[Cabecinha84]

Release PR, development → master. 11 merged PRs since v8.21.1 (#1853), all merged into development directly: #1868, #1867, #1860, #1858, #1881, #1866, #1874, #1876, #1882, #1885, #1887. #1874 → #1876 → #1882 and #1860 → #1858 were stacks, each merged in order. 250 files, +29.7k/−4.3k, of which ZelBack is 76 files, +7.4k/−2.8k. The rest is tests and the harness.

Cut following RELEASING.md.

release step	state
master holds no ZelBack changes development is missing	yes. master was merged back into development (8a3b5aed8), and that merge changes no files
package.json 8.21.1 → 8.22.0 (9dfef7f4f)	done
helpers/hashes.json carries b9bfb6578c581b007f92137826c01cb1 (c10a308a9)	done. It is the md5 over ./ZelBack at this tip, checked from a clean git archive
the fingerprint is in the signed document central serves	verified at hashes.runonflux.io/hashlist, seq 340
full harness gate at this tip	done: 234 suites, 234 pass, 0 fail, at 04ddc7e2ed (#1887's head), whose tree differs from this tip only in helpers/hashes.json

Minor bump: new checks and features, nothing that changes consensus or the message protocol. Several operational changes need attention, listed first.

⚠️ Read before merging

Nodes that will go out of service or change behaviour

• MongoDB floor 6.0.27 (fix(db): every database call ends, and a failed call decides nothing #1866). A node below it is held out of service with a sticky DOS that names the version found and the version required.
• Apps run only on cgroup v2 with cgroup.kill, under Docker's systemd cgroup driver (fix(apps): a node whose host stalls a dependency takes no new apps, and one held for 30 minutes goes out of service #1874). A node missing any of the three holds itself out of service at boot and names what is missing. Every Ubuntu 22.04+, Debian 12 and ArcaneOS node meets it by default. Survey of 2026-10-22: all 288 legacy nodes reached meet all three (56 did not answer on fluxadm, 2 are on 8.18.0).
• A node whose host stalls a dependency (fix(apps): a node whose host stalls a dependency takes no new apps, and one held for 30 minutes goes out of service #1874). A thread of mongod, dockerd, containerd, syncthing, fluxd or fluxbenchd held in the kernel for one 5 min reading holds the node back from new apps. After 30 min the node goes out of service until the machine reboots, and every app on it is stopped at once, killed through its cgroup slice when docker cannot stop it. State lives in /run/fluxos/host-stall.json. On ArcaneOS that is the fluxos unit's runtime directory (RuntimeDirectoryPreserve=yes, flux_iso).
• A database that keeps timing out (fix(db): every database call ends, and a failed call decides nothing #1866, fix(apps): a node whose host stalls a dependency takes no new apps, and one held for 30 minutes goes out of service #1874). Every MongoDB call is bounded (60 s, 15 min for maintenance). Four timed-out round trips in 30 min mark the database suspect, and the node takes no new apps until 30 min after the last one. Running apps are untouched.
• Boot waits for the database (fix(db): every database call ends, and a failed call decides nothing #1866). A node whose database does not answer holds its boot at the database step and retries every 15 s, serving nothing until then. If that lasts past an app's location lifetime, the network places the app elsewhere, and once the database answers this node removes its copy, data included.
• UDP is proven on app ports (feat(ports): prove app ports over UDP as well as TCP #1881). The pre-install port test proves UDP as well as TCP. A node whose UDP is blocked (for example a router that forwards TCP alone) is refused such apps once two updated peers both heard nothing, and reports udp: degraded in /flux/health. It stays in service unless the policy document udpportdos is true. udpinstallrefusaloff: true in the policy turns the install refusal off without a release.
• The TCP availability check needs this node's own answer (feat(ports): prove app ports over UDP as well as TCP #1881). A port answered by another machine at the same public IP now fails the check. Before, anything that answered passed.
• A UPnP router that refuses mappings or their removal takes its node out of service (fix(upnp): a full router table is scored as the router's, and a node still verifies on one #1858, feat(ports): prove app ports over UDP as well as TCP #1881). That is about 25 min after the first refusal, UDP mappings included, and the node is back about a minute after the router recovers. Behind a full router table a node now verifies and runs on the mappings it already holds instead of crash-looping (the incident behind fix(upnp): a full router table is scored as the router's, and a node still verifies on one #1858).
• A node with no public address is out of service after 12 min (fix(apps): announcements are judged per entry, and a node keeps its own record of when it took an app #1882): 48 asks to benchmark, 15 s apart.
• Games-hub game servers are never cpu-throttled (feat(apps): never throttle the cpu of a games-hub game server #1868) when their name matches the signed policy document cputhrottleexempt (Exempt games-hub game servers from the CPU throttle fluxos-network-policy#33). Without the document nothing changes. An exempt app never gets more than its spec.

