  histograms, percentiles and 5xx counts per route-template group and for AQL
  execution. It never carries patient data, request paths, AQL text, licence
  ids or host names. FerroPULSE stores the source IP address of each report
  and the country derived from it. Several replicas send one daily report
  between them, and a restart loop sends at most one start report per ten
  minutes. A slow or unreachable collector affects neither boot nor
  readiness; a failed send is logged once at DEBUG and not retried. Every boot
  logs one INFO line saying whether the report is on. Switch it off with
  [usage_report] enabled = false, FERROEHR__USAGE_REPORT__ENABLED=false,
  or the chart value usageReport.enabled=false. The new [usage_report]
  section also takes endpoint and slow_aql_ms (default 1000), and
  ferroehr usage-report --print [--event start|daily] prints the exact JSON
  the instance would send without sending it. The Helm chart (10.2.1) and the
  compose files set the deployment kind; the conformance compose files switch
  the report off. A new clinical migration adds the usage_report_instance
  and usage_report_window tables.

Changed

• Commercial licensing goes to Cadasto B.V. (#3572). Cadasto B.V., the
  Licensor, handles the commercial licence and every other business or
  licensing question, at info@cadasto.com or
  https://www.cadasto.com/contact/. The BUSL LICENSE copies name that
  contact for alternative licensing arrangements in place of the maintainer,
  and the README, the book, the landing page, the BUSL crate READMEs,
  MAINTAINERS.md, GOVERNANCE.md and SUPPORT.md say the same. The
  maintainer keeps the technical side. The licence terms do not change. The
  openehr-* crates step to 0.0.86 in lockstep, because three packaged
  LICENSE files change.
• The Licensor and copyright holder is Cadasto B.V. (#3567). Every
  holder statement moves from Vernum Projecten B.V. to Cadasto B.V.: LICENSE
  and the crate licence files, REUSE.toml, every SPDX-FileCopyrightText
  header, the licensing chapter of the book, the landing page footer and the
  conformance statement, whose signatory is now "Ruben Talstra, for Cadasto
  B.V." with the date of the change. The licence terms do not change.
• ClientError::DpopProof says whether a send went out (#3565). Its new
  sent field is false when the first proof failed and nothing was sent,
  and true when the proof for a retry or for the re-send answering a DPoP
  use_dpop_nonce challenge failed, after the service had received the first
  request.
• A CONTRIBUTION version no longer borrows the change set's committer
  (#3550). A versions[i].commit_audit, or an attestation, that names no
  committer used to be committed under the CONTRIBUTION audit.committer.
  ITS-REST UpdateAudit.yaml requires committer on every commit audit, so
  such a version is now refused with 400. A CONTRIBUTION without an audit,
  or whose audit has no committer or no change_type, is a 400 too (it
  was a 422), and so is a committer that is not a PARTY_PROXY object at
  all; a PARTY_PROXY that breaks its own invariants stays a 422. A version
  that names its own committer keeps it. The server still fills one
  time_committed for every audit in the set, and copies the CONTRIBUTION
  audit's system_id into a version that omits one. This applies to the EHR
  and the demographic CONTRIBUTION alike. Migration: send committer on every
  audit and attestation, and change_type on the CONTRIBUTION audit.
• An attestation member of a CONTRIBUTION must state its lifecycle_state
  (#3590). A 666|attestation| member without one was accepted, although SM
  master03 §Version Update Semantics says the lifecycle state "must be supplied
  in all cases". It is now refused with 400 like every other member, and a
  stated code outside the openEHR version_lifecycle_state group is a 422.
  Migration: send lifecycle_state on every 666|attestation| member.

Fixed

• The terminology overlay switches on the /terminology/* API it describes
  (#3476). docker-compose.terminology.yml said the CDR's /terminology/*
  routes answer from FerroTERM, but it left [terminology] api_enabled at its
  false default, so every route answered 404. The overlay now sets
  FERROEHR__TERMINOLOGY__API_ENABLED=true; a term, subsumption or value-set
  call for a terminology the bundled openEHR terminology does not carry is
  answered by FerroTERM.
• deploy/helm/validate.sh --update regenerates the chart README (#3476).
  It used to restore the stale README and then fail on it, so the drift it
  reported could only be fixed by running helm-docs by hand.