v0.18.2.

Supersedes the unpublished v0.18.0 and v0.18.1 candidates. Acceptance gates held publication; their existing Git tags and the v0.18.0 image were preserved.

Added

• Guarded single-replica node canary for plain Docker services with explicit HTTP readiness, domain routing and no published host ports. Validate the selected agent before candidate startup, verify the stable traffic source before splitting, and keep measured promotion, cancellation, Stop and durable recovery authoritative. Panel and CLI distinguish a promotion request from completion.
• Sealed, owner-opt-in node proxy traffic reservations (proxy.traffic, agent target 0.18.2), with immutable runtime/source receipts, expected loaded HTTP/TLS routing-generation checks, request-sequence coverage and a final drain. Raw access logs stay on the node. Eligible node canary workers use this internal transport; update panel and agent together and enable observations explicitly on the node.
• Node database client terminals and private Web Studio for PostgreSQL, MySQL, MariaDB, Redis, Valkey, KeyDB and Dragonfly. Studio uses sealed operations and an encrypted relay, publishes no node port, follows the operator's live session/API grant, and confirms helper cleanup before database lifecycle changes. Migration 0100 stores private Studio identity receipts; update both panel and agent.
• Database-scoped resource telemetry, including database-only nodes, with explicit pending/unavailable/stale/stopped states. The SDK refuses an older panel that ignores the database filter instead of displaying another resource's metrics.
• Durable routed primary Docker transition recovery on the panel host and nodes: migration 0098 journals immutable replica identities before traffic changes, protects interrupted candidates from boot cleanup, and repeats readiness and loaded-routing acknowledgement before obsolete-generation removal. Settings/API/SDK expose pending reasons and safe retries; Stop/cancellation and newer owners remain authoritative.
• Recorded Docker artifact promotion and rollback can fan out the same immutable image to configured additional nodes without checkout or rebuild. Each target uses its current runtime environment and existing readiness/routing/recovery guards; transfer or identity failure preserves its previous runtime and is reported separately from the primary.
• Durable routed fan-out recovery after a panel restart, with leased transition records, fresh readiness/routing checks and cleanup by immutable container ID. Settings shows pending recovery, its reason and retry time; operators can retry through the panel or API/SDK without stealing a live deployment lease. Additive migration 0097 and a sealed docker.recovery agent capability (target 0.18.2) are required.
• Opt-in 1–90 day CPU/memory history with weighted rollups and longer service charts; authenticated Prometheus text export and OTLP/HTTP JSON gauges with encrypted collector settings. Configure through Monitoring, the API/SDK or CLI. Existing installs retain one day with export disabled.
• Durable encrypted per-destination captured-log queues and cursors, independent retry/backoff, bounded backpressure, destination-binding checks and master-key rotation. Panel and CLI expose backlog, scheduled retry and explicit discard. Source capture remains bounded and delivery is at least once. Additive migration 0096 creates the history/queue tables. See Observability for limits and upgrade details.

Fixed

• Admit bounded agent control traffic for readiness and measured canaries without exhausting the former shared 120/minute request bucket. Keep a separate 120/minute rejection response budget, enforce it for concurrent invalid requests, retain the 1,000/minute operation ceiling and preserve sealed authentication/replay checks.

• Close and await encrypted node volume/database backup writers before removing failed partial files. Integrity failures that arrive during a pending file open no longer leave orphan .part files.

• Wait for primary-node retirement to settle before changing the next readiness case in the release smoke. Preserve the existing HTTP failure, previous-runtime, metric-history and log-delivery assertions.

• Preserve sealed routing-generation confirmation during ordinary node proxy refreshes while a node canary split is active. Refuse disabled confirmation support, plaintext transport and stale receipts.

• Verify immutable node candidate groups through a sealed, bounded readiness batch when supported by the agent. Preserve three consecutive samples for every replica, recheck Docker health/restarts after application probes, keep older agents on their negotiated path, and refuse protocol loss without downgrade.

• Handle images without Docker HEALTHCHECK in batched readiness instead of failing on a missing State.Health field. Add a real Docker smoke for images with and without HEALTHCHECK and wire it into the release workflow.

