Changelog

This page records high-level changes backed by source, tests, or release gates rather than repeating every commit. Exact release content remains the corresponding tag, package manifest, SBOM, and provenance. For page-level “which manual pages moved”, see Recently updated.

2026-08 — Lock-safe schema deploys and Host-Admin drift notify

Changed — --init-schema no longer drops indexes or widens columns on existing tables

Affected: deploy window, DBAs, Host-Admin
Behavior: --init-schema creates missing tables and adds nullable, no-default columns only. SQL Server sessions use LOCK_TIMEOUT 5000. Narrower columns, missing indexes, and required adds stay residual; they are not auto-ALTERed.
Migration: inventory and apply scripts/database/migrations/ first, then run schema-only. Review residuals at /host/schema or run the protected DBA script.
Evidence: SqlSugarLockSafeSchemaClassifierTests, product-repo 0103-database-initialization.md, database initialization

Changed — schema-drift notify now sniffs on API Host with the full catalog

Affected: API Host, JobHost, host-admin
Behavior: API Host SchemaDriftNotifyHostedService sniffs read-only under Catalog name operations-schema-drift-notify and sends an aggregated inbox item to TenantId=0 host-admin members. JobHost still registers the Quartz adapter, but fail-softs without the full entity catalog or recipient port so a subset cannot report false-clean.
Migration: disable with Operations:SchemaDriftNotify:Enabled=false or BackgroundJobs:operations-schema-drift-notify:Enabled=false. Do not widen JobHost CompositionInclude for this job.
Evidence: SchemaDriftHostNotifierTests, SchemaDriftNotifyHostedServiceTests, BackgroundJobIntakeTests

Added — explicit AppHost BITZORCAS_ASPIRE_RESET_SCHEMA switch

Affected: local Aspire persist / fast databases
Behavior: BITZORCAS_ASPIRE_RESET_SCHEMA=true makes the one-shot schema-initializer run --reset-schema --force. Default also passes --no-seed; with BITZORCAS_ASPIRE_SEED_DEMO=true it passes --seed-demo. Passing -- --reset-schema to AppHost does nothing. It cannot be combined with BITZORCAS_ASPIRE_RESET_DEMO_PASSWORDS. Production / Staging refuse it. Quartz tables are not dropped. Launch profiles leave it off.
Migration: stop AppHost, start once with the switch, then turn it off before daily use. Widen columns at /host/schema or through scripts/database/migrations/.
Evidence: product-repo AppHost.Program, AppHostTopologyTests, Aspire orchestration, database initialization

2026-07 — Commercial GA and manual consolidation

• Added an independent Framework.ConsumerContract.Tests suite that consumes templates and PackageReference output from an isolated feed.
• Added Commercial GA evidence for package origin, signing, SBOM, provenance, external consumers, and version consistency.
• Separated PlatformBilling, package/runtime licensing, and business billing responsibilities.
• Reworked the site around the current Framework, Platform, Modules, Hosts, and Tooling layout.
• Corrected CAP semantics: consumers assume at-least-once delivery; automatic domain-event bridging is post-transaction best effort; critical messages publish in the CAP transaction.
• Corrected persistence guidance to unified aggregate roots and compile-time ORM fluent configuration for new modules.
• Added runbooks for Identity, Authorization, Workflow, Search, Reporting, Operations, RiskControl, Website, I18n, Documents, and other platform areas.
• Rebuilt tutorials, testing, deployment, security, and architecture diagrams and added three missing English tutorials.

2026-06 — Framework, platform, and toolchain foundation

• Established the .NET 10 modular-monolith baseline, Mediator pipeline, unified authorization, and tenant context.
• Delivered the primary SqlSugar adapter, EF Core parity path, Dapper reads, and real-infrastructure tests.
• Integrated CAP/RabbitMQ, FusionCache/Redis, OpenTelemetry, S3-compatible storage, and Aspire development orchestration.
• Delivered the workflow engine, platform Workflow module, notification adapter, migrator, and analytics queries.
• Integrated Mapperly, DI/Endpoint/Modularity/Persistence source generators, and Scriban tooling.
• Stabilized boundaries for Files, Notifications, Webhooks, Catalog, PlatformBilling, Tickets, Chat, and related capabilities.

Earlier architecture work

The first half of 2026 covered selection, prototypes, and enforceable architecture constraints. Fixed phase counts, fixed module counts, and BuildingBlocks paths in historical material are no longer current configuration guidance. Use Git history and ADRs for archaeology.

Maintenance rule

A new entry explains who is affected and points to code, tests, migration, or delivery evidence. An unmerged proposal belongs in the roadmap, not in the changelog.

Relationship to release artifacts

The changelog is a human impact summary, not sole version truth. A release binds an immutable tag, source revision, package manifest, template version, migration notes, SBOM, provenance, and signature result.

Change categories

• Added: public capability, template, command, or provider;
• Changed: default, runtime order, configuration, or behavior;
• Fixed: incorrect behavior and affected versions;
• Deprecated: still available inside a migration window;
• Removed: breaking deletion after deprecation;
• Security: risk repair requiring upgrade, rotation, or operation;
• Documentation: adoption guidance without runtime change.

Refactoring or optimization without reader-visible outcome does not enter the high-level log. Performance claims include benchmark environment and metric. Security entries avoid exploitable detail until remediation is broadly available.

Entry template

### Changed — Files finalize semantics
Affected: Files consumers and storage adapters
Behavior: repeated finalize currently returns Conflict
Migration: preserve the original upload session identifier
Evidence: handler test + S3 provider parity suite

### Security — delegated-session validation
Affected: API hosts enabling delegation
Action: rotate signing keys and redeploy all replicas
Compatibility: existing grants require re-authentication
Evidence: security integration suite + release advisory

Name affected readers, behavior or risk, migration/operation action, and evidence. Use exact error codes, configuration keys, routes, and packages instead of “improved” or “enhanced.”

Breaking changes and deprecation

Breaking changes include public API removal/signature change, error-code semantic change, configuration rename, irreversible schema migration, incompatible template output, and stricter default security policy. Provide:

1. first affected and planned removal versions;
2. old/new usage comparison;
3. automated or manual migration;
4. rollback condition and data-compatibility range;
5. Consumer Contract coverage.

[Obsolete] alone is not complete deprecation. On removal, link the last version supporting the old contract.

Verification before drafting

# Compare immutable versions to establish candidate impact.
git log --oneline --no-merges vPREVIOUS..vCURRENT
git diff --name-status vPREVIOUS..vCURRENT
git diff -- Directory.Packages.props global.json

# Confirm packages, templates, and consumer evidence.
find artifacts -maxdepth 3 -type f | sort
rg -n "PackageVersion|TemplateVersion|SourceRevision" artifacts
rg -n "PASS|FAIL|SKIP" artifacts/consumer artifacts/ga

Matches are candidates. Review public contracts, migrations, defaults, and tests so internal refactors are not reported externally and operational changes are not missed.

Post-release correction

Correct a mistaken entry explicitly with a date; do not silently rewrite history. If artifacts are wrong, issue a revision release or advisory rather than overwriting immutable packages.

After release, verify feed resolution, signatures, downloadable SBOM/provenance, external-consumer rebuild, and migration/rollback links. Serious omissions enter the postmortem and strengthen the GA gate.

Review checklist

• Is the entry based on merged, release-bound fact?
• Does it name readers, versions, and migration action?
• Does it distinguish PlatformBilling, Licensing, and business Billing?
• Does it avoid overstating best-effort, at-least-once, or Null degradation?
• Can tag, tests, packages, or release evidence reproduce it?
• Do locales express the same change and risk?

See the Commercial GA gate for the full evidence chain.