2.5.4-dev.6 (nightly)

Source: Vateron-Media/XC_VM@fc6cb38

Nightly build from main. Untested — for test servers only.

Changes since b489c13a2477

• docs(cluster): say plainly which nodes cluster:rotate-db-password leaves by hand (e96d263a)
• docs(cluster): MAIN's data-plane client in ADR 0004 and the Limits (d1282176)
• feat(cluster): a data-plane client of MAIN's own (cluster:main-dataplane) (258be636)
• docs(cluster): the agent drops the fanout's viewers under a lease fence (7f9bde8d)
• feat(cluster): keep a node's report that its relay proxy cannot bind its port (b68adaea)
• feat(cluster): keep a credential-free node credential-free through reinstalls and grants (941499cb)
• fix(status): point a load balancer's Redis at MAIN's address, not a URL (5826182a)
• docs(cluster): the DB password rotation has one command and travels sealed (0cece500)
• refactor(cluster): one DB password rotation, sealed to each node's box key (c5c24d98)
• docs(cluster): core pins, the credential strip and the DB password rotation (70ccd83e)
• feat(cluster): rotate the panel's DB password through xcvm_core (8a370655)
• feat(cluster): operator actions to pin a node's core and drop its DB credentials (8db91384)
• feat(cluster): pin MAIN's panel key in every node's xcvm_core (core.pin) (1b2f522b)
• docs(adr): record Phase 9's compiled lease verdict and credential actions (1877c6dd)
• feat(cluster): NodeLease consults xcvm_core's compiled lease verdict (09e95259)
• feat(cluster): node.root strip_db_credentials / install_config and MAIN's revoke (03b74feb)
• docs(adr): 0004 records Phase 9's commands, rotations and lockdown (fc10c768)
• test(cluster): the stream-secret rotation may re-encrypt stored data (919bf0cb)
• feat(cluster): install a new LB in API mode without a DB grant (fd524af6)
• feat(cluster): node.root rotate_sign_key re-pins MAIN's key without SSH (9a758b9f)
• feat(cluster): cluster:lockdown and --undo, manual only (ed8836ce)
• feat(cluster): rotate the Redis and DB passwords for the nodes that use them (655fc0a6)
• feat(cluster): cluster:rotate-stream-secret, resumable, re-encrypting stored data (36bd3951)
• feat(cluster): send the restrictive commands nothing produced (f4a2bedc)
• fix(i18n): add dashboard_nav_top, sub_reseller and system_template to en.ini (af42d743)
• docs(adr): 0004 records the agent's lease_state.json and MAIN clock (04b918d1)
• test(cluster): judge the agent's own lease_state.json in NodeLeaseTest (7abc62d6)
• feat(admin): Cluster Nodes fence windows, banners, figures and rotate-all (46795172)
• feat(cluster): ClusterLicenceLapsedEvent when a lease is refused for the licence (63e4ba9a)
• feat(cluster): server:diagnose reports a node's cluster state (3e322241)
• chore(i18n): drop keys en.ini no longer has from the other language files (0839df76)
• docs(cluster): the lease fence is built behind lb_lease_fence; two update rules (c970c5f1)
• fix(cluster): serve /xfile with nosniff and annotate the Semgrep false positive (64bdc723)
• fix(cluster): harden the data plane after security review (90641d9c)
• feat(cluster): the data plane without bearer credentials (Phase 8 relay half) (be87b8c2)
• docs(adr): record the fanout switch, supersede P4 and the CLOCK_SKEW resync (b392fa6e)
• feat(admin): quick search renders the full JSON contract (8445e225)
• fix(streaming): fanout_enabled=0 fully restores the pre-fanout path (573d7120)
• fix(nginx): MAIN's own /api keeps no toggle (ADR 0004, Phase 8) (5d607c16)
• fix(cluster): mode 2 needs root's pin in place, as ADR 0004 requires (065239c5)
• fix(modules): validate a stream form tab only when its fields were posted (836ed706)
• fix(auth): refuse post.php save actions that no rule covers (bd860333)
• docs(modules): drop stream middleware; list the events core actually dispatches (edfda263)
• refactor(modules): remove the stream middleware pipeline that never ran (418c7067)
• fix(install): name the LB installer's temp files with random_bytes, not md5(time()) (41f6d11e)
• refactor(modules): split the tab validator call out of StreamFormRegistry::validate (77cf2c03)
• refactor(cluster): agent paths, signed-token encoding and php-fpm pools written once (0a75e890)
• refactor(cluster): enum settings, policy version, enrolment start and CLI helpers written once (e6b62341)
• refactor(cluster): one reader for a stored stream record and for ids in file names (a530d6e2)
• refactor(cluster): one connection uuid pattern, identity rule, route and reservation helper (9cb5f053)
• docs(modules): import kinds (02b49fe8)
• feat(modules): module import kinds on Import & Review (c4843954)
• fix(streams): Stream Review saves EPG alone again (e943d624)
• fix(streams): Import & Review writes only stream columns (6b6e8a23)
• docs(modules): stream form tabs and StreamSavedEvent (b4da1f83)
• feat(modules): stream form tabs and StreamSavedEvent (7a054b8f)
• fix(i18n): lang-translate saves every key as it goes and skips engines that lack the language (ba719fbe)
• docs(streams): source drivers are validated on save; add the domain glossary (e96e3f6d)
• feat(streams): driver sources answer source checks and supervisor probes (6619b957)
• feat(streams): refuse stream saves that hand a driver URL to anything but its engine (dd38b375)
• fix(streams): never refuse a scheme a bundled ffmpeg reads (a072ddbb)
• refactor(cluster): share constants, test seams, audit days, base32 and install base (969595f2)
• refactor(cluster): write files atomically through one Core helper (215d41dc)
• refactor(cluster): one connection identity rule and one stored-connection reader (3767819e)
• refactor(stream): one helper picks and redacts a stream's state fields (b0115c49)
• refactor(cluster): one copy of the queue SQL and the strict read (37182613)
• refactor(cluster): write the endpoint's request checks once (ccede63f)
• refactor(cluster): read every clamped cluster setting through ClusterSettings::int() (835448b8)
• fix(cluster): end the CLI's id and fingerprint checks in \z too (6bf7186d)
• docs(adr): command registry, endpoint fixes and corrected status lines (a029916b)
• test(cluster): fix the arch fixture and SERVER_ID order dependence; cite real tests (d6f0bd73)
• fix(admin): a stored cluster_offline_after_sec of 0 means 30 s on the Cluster Nodes page too (6873a20d)
• fix(auth): point access code type 5 at the Ministra portal in core (2b3d602d)
• fix(lb): honour api_legacy.conf on load balancers (a9a72f28)
• fix(install): write root-owned files over SSH with sudo tee; fix the ramdisk toggle (71b348eb)
• fix(cluster): a failed write keeps the event batch and its cursor unapplied (dcd3df90)
• fix(cluster): harden the API endpoint against races, replays and bad records (2ca86fd2)
• fix(cluster): send commands the extension signs, and never lose one silently (0f260b8c)
• docs(contributors): update contributors list (2cc1a829)