feat(docker): guide clone installation and validate paired update artifacts

src/app/admin/devops/installation/page.tsx

@@ -21,6 +21,18 @@ export default async function InstallationPage() {
 				})}
 			</p>
 			<RefreshStatus label={t("recheck")} />
+			<section className="admin-card space-y-3">
+				<h2 className="font-semibold">{t("guideTitle")}</h2>
+				<p>{t("guideHost")}</p>
+				<code className="block break-all text-sm">bash cms install</code>
+				<p>{t("guideAccess")}</p>
+				<code className="block break-all text-sm">bash cms update</code>
+				<p>{t("guidePinned")}</p>
+				<p>{t("guideWorker")}</p>
+				<p className="text-sm text-[var(--admin-text-muted)]">
+					{t("guideRecovery")}
+				</p>
+			</section>
 			<div className="grid gap-3 md:grid-cols-2">
 				{result.rows.map((row) => (
 					<section key={row.key} className="admin-card space-y-2 min-w-0">

src/lib/docker-install.test.ts

@@ -146,3 +146,51 @@ it("hands a completed installation to the existing updater", () => {
 	expect(result.output).toContain("Update invoked");
 	expect(result.profile).toContain("MODE=prebuilt");
 });
+
+it("defaults a new clone to source without requiring registry access", () => {
+	const result = configure(
+		"https://hotel.example\n\n",
+		"AUTH_SECRET=existing\n",
+	);
+	expect(result.status, result.output).toBe(0);
+	expect(result.profile).toContain("MODE=source");
+});
+it("keeps a saved prebuilt choice when the operator accepts defaults", () => {
+	const result = configure(
+		"\n\n",
+		"AUTH_SECRET=existing\n",
+		"MODE=prebuilt\nPUBLIC_URL=https://hotel.example\n",
+	);
+	expect(result.status, result.output).toBe(0);
+	expect(result.profile).toContain("MODE=prebuilt");
+});
+
+it("preflight treats dotenv as configuration data instead of executing host commands", () => {
+	const dir = mkdtempSync(join(tmpdir(), "cms-preflight-test-"));
+	try {
+		mkdirSync(join(dir, "scripts"));
+		copyFileSync(
+			resolve(root, "scripts/docker-preflight.sh"),
+			join(dir, "scripts/docker-preflight.sh"),
+		);
+		writeFileSync(join(dir, ".env"), "touch injected\n");
+		const result = spawnSync(bash, [join(dir, "scripts/docker-preflight.sh")], {
+			cwd: dir,
+			encoding: "utf8",
+			timeout: 15000,
+			env: {
+				...process.env,
+				ENV_FILE: join(dir, ".env"),
+				MYSQL_PORT: "1",
+				REDIS_PORT: "1",
+				CMS_PORT: "1",
+				BASH_ENV: resolve(root, "src/test/docker-install-harness.sh"),
+			},
+		});
+		if (result.error) throw result.error;
+		expect(existsSync(join(dir, "injected"))).toBe(false);
+		expect(result.stdout).toContain("Dotenv is not executed");
+	} finally {
+		rmSync(dir, { recursive: true, force: true });
+	}
+});

