{
  "//": "For the changelog: each release-note bullet's bold lead, mapped to the branches behind it. Kept by hand, one release at a time, as step 10 of the release recipe in the README. go run ./cmd/changelog fails on a lead no bullet has, or a branch that did not land in that release.",
  "v0.28.7": {
    "`carlos logs` now shows each run.": [
      "run-lifecycle-logs-325"
    ],
    "An app can ask for one uploaded object to be scanned.": [
      "scan-demand-revival"
    ],
    "The console's account switcher has a search box.": [
      "console-switcher-filter"
    ],
    "An offline move can copy most of its data before the instance goes offline.": [
      "moves-offline-precopy"
    ],
    "Every box in both regions must run this release before `stage` works.": [
      "moves-offline-precopy"
    ],
    "Moves and replica copies now run eight object copies at once.": [
      "moves-offline-precopy"
    ],
    "On-demand scanning needs `CARLOS_SCAN_WEBHOOK_KEY` only for callbacks.": [
      "scan-demand-revival"
    ]
  },
  "v0.28.6": {
    "A guard-armed box's protected console can now be replaced.": [
      "install-console-upgrade"
    ],
    "A nested instance's `config.env` is written as soon as its directory appears.": [
      "moves-offline-fixes"
    ],
    "Each offline move step now sees a current box report.": [
      "moves-offline-fixes"
    ],
    "A source box's scheduler leaves a moved instance alone.": [
      "moves-offline-fixes"
    ]
  },
  "v0.28.5": {
    "`carlos move offline` moves one instance to another region, with planned downtime.": [
      "moves-offline"
    ],
    "Roll every box in both regions before you start an offline move.": [
      "moves-offline"
    ],
    "A box whose guard is armed on v0.28.4 needs one update by hand.": [
      "armed-box-updates"
    ],
    "The guarded updater reads only what a candidate writes to standard output.": [
      "armed-box-updates"
    ],
    "`carlos system guard-arm` makes its directories readable whatever your umask is.": [
      "claim-guard-umask"
    ],
    "Routes with their own unit now restart on boxes whose agent doesn't run as root.": [
      "adopt-unit-root-pass-315"
    ],
    "`carlos system status` warns when a new box would boot an older build.": [
      "bootstrap-carlos-follows-316"
    ]
  },
  "v0.28.4": {
    "Console invites now arrive.": [
      "design-console-invite-delivery"
    ],
    "An account can have 20 invites waiting at most, and send 20 an hour.": [
      "design-console-invite-delivery"
    ],
    "Console email can switch itself on.": [
      "design-console-invite-delivery"
    ],
    "Sending also needs a grant that is off by default.": [
      "design-console-invite-delivery"
    ],
    "With `CARLOS_HOST_CLAIM` on, the console sends no email.": [
      "design-console-invite-delivery"
    ],
    "`carlos system install-channel --policy` now also takes `--identity`.": [
      "claim-untagged-pointer"
    ]
  },
  "v0.28.3": {
    "`carlos system install-channel --policy` prepares a box that is already running for host claims.": [
      "claim-prev-rehearsal"
    ]
  },
  "v0.28.2": {
    "Three new `carlos system claims` commands prepare a box for host claims.": [
      "claim-step6-artifacts"
    ]
  },
  "v0.28.1": {
    "A box can publish its identity record by hand.": [
      "box-publish-record"
    ],
    "A box that has not reported for a day drops out of status.": [
      "region-ha-2b-build"
    ],
    "Each box gets an idle join unit.": [
      "region-ha-2b-build"
    ]
  },
  "v0.28.0": {
    "`carlos run` runs one of your app's commands against one instance.": [
      "carlos-run"
    ],
    "New instances can start from a copy of another instance's database.": [
      "seeded-instances"
    ],
    "The download is smaller again.": [
