Service First V1.73

Explicit health probes no longer depend on browser session Redis or browser credentials. Normal API security, readiness dependency checks and separate scheduler-control authorization remain enforced.

Completed Quartz shutdown removes only the stopped instance's own heartbeat, without deleting another node or fired work. Fresh physical tests must prove exact persistent schedules, correct native time storage, restart and instance-scoped cleanup.

No MultiOrg deployment, including the temporary bridge, may precede completion and fresh validation of V1.73 with Quartz 4. The corrected bridge and the migration runner now bind the same exact version and immutable migration contract.

The production policy comparison now treats an identical 56-gate plan as an explicit empty difference, remains case-sensitive and rejects reordered, missing, extra, duplicate, or case-drifted gates under StrictMode 3.

A silent physical UI controller child now remains a valid empty output collection under StrictMode, preserving its real exit code without weakening process termination, logging, or secret-environment boundaries.

The public language selector exposes the exact active locale through aria-pressed while image-scoped grayscale leaves each semantic language button paint-observable for the fail-closed physical UI audit.

The tenant application advances dhtmlx-gantt from 10.0.2 to stable 10.0.3 with an exact rebuilt lock; fresh vulnerability, license, SBOM, lint, test, build, and physical-browser evidence is required before authorization.

Quartz.NET advances from 3.20.1 to 4.0.0; the main Quartz package absorbs System.Text.Json serialization, and jobs and scheduler integration use the Quartz 4 ValueTask, explicit cancellation-token, QuartzSchedulerBuilder, scheduler-status, typed misfire instruction, and add-job options APIs.

The checksum-pinned additive center migration 20260903_01_quartz_4_upgrade.sql adds nullable RETRY_POLICY and RETRY_ATTEMPT fields to QRTZ_TRIGGERS and creates QRTZ_PAUSED_JOB_GRPS. The complete manifest is 50 migrations: 29 center and 21 tenant. Schema must precede every Quartz 4 application node, and V1.73 performs no optional Quartz index drops or index realignment.

The required V1.72.23 transition bridge at signed commit 4a5a8d8a5aa3cf4c454013d1e1d3a239cb6f529c keeps Quartz 3.20.1 and accepts exactly the complete 49-row or complete 50-row schema contract. It must be fully gated and healthy before migration; after migration it proves the upgraded schema before any V1.73 role starts. Original V1.72 is not a post-migration rollback release.

The V1.73 candidate contains an exact signed 54-file migration mini-root. Its separate staging phase is database-blind and cannot execute SQL, read a database secret, mutate a service, or switch the active application release; the final application activation remains one continuous Phase All transaction.

The authoritative MariaDB 12.3.2 and 12.3.3 matrix must start the actual Production Quartz hosted service from the frozen candidate, prove exact persistent jobs, triggers, table shape, running readiness, pre-fire standby, stable trigger start times across restart, and clean shutdown.

V1.72's 54-of-56 standalone result is retained only as NO-GO diagnosis; V1.73 re-runs the immutable candidate and complete authorization chain from the beginning.

Both Vue applications use the complete stable Tiptap 3.31.3 family with exact rebuilt locks and regenerated CycloneDX and license evidence.

The hostile release-package verifier regression has a measured finite 300-second outer Node runner budget after an isolated 161.44-second pass and a 184.08-second full-suite timeout; verifier-owned digest, archive, path, link, process, and authorization bounds are unchanged.

The physical UI fixture pairwise-separates runtime, provisioner, and file-backed migrator identities; consumes the migrator path only in direct controller children; proves the live API has no migrator setting; binds cleanup to the original source endpoint and database; and requires all 50 migration-ledger rows to identify the authenticated restricted migrator.

The Node.js 22.22.1 standalone runtime proof now has a monotonic 60-second readiness deadline, remaining-time-bounded requests and retries, continuously drained 32 KiB-capped output counters, sanitized failure codes, liveness through controlled termination-signal delivery, independent container-state verification, and exact run-owned cleanup.

Release authorization must match the controller-generated canonical 56-gate execution plan exactly and cross-binds the policy schema version, policy SHA-256, and execution-plan SHA-256 across signed authorization, package verification, and deployment.

The external Buildx identity parser accepts only a plain semantic version or the exact Docker Desktop -desktop.<number> suffix followed by a full lowercase 40-character source revision; arbitrary suffixes remain fail-closed.

Both Vue applications now use Maska 3.2.1 and Vue Router 5.3.1 with exact lockfile integrity, regenerated license and software-inventory evidence, and mandatory routing, masking, production-build, and physical-browser verification.

MariaDB 12.3.2 remains the primary and minimum MultiOrg runtime; exact digest-pinned MariaDB 12.3.2 and 12.3.3 compatibility is exercised separately in isolated Docker gates, with no server database upgrade.

The existing host ClamAV 1.5.3 runtime is consumed unchanged without Service First installing, upgrading, downgrading, or managing shared services or configuration; container ClamAV remains a separate pinned 1.4.6-r0 runtime.

The verified host Node.js 22.22.1 runtime serves the marketing application; Node.js 26.8.1 remains isolated to build and release-controller work.

The overall V1.73 release requires a controlled backup and schema-before-application migration transaction; only the later signed deploy-controller transaction is application-only, followed by immutable version-marker and postflight evidence. This entry does not claim those tests, migration, or deployment have completed.

The release controller remains locked to exact Docker, Buildx, and Compose versions.

API software-inventory identity now uses canonical parsed lock, vendor, and license semantics, preventing formatting-only drift while retaining fail-closed change detection.

OCI runtime validation safely handles an absent optional platform variant and still accepts only exact Linux/amd64 no-variant images.

The complete Alpine runtime and archive locks include libcurl 8.22.0-r0 and pcre2 10.48-r0 with exact package and SHA-256 archive inventories.

Fresh dependency, documentation, and reproducible software-inventory evidence remains required for authorization.