src/lib/docker-update.test.ts

@@ -25,11 +25,15 @@ const bash =
 				.find((path) => existsSync(path)) ?? "bash")
 		: "bash";
 const sha = "a".repeat(40);
-function simulate(scenario: string) {
+function simulate(scenario: string, args: string[] = []) {
 	const dir = mkdtempSync(join(tmpdir(), "cms-compose-test-"));
 	try {
 		mkdirSync(join(dir, "scripts"));
 		mkdirSync(join(dir, "logs"));
+		copyFileSync(
+			resolve(root, "scripts/docker-update-options.sh"),
+			join(dir, "scripts/docker-update-options.sh"),
+		);
 		copyFileSync(
 			resolve(root, "scripts/docker-config.sh"),
 			join(dir, "scripts/docker-config.sh"),
@@ -56,26 +60,30 @@ function simulate(scenario: string) {
 				join(dir, ".docker-install"),
 				`MODE=${scenario === "saved-source" ? "source" : "prebuilt"}\nPUBLIC_URL=https://saved.test\n`,
 			);
-		const result = spawnSync(bash, [join(dir, "scripts/docker-update.sh")], {
-			cwd: dir,
-			encoding: "utf8",
-			timeout: 25000,
-			env: {
-				...process.env,
-				BASH_ENV: resolve(root, "src/test/docker-update-harness.sh"),
-				TEST_DIR: dir.replaceAll("\\", "/"),
-				TEST_SHA: sha,
-				SCENARIO: scenario,
-				CMS_PUBLIC_URL: scenario.startsWith("saved-")
-					? undefined
-					: "https://example.test",
-				CMS_IMAGE_REPOSITORY: scenario.startsWith("saved-")
-					? undefined
-					: scenario.startsWith("registry")
-						? "registry.test/team/cms"
-						: "",
+		const result = spawnSync(
+			bash,
+			[join(dir, "scripts/docker-update.sh"), ...args],
+			{
+				cwd: dir,
+				encoding: "utf8",
+				timeout: 25000,
+				env: {
+					...process.env,
+					BASH_ENV: resolve(root, "src/test/docker-update-harness.sh"),
+					TEST_DIR: dir.replaceAll("\\", "/"),
+					TEST_SHA: sha,
+					SCENARIO: scenario,
+					CMS_PUBLIC_URL: scenario.startsWith("saved-")
+						? undefined
+						: "https://example.test",
+					CMS_IMAGE_REPOSITORY: scenario.startsWith("saved-")
+						? undefined
+						: scenario.startsWith("registry")
+							? "registry.test/team/cms"
+							: "",
+				},
 			},
-		});
+		);
 		if (result.error) throw result.error;
 		return {
 			status: result.status,
@@ -86,7 +94,12 @@ function simulate(scenario: string) {
 				: "",
 		};
 	} finally {
-		rmSync(dir, { recursive: true, force: true });
+		rmSync(dir, {
+			recursive: true,
+			force: true,
+			maxRetries: 5,
+			retryDelay: 100,
+		});
 	}
 }
 describe("Docker clone updates", () => {
@@ -212,3 +225,62 @@ it("keeps source builds available for a saved source installation", () => {
 	expect(r.calls).toContain("docker compose build");
 	expect(r.calls).not.toContain("docker pull");
 });
+
+it("checks candidate storage before any database migration", () => {
+	const r = simulate("storage-failure");
+	expect(r.status).not.toBe(0);
+	expect(r.calls).toContain(
+		"docker compose run --rm --no-deps --entrypoint node",
+	);
+	expect(r.calls).not.toContain("--entrypoint pnpm");
+	expect(r.restored).toBe(false);
+});
+it("rejects a migration artifact from another revision before database changes", () => {
+	const r = simulate("migration-revision-mismatch");
+	expect(r.status).not.toBe(0);
+	expect(r.calls).not.toContain("--entrypoint pnpm");
+	expect(r.output).toContain("no matching release label");
+});
+
+it("uses both immutable artifacts without pulling Git when a checked-out release is requested", () => {
+	const digest = `sha256:${"1".repeat(64)}`;
+	const migrations = `sha256:${"2".repeat(64)}`;
+	const r = simulate("registry", [
+		"--skip-pull",
+		"--app-digest",
+		digest,
+		"--migrations-digest",
+		migrations,
+	]);
+	expect(r.status, r.output).toBe(0);
+	expect(r.calls).not.toContain("git pull");
+	expect(r.calls).toContain(`docker pull registry.test/team/cms@${digest}`);
+	expect(r.calls).toContain(`docker pull registry.test/team/cms@${migrations}`);
+});
+it("rejects incomplete artifact selection before contacting Git or Docker", () => {
+	const r = simulate("registry", ["--app-digest", `sha256:${"1".repeat(64)}`]);
+	expect(r.status).not.toBe(0);
+	expect(r.calls).toBe("");
+});
+
+it("rejects a legacy migrations image without release metadata before database changes", () => {
+	const r = simulate("migration-revision-missing");
+	expect(r.status).not.toBe(0);
+	expect(r.calls).not.toContain("--entrypoint pnpm");
+	expect(r.calls).not.toContain("compose up");
+	expect(r.output).toContain("Rebuild/publish both artifacts");
+});
+it("requires prebuilt mode when selecting immutable artifacts", () => {
+	const digest = `sha256:${"1".repeat(64)}`;
+	const r = simulate("saved-source", [
+		"--app-digest",
+		digest,
+		"--migrations-digest",
+		digest,
+	]);
+	expect(r.status).not.toBe(0);
+	expect(r.output).toContain("Digest selection requires prebuilt mode");
+	expect(r.calls).not.toContain("docker pull");
+	expect(r.calls).not.toContain("--entrypoint pnpm");
+	expect(r.calls).not.toContain("compose up");
+});

src/messages/ar.json

@@ -377,7 +377,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"importHistory": {
 				"cancelled": "Cancelled",

src/messages/bg.json

@@ -4062,7 +4062,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"importHistory": {
 				"cancelled": "Cancelled",

src/messages/cs.json

@@ -4062,7 +4062,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"importHistory": {
 				"cancelled": "Cancelled",

src/messages/da.json

@@ -4062,7 +4062,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"importHistory": {
 				"cancelled": "Cancelled",