      "fix-binary-size-275"
    ],
    "Roll the boxes first, then every console.": [
      "carlos-run"
    ],
    "Give the console room for run uploads.": [
      "carlos-run"
    ],
    "Seeded instances stay off until you publish the seeds floor.": [
      "seeded-instances"
    ],
    "The host claim is still off.": [
      "feat/claim-root-trusted-state-p3",
      "feat/claim-files-backfill"
    ]
  },
  "v0.27.3": {
    "Restarting the edge no longer leaves an instance unreachable for 15 minutes.": [
      "fix-shutdown-lease-292"
    ],
    "New accounts never get a reserved address.": [
      "reserved-sqids-285"
    ],
    "Instance control restarts with this update.": [
      "fix-shutdown-lease-292"
    ],
    "Roll the console as well as the boxes.": [
      "reserved-sqids-285"
    ]
  },
  "v0.27.2": {
    "Two builds at once keeps each build's socket name.": [
      "zdd-gen-socket-names"
    ],
    "A long host name keeps stop-then-start updates.": [
      "zdd-gen-socket-names"
    ]
  },
  "v0.27.1": {
    "A box with many instances no longer fails its update while it starts.": [
      "hotfix-startup-sweep-281"
    ]
  },
  "v0.27.0": {
    "Root keeps its own record of each box's releases.": [
      "feat/claim-root-trusted-state"
    ],
    "`carlos __cgexec` can appear in `ps`.": [
      "zdd-flag-readiness-3"
    ],
    "After the roll, check placement on each box.": [
      "zdd-flag-readiness-3"
    ]
  },
  "v0.26.0": {
    "Two builds at once, off until your deployment turns it on.": [
      "zdd-1-generations",
      "zdd-2-containment",
      "zdd-3-swap",
      "zdd-4-release-side",
      "zdd-5-scheduler",
      "zdd-6-surfaces",
      "zdd-flag-readiness"
    ],
    "`carlos deploy` follows the rollout box by box.": [
      "zdd-6-surfaces",
      "zdd-flag-readiness"
    ],
    "`carlos instances list` shows two builds.": [
      "zdd-4-release-side",
      "zdd-6-surfaces"
    ],
    "Choose how each instance takes new builds.": [
      "settings-3-console-settings",
      "settings-4-root-applies",
      "settings-5-surfaces"
    ],
    "Read a database as it was.": [
      "db-pull-at",
      "hibernate-retention"
    ],
    "Channel digests.": [
      "settings-1-pointer-digests"
    ],
    "`carlos releases authorize <app> <version>`, for operators.": [
      "settings-2-promotion-records"
    ],
    "What an instance is started with.": [
      "fix-roll-incident-256"
    ],
    "`carlos move`, off until your deployment turns moves on.": [
      "moves-phase1",
      "moves-phase1-2",
      "moves-phase1-3",
      "moves-phase1-3b",
      "moves-phase1-3c",
      "moves-phase1-4",
      "moves-phase1-5",
      "moves-phase1-5b",
      "moves-phase1-5c",
      "moves-phase1-5d",
      "moves-phase1-5e",
      "moves-phase1-5f",
      "moves-phase1-6",
      "moves-phase1-7",
      "moves-cut-guard"
    ],
    "Smaller fixes.": [
      "stage-stream-artifact",
      "zdd-6-surfaces",
      "setenv-box-route-error"
    ],
    "After each box updates, restart `carlos-instance-control.service` on it.": [
      "fix-roll-incident-256"
    ],
    "Before any box rolls, run the instance key checks.": [
      "instance-key-provision",
      "instance-key-build"
    ],
    "Root ignores AWS profile, endpoint and trust-store settings.": [
      "fix/267-credentials",
      "fix/267-adopt-writes",
      "docs/267-remote-host"
    ],
    "Host claims: every roster reader first.": [
      "feat/hostclaim-home-region",
      "fix/home-region-followups"
    ],
    "Digests: writers before readers.": [
      "settings-1-pointer-digests"
    ],
    "Instance update settings wait for every box.": [
      "settings-4-root-applies",
      "settings-5-surfaces"
    ],
    "Remove the staging memory drop-ins after the roll.": [
      "stage-stream-artifact"
    ],
    "The `deployment-buckets` module now guards fence writes.": [
      "feat/hostclaim-activation"
    ],
    "Files left behind by earlier moves.": [
      "fix-roll-incident-256"
    ]
  },
  "v0.25.0": {
    "Each instance runs in its own box.": [
      "tenant-iso-default-nested",
      "tenant-iso-layout"
    ],
    "`carlos system layout`": [
      "tenant-iso-plan5"
    ],
    "Instances get CPU and IO limits": [
      "tenant-iso-hardening"
    ],
    "Custom domains can require proof.": [
      "tenant-iso-domains"
    ],
    "Only a platform operator can add an upstream address": [
      "tenant-iso-routes"
    ],
    "Cookies stay within their account.": [
      "tenant-iso-cookies"
    ],
    "Instance catch-all domains.": [
      "instance-catchall"
    ],
    "`carlos email test` sends HTML too.": [
      "multipart-email-support"
    ],
    "Smaller fixes.": [
      "first-route-wildcard",
      "wildcard-zone-check"
    ],
    "Instances move to the nested layout on their own.": [
      "tenant-iso-default-nested"
    ],
    "Before rolling, check one box:": [
      "tenant-iso-layout",
      "tenant-iso-hardening"
    ],
    "Roll the boxes before the console.": [
      "tenant-iso-routes"
    ],
    "Rolling back": [
      "tenant-iso-plan5"
    ],
    "Settings worth turning on": [
      "tenant-iso-domains"
    ]
  },
  "v0.24.2": {
    "CI can deploy through the console.": [
      "design-deploy-credential"
    ],
    "A failed rollback says so.": [
      "fix-deploy-rollback-copy"
    ],
    "`carlos db` no longer panics.": [
      "feat/hostclaim-door"
    ],
    "The boxes come back onto the release train.": [
      "fix-stage-request-deferred"
    ],
    "Leave `CARLOS_HOST_CLAIM` unset on the console.": [
      "feat/hostclaim-door"
    ],
    "Do not set `CARLOS_REGION_HA` on a box yet.": [
      "design-region-ha"
    ],
    "Deploy credentials need the console's signing key.": [
      "design-deploy-credential"
    ],
    "Region HA foundations ship dormant.": [
      "design-region-ha",
      "feat/hostclaim-library",
      "feat/hostclaim-genselect",
      "feat/hostclaim-boxguard",
      "feat/hostclaim-park"
    ],
    "Read the plan before applying the infrastructure modules.": [
      "design-region-ha",
      "feat/hostclaim-door"
    ],
    "The scanner host fix is in this release too.": [
      "fix/scanner-freshclam-apparmor"
    ]
  },
  "v0.24.0": {
    "Canaries have a one-label address, and can be created again.": [
      "fix/canary-one-label"
    ],
    "Deploys reach running instances sooner on busy boxes.": [
      "fix-converge-own-loop",
      "fix-reconcile-listing",
      "fix-reconcile-parallel-reads"
    ],
    "An instance never starts without its secrets.": [
      "fix/keyless-box-refuses"
    ],
    "One address, one app.": [
      "fix/canary-one-label"
    ],
    "Check every box's secrets key before rolling the boxes.": [
      "fix/keyless-box-refuses"
    ],
    "A box with no deployment store refuses exec instances.": [
      "fix/keyless-box-refuses"
    ],
    "Roll the console to this release before pointing it at a scanner host.": [
      "worktree-scanner-host"
    ],
    "Object-storage scanning has its own box.": [
      "worktree-scanner-host"
    ],
    "The app regions rollback floor is v0.23.0.": [
      "docs-regions-floor-v0.23.0"
    ],
    "Boxes can send alerts to SNS.": [
      "feat/alerts-sns"
    ],
    "Boxes list the bucket by app.": [
      "fix-reconcile-listing",
      "fix-reconcile-parallel-reads"
    ]
  },
  "v0.23.0": {
    "A deploy reaches a running instance in seconds.": [
      "fix-adopted-exec-restart"
    ],
    "Static sites show a deploy on the next page load.": [
      "static-cache-control"
    ],
