# kit-argon-f79692fd

The ArgonDB kit at main's tip on 2026-11-01, superseding the channel-staged kit-argon-d43df2ab: the box image now carries the catalog's policy engine (OpenFGA 1.14.2) so a box holding more than one database walls its catalog by default as designed, the storage tier is built from the same source commit as the kit, and a table published on an idle box no longer reads backfill pending until the hourly refresh. Forward-migrating from kit-argon-b3922801: back up before applying, and a restart of the argondb service is required.

## What changed

- Box image: OpenFGA 1.14.2 is bundled beside Lakekeeper (ARGONDB_OPENFGA_BIN), so a box whose cluster holds more than one database boots with catalog_authz=openfga by default instead of falling back to an unwalled catalog; a single-database box is unchanged.
- Kit cut: the storage tier (pageserver, safekeeper, storage broker, compute_ctl) is built from the same source commit as the kit in the same build, and the cut refuses to ship an image whose tier was built from any other commit.
- Lake: a table published on a quiet box reads its true lake state from argondb lake list within one tail cadence; it no longer reads backfill pending until the hourly cursor refresh.
- Everything kit-argon-d43df2ab carried over kit-argon-b3922801 (multi-tenant estates on one box, the memory-bound tail with its WAL retention hold, views and data sharing, the lake wall, the compute authorization walk, the idle-sweep and memory-budget operations fixes); that kit was staged on the channel and never pinned, so this is the first pin move since kit-argon-b3922801.
- Known limit, stated plainly: the customer-sequence replay did not run against this image (the replay's image arm cannot run an Ubuntu 24.04 image's bytes natively on the Ubuntu 26.04 build host); the box-image binary census and the exit-door proof did run and passed.

## Machine contract

```argon-release-contract
schema: argon-release-contract/1
pack_version: kit-argon-f79692fd
source_sha: f79692fd91f429e1c5a6744c02a8d13b71985b16
supersedes: kit-argon-d43df2ab
data_format: forward-migrating
restart_required: yes
restart_services: argondb
summary: The ArgonDB kit at main's tip on 2026-11-01, superseding the channel-staged kit-argon-d43df2ab: the box image now carries the catalog's policy engine (OpenFGA 1.14.2) so a box holding more than one database walls its catalog by default as designed, the storage tier is built from the same source commit as the kit, and a table published on an idle box no longer reads backfill pending until the hourly refresh. Forward-migrating from kit-argon-b3922801: back up before applying, and a restart of the argondb service is required.
change: Box image: OpenFGA 1.14.2 is bundled beside Lakekeeper (ARGONDB_OPENFGA_BIN), so a box whose cluster holds more than one database boots with catalog_authz=openfga by default instead of falling back to an unwalled catalog; a single-database box is unchanged.
change: Kit cut: the storage tier (pageserver, safekeeper, storage broker, compute_ctl) is built from the same source commit as the kit in the same build, and the cut refuses to ship an image whose tier was built from any other commit.
change: Lake: a table published on a quiet box reads its true lake state from argondb lake list within one tail cadence; it no longer reads backfill pending until the hourly cursor refresh.
change: Everything kit-argon-d43df2ab carried over kit-argon-b3922801 (multi-tenant estates on one box, the memory-bound tail with its WAL retention hold, views and data sharing, the lake wall, the compute authorization walk, the idle-sweep and memory-budget operations fixes); that kit was staged on the channel and never pinned, so this is the first pin move since kit-argon-b3922801.
change: Known limit, stated plainly: the customer-sequence replay did not run against this image (the replay's image arm cannot run an Ubuntu 24.04 image's bytes natively on the Ubuntu 26.04 build host); the box-image binary census and the exit-door proof did run and passed.
```

## Customer-sequence replay

This image was NOT replayed through the customer's sequence (the cut ran with --no-replay). Tenant creates under the estate pass, a restart with tenants and the idle sweep over a held backlog were not exercised against this build before it was published.

## Build

| | |
|---|---|
| box_image | ghcr.io/argondbdev/argondb-box:f79692fd91f4 |
| artifact  | argon-kit-x86_64-unknown-linux-gnu-f79692fd91f4.tar.gz |
| sha256    | d8e58d743f0a0be6de0f09c14b1ef38c428e31effe4605455b73eae34984d35c |
| source commit | f79692fd91f429e1c5a6744c02a8d13b71985b16 |
| commit range | `d43df2aba317..f79692fd91f4` (77 commits) |