• Bind primary canary traffic to the durable transition lease and record confirmed rollback routing before candidate retirement. The worker uses a shared local/node source adapter with immutable journal identities, mandatory node HTTP/TLS acknowledgement and no panel-traffic fallback.

• Fence canary continuations and parent cleanup by an opaque run owner, including retries of the same deployment. Late routing, source, readiness and close replies cannot overwrite a newer canary split. Check deployment ownership before creating canary state.

• Scope canary rendering to its primary host and stable runtime, pass explicit observation step context, and make the internal node-mode promotion wait for the current measured step to pass. The node worker rechecks workload and live agent requirements before candidate startup.

• Preserve initial readiness and stable-sample checks while giving periodic canary verification up to ten seconds, capped by the configured service deadline. Reuse a probe that already completed after the step boundary instead of burning the remote observation reserve with a duplicate check.

• Judge measured local canary steps from independent, bounded access-log windows and a final drain. Refuse unavailable/incomplete observations or unreadable analytics settings, verify the selected service and proxy/log source, coordinate rotation, and preserve a newer canary owner's routing after late replies.

• Refuse plaintext fallback for every proxy.traffic.* operation and preserve completed node-observation receipts for bounded retries after their active-window deadline.

• Invalidate a node observation when its routing/source check fails, discard private routing content on window closure, and verify the proxy did not restart during routing confirmation.

• Honor bounded HTTP 429 Retry-After responses on sealed agent calls within the original request deadline, preserving nonce/replay protection and cancellation. Remote readiness inspection, probes and diagnostics share the remaining budget and refuse late success. Packaged Docker healthchecks use the configured panel or agent endpoint for their role.

• Propagate canary leaf health to Traefik's weighted parent and probe single-container releases when HTTP-strict readiness is configured. Preserve accepted health query strings and percent encoding for canary and ordinary replica backends.

• Preserve Swarm's current and rollback placement while preloading a new image. Select an unused one of three fixed per-service slots across all service specs, use the full image identity, retain legacy constraints and refuse unconfirmed/exhausted placement instead of evicting serving tasks during preparation.

• Preserve explicit Stop during deploy readiness and omit stopped services from proxy routes. Pending primary recovery blocks same-service deploy claims, autoscaling and sleep while leaving other services deployable.

• Honor explicit HTTP/TCP readiness, resolved source ports and configured deadlines on fan-out targets; refuse missing readiness capabilities before starting a replacement. Routed fan-out targets require sealed routing acknowledgement before retiring the old runtime. Confirm rollback before removing a candidate, retain both generations on uncertainty, and guard target updates against replacement, deletion and service stop. Routed targets with published host ports are refused before retirement because they cannot overlap safely.

• Keep deployments in deploying with no completion timestamp until routing is acknowledged. Supersede the previous deployment only after success; preserve cancellation during the transition. Include this phase in worker claims, sleep/stop guards, webhook deduplication, diagnostics and failure recovery.

• Confirm local routed deploy/canary/autoscale transitions against the actual HTTP and TLS handler generation and enabled routing definitions before retirement. Routed primary-node deploys require a sealed agent advertising proxy.routingAck (agent target 0.18.2) and validate its generation receipt. Keep potentially routed containers alive when a write response, transition or rollback cannot be confirmed. Canary observation windows now begin after routing acknowledgement. The restricted internal probe is excluded from application routing tables; node canary and autoscaling remain separate work.

• Hold autoscaling on incomplete, invalid or stale CPU/memory samples and restart the load window after an unreadable sample. Guard serving-count changes against deployment/configuration races; restore the count and keep containers running when a proxy write fails. Drain active scaling operations during shutdown. Node and Swarm autoscaling remain unsupported.

• Keep autoscaling status errors visible with retry and highlight holding reasons. Resource telemetry now distinguishes missing measurements from real zero usage, labels historical fallback readings, and leaves empty charts empty.

CI

• Give the serialized coverage job 30 minutes: the 20-minute limit canceled the run after all 8,929 server tests passed, before web coverage and the remaining guards finished. Test commands, coverage thresholds and required checks are unchanged.