src/messages/de.json

@@ -4032,7 +4032,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"importHistory": {
 				"cancelled": "Cancelled",

src/messages/el.json

@@ -4062,7 +4062,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"importHistory": {
 				"cancelled": "Cancelled",

src/messages/en.json

@@ -4338,7 +4338,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"operations": {
 				"title": "Needs attention",

src/messages/es.json

@@ -4032,7 +4032,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"importHistory": {
 				"cancelled": "Cancelled",

src/messages/fi.json

@@ -377,7 +377,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"importHistory": {
 				"cancelled": "Cancelled",

src/messages/fr.json

@@ -4032,7 +4032,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"importHistory": {
 				"cancelled": "Cancelled",

src/messages/hr.json

@@ -4062,7 +4062,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"importHistory": {
 				"cancelled": "Cancelled",

src/messages/hu.json

@@ -4062,7 +4062,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"importHistory": {
 				"cancelled": "Cancelled",

src/messages/it.json

@@ -4307,7 +4307,13 @@
 				"migrationsHint": "Numero di migrazioni incluse nella versione e assenti dalla cronologia del database. Applicale attraverso il processo di rilascio.",
 				"workerHint": "Ultimo segnale del worker in Redis. Oltre due minuti richiede verifica; nessun segnale non permette di stabilire se il worker sia attivo.",
 				"rendererHint": "Il client usa l’indirizzo configurato oppure /nitro-client/ come percorso predefinito. Apri separatamente il gioco per controllare rendering e risorse.",
-				"registryHint": "Le credenziali del registro sono nella CI, non nel CMS. Controlla il lavoro di pubblicazione e il tag immutabile della versione in Gitea."
+				"registryHint": "Le credenziali del registro sono nella CI, non nel CMS. Controlla il lavoro di pubblicazione e il tag immutabile della versione in Gitea.",
+				"guideTitle": "Installazione e aggiornamenti",
+				"guideHost": "Esegui questi comandi nel clone del repository sul server Linux con Docker. Questa pagina verifica lo stato e non controlla Docker.",
+				"guideAccess": "La compilazione dai sorgenti richiede accesso al repository. Le immagini private richiedono anche accesso ai pacchetti del registro. La procedura conserva le impostazioni esistenti.",
+				"guidePinned": "Per una versione verificata, seleziona il relativo commit sul server ed esegui bash cms update --skip-pull. In modalità immagini precompilate puoi specificare entrambi i digest; consulta docs/operations/docker-installation.md.",
+				"guideWorker": "Dopo l’avvio verifica spazio persistente, migrazioni e segnale del worker. Lo stato HTTP da solo non conferma l’esecuzione dei processi in background.",
+				"guideRecovery": "Prima di aggiornare salva il database e verifica come ripristinarlo. Ripristinare l’immagine non annulla le migrazioni. La compatibilità con versioni precedenti del database non è garantita."
 			},
 			"operations": {
 				"title": "Da controllare",

src/messages/ja.json

@@ -377,7 +377,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"importHistory": {
 				"cancelled": "Cancelled",

src/messages/nl.json

@@ -4235,7 +4235,13 @@
 				"migrationsHint": "Aantal meegeleverde migraties dat ontbreekt in de databasehistorie. Voer migraties uit via het releaseproces.",
 				"workerHint": "Laatste workersignaal in Redis. Ouder dan twee minuten vereist onderzoek; zonder signaal is niet vast te stellen of de worker actief is.",
 				"rendererHint": "De client gebruikt het ingestelde adres of standaard /nitro-client/. Open het spel apart om de weergave en assets te controleren.",
-				"registryHint": "Registergegevens staan in CI, niet in het CMS. Controleer de publicatietaak en onveranderlijke versietag in Gitea."
+				"registryHint": "Registergegevens staan in CI, niet in het CMS. Controleer de publicatietaak en onveranderlijke versietag in Gitea.",
+				"guideTitle": "Installatie en updates",
+				"guideHost": "Voer deze opdrachten uit in de repositorykloon op je Linux Docker-host. Deze pagina controleert alleen de status en bestuurt Docker niet.",
+				"guideAccess": "Bouwen vanuit broncode vereist toegang tot de repository. Private images vereisen ook toegang tot registerpakketten. De wizard bewaart bestaande instellingen.",
+				"guidePinned": "Selecteer voor een gecontroleerde versie de bijbehorende commit op de host en voer bash cms update --skip-pull uit. Bij vooraf gebouwde images kun je beide digests opgeven; zie docs/operations/docker-installation.md.",
+				"guideWorker": "Controleer na het starten opslag, migraties en de worker-heartbeat hieronder. Een gