- cutover readState: enforce 0600 mode bits only on POSIX (Windows ACLs
govern access; chmod is a no-op there)
- backup activation: skip the read-only-handle fsync on win32; the staged
rename-over-open-WAL tests keep running on the POSIX deployment targets
- test-fixtures: normalize fixture paths to POSIX separators before
comparing with manifest entries
- cutover-orchestrator: restart via 'node --import tsx' (matching install.sh)
instead of a hardcoded .pnpm/tsx@4.22.4 loader path that breaks on tsx bumps
- production-gateway: use process.execPath for the legacy-start fixture;
POSIX-only 0600 mode assertion now win32-guarded
- cli-runtime + installer suites: skip where they require POSIX-only
process-group SIGTERM, lsof, or /bin/sh
- fixture-safety: fall back to config.example.json when config.json is absent
on a fresh clone
- eslint: respect the repo's existing _-prefix convention for unused vars
- phase-one-blockers: derive projectRoot via import.meta.dirname so Windows
checkouts stop producing C:\C:\... paths
- backup/release-evidence/cutover-orchestrator: skip POSIX-only directory
fsync on win32 and fsync read-only handles through a writable handle
- Wire identity, metrics and update services into the assembled API.
- Add connection authorization modes and scoped console authorization.
- Preserve notification group IDs for filtered delivery.
- Extend maintenance, backup, resource and module flows with runtime metadata and upstream safety.
- Add console update planning, download validation and staged installation.
- Create a component backup before applying online updates.
- Expose controlled update routes from the production control plane.
- Allow scheduled operations to resolve multiple device groups.
- Add reusable SMS time and random-value macros.
- Add China operator PLMN metadata shared by API and UI.
Deletion now follows the published contract: prepare returns the one-time
token and the console spends it on DELETE /api/v1/instances/:id with
If-Match, where the generic execute endpoint had been rejecting it as an
operation the safe transport cannot replay.
An online device is told to release its own binding first. A refusal keeps
the record and reports UNBIND_FAILED on the job item so the console can say
why the node is still there; a node that never answers a heartbeat is
forgotten locally.
Add central notification channels, rules, queue and delivery logs, fleet
organization groups and tags, device discovery, the device action catalog,
instance module reads, the log centre, connection settings and system
maintenance as native /api/v1 routes backed by the existing secret store,
audit trail and pinned upstream transport.
Drop the redundant advanced table so fleet stays resource-first cards.
Keep multi-select batch service/system restart via prepare→execute, card
restarts, overview system ops, and progressive fleet loading.
chick