    "Read a copy of an instance's database.": [
      "feat/carlos-db-read"
    ],
    "Region flags.": [
      "design-nearest-region"
    ],
    "Invite links ask before you join.": [
      "tenant-iso-leftovers"
    ],
    "Sending domains you did not set up.": [
      "tenant-iso-mail"
    ],
    "Stores no longer share a bucket by accident.": [
      "tenant-iso-objstore"
    ],
    "Platform domains.": [
      "platform-domain-claims-209"
    ],
    "Leave `CONSOLE_SECRETS_ENVELOPE_V2` off until every box runs v0.23.0.": [
      "tenant-iso-binding"
    ],
    "v0.23.0 is the first release that understands app regions.": [
      "design-nearest-region"
    ],
    "Boxes restart awake instances when they adopt a release.": [
      "fix-adopted-exec-restart"
    ],
    "Static responses change their headers.": [
      "static-cache-control"
    ],
    "Pin infrastructure modules to v0.23.0.": [
      "feat/hostclaim-storage"
    ],
    "Run `carlos accounts migrate` with a v0.23.0 CLI.": [
      "tenant-iso-binding"
    ],
    "Existing data is left in place.": [
      "tenant-iso-leftovers",
      "tenant-iso-mail"
    ]
  },
  "v0.22.2": {
    "Database size on the app Overview.": [
      "feature/instance-db-stats-card"
    ],
    "Busy and large instances can finish a move.": [
      "move-ready-delta-threshold"
    ],
    "A move becomes ready when little is left to copy.": [
      "move-ready-delta-threshold"
    ],
    "Copy receipts in the source box's data bucket.": [
      "move-ready-delta-threshold"
    ],
    "The cut is still exact.": [
      "move-ready-delta-threshold"
    ],
    "The Database tile is console only.": [
      "feature/instance-db-stats-card"
    ]
  },
  "v0.22.0": {
    "Availability, apart from errors.": [
      "availability-tab"
    ],
    "Errors is shorter.": [
      "availability-tab"
    ],
    "Replica instances.": [
      "edge-replica-placements"
    ],
    "Door keys.": [
      "instance-moves-p7"
    ],
    "Faster log reads.": [
      "parallel-chunk-read"
    ],
    "A restored app keeps its pipeline.": [
      "fix/preserve-adopted-app-pipeline"
    ],
    "Roll the console first, then the boxes, close together.": [
      "availability-tab"
    ],
    "A new CLI against an old console.": [
      "availability-tab",
      "edge-replica-placements"
    ],
    "No replicas until every box has rolled.": [
      "edge-replica-placements"
    ],
    "Long polls show up in Availability.": [
      "availability-tab"
    ],
    "Tunnelled failures are filed once.": [
      "availability-tab"
    ],
    "Instance moves.": [
      "instance-moves-p0"
    ],
    "The edge-local door is off by default.": [
      "instance-moves-p7"
    ],
    "Each instance gets its own `/dev/shm`.": [
      "isolated-exec-probe-fixes"
    ]
  },
  "v0.21.0": {
    "A new address is never a dead end.": [
      "edge-unknown-host-174"
    ],
    "The release recipe is in the README.": [
      "docs-release-recipe"
    ]
  },
  "v0.20.0": {
    "Named deploy destinations.": [
      "config-destinations-cli",
      "carlos-deploy-targets"
    ],
    "Sidecars.": [
      "sidecar-members",
      "sidecar-engine-capability"
    ],
    "Email you can follow.": [
      "mail-events-log",
      "mail-events-push"
    ],
    "A store per environment.": [
      "per-instance-store",
      "412-storage-isolation-config"
    ],
    "Purge every host of an account at once.": [
      "edge-purge-hosts-173"
    ],
    "Faster edge start on distant boxes.": [
      "fix-edge-boot-refresh"
    ]
  },
  "v0.19.0": {
    "Self-serve object storage.": [
      "worktree-store-self-serve"
    ],
    "Edge reads `s-maxage`": [
      "edge-s-maxage"
    ],
    "Maintenance worker.": [
      "feat-maintenance-worker",
      "feat-launchctx-module"
    ]
  }
}