API and configuration changes for callers

• /flux/checkappavailability takes protocols (tcp, udp or both, TCP when absent) and everyPort (feat(ports): prove app ports over UDP as well as TCP #1881). Existing callers get the same check as before.
• /flux/health adds a udp check (feat(ports): prove app ports over UDP as well as TCP #1881).
• /apps/promotedfolders lists notLookedAt, heldOut and volumeGone apart from holding (fix(syncthing): a primary that went quiet and then died is taken over, with its data intact #1876). A node on 8.21 does not read the new fields.
• installapplocally installs only a spec that carries a height, and testappinstall is tightened (fix(apps): announcements are judged per entry, and a node keeps its own record of when it took an app #1882, SR-2026-10-21 H3). ownerAppAllowance and temporaryAppAllowance are removed from the configuration, since nothing read them.
• Enterprise specs with an invalid app name or owner are refused (fix(apps): validate app name and owner #1887) by the price, verify, register and update routes, before any decrypt. A non-enterprise spec, a marketplace price request among them, is not checked.
• Apprunning announcements are judged per entry (fix(apps): announcements are judged per entry, and a node keeps its own record of when it took an app #1882). Readable entries are stored and relayed, and the rest are refused and logged. There is no new message, field or version, so a fleet on mixed releases keeps working.

Shipping order with other components

• @runonflux/nat-upnp 2.0.5 (chore(upnp): move to @runonflux/nat-upnp 2.0.5 #1860) is the new floor. It is already published.
• Policy documents cputhrottleexempt, udpportdos and udpinstallrefusaloff can be published before or after this release, because a release ignores names it does not read. udpportdos should stay off until operators have had notice.

Changes

Single-writer (g:) apps

• fix(election): the primary of a g: app runs every g: component #1867: the primary of a g: app runs every g: component. The election decides the whole app, not its first component. Seeds are decided per app, and a cold start seeds every g: folder from one node. An in-place update restarts through the reconciler, so a standby's g: component stays down.
• fix(syncthing): a primary that went quiet and then died is taken over, with its data intact #1876: a primary that went quiet and then died is taken over with its data intact. A device stays in an app's folders only while a location lists it. A change to another device's data that no other device holds is never reverted, and reverts act only on the changes they checked. A standby's own changes are kept while no holder runs the app. A cold-start seed waits only on a holder that has not looked, and leaves out a holder that cannot seed (folderStates). The device sweep keeps devices seen in the last 24 h, so a dead primary can still be shown gone.

Database and host health

• fix(db): every database call ends, and a failed call decides nothing #1866: every database call ends, and a failed call decides nothing. A failed read is never read as "no apps", "no locations" or "absent". No database error uninstalls an app, removes a device or unshares a folder. A removal that stops part way is held as departing and finished later. Index conflicts are repaired at boot. Sync credits a peer only for answers it recorded. The master/slave election runs as one pass at a time (startMasterSlaveApps).
• fix(apps): a node whose host stalls a dependency takes no new apps, and one held for 30 minutes goes out of service #1874: host stalls and database suspicion (see above). Every app's containers live in flux.slice/flux-<name>.slice, and flux.slice weighs the same as system.slice under contention.
• test(hostStall): a held write is released once #1885: a test-only fix for a hostStallService race (ENOTEMPTY).

Network and ports

• feat(ports): prove app ports over UDP as well as TCP #1881: app ports are proven over UDP as well as TCP, with a per-test token on a UDP test server. Behind UPnP the availability check tests TCP and UDP in turn. getRunningAppIpList no longer matches 1.2.3.45 for 1.2.3.4.
• chore(upnp): move to @runonflux/nat-upnp 2.0.5 #1860: @runonflux/nat-upnp 2.0.5. The library's table walk replaces FluxOS's, the router is cached, and lookups are single entries. It handles TP-Link keep-alive and IPv6-first discovery.
• fix(upnp): a full router table is scored as the router's, and a node still verifies on one #1858: a full router table is scored as the router's, and a node still verifies on one. mapUpnpPort returns the router's code and reason. Refused removals are retried. Descriptions are compared as routers store them, which fixes cleanup on FRITZ!Box. Lab and incident nodes: all 8 behind the TP-Link VR2100v verify and run at DOS 0.

Apps

• fix(apps): announcements are judged per entry, and a node keeps its own record of when it took an app #1882: announcements are judged per entry. A node keeps its own record of when it took each app (zelappsplacements), so lapsed location rows no longer reset seniority. A hard redeploy makes the node the newest holder. The local install routes are tightened.
• feat(apps): never throttle the cpu of a games-hub game server #1868: games-hub game servers are exempt from the cpu throttle.
• fix(apps): validate app name and owner #1887: an app's name and owner are validated wherever a spec arrives. The decrypt runs on exactly the specs the route checks treat as enterprise (version >= 8 with an enterprise field).

Tests

The unit suite passed on each PR. #1876/#1882 were the last full runs: 9,983 passing, 0 failing. Every PR adds harness suites that fail on the tree without their fix: 2241–2256, 2507, 3001–3004, 3301–3320, 3501–3506. The author reported a full gate of 233/0 at an earlier #1882 tip (09780d58e6). The full gate at 04ddc7e2ed, this tree apart from helpers/hashes.json, ran 234 suites: 234 pass, 0 fail.

🤖 Generated with Claude Code

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 95.23449% with 126 lines in your changes missing coverage. Please review.
✅ Project coverage is 81.74%. Comparing base (bb5adc7) to head (9dfef7f).
⚠️ Report is 130 commits behind head on master.

Files with missing lines	Patch %	Lines
ZelBack/src/services/serviceManager.js	17.85%	46 Missing ⚠️
ZelBack/src/services/explorerService.js	69.33%	23 Missing ⚠️
...ack/src/services/appLifecycle/advancedWorkflows.js	96.46%	7 Missing ⚠️
ZelBack/src/services/appMessaging/messageStore.js	91.13%	7 Missing ⚠️
.../src/services/appMonitoring/availabilityChecker.js	95.10%	7 Missing ⚠️
ZelBack/src/services/dbHelper.js	94.18%	5 Missing ⚠️
ZelBack/src/services/idService.js	93.90%	5 Missing ⚠️
...lBack/src/services/appTamperingDetectionService.js	94.52%	4 Missing ⚠️
...elBack/src/services/appLifecycle/appUninstaller.js	93.75%	3 Missing ⚠️
...ck/src/services/appMonitoring/nodeStatusMonitor.js	96.38%	3 Missing ⚠️
... and 10 more
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1886      +/-   ##
==========================================
+ Coverage   78.75%   81.74%   +2.99%     
==========================================
  Files         223      240      +17     
  Lines       36449    38422    +1973     
==========================================
+ Hits        28704    31409    +2705     
+ Misses       7745     7012     -733     
- Partials        0        1       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[MorningLightMountain713]

Ack

[alihm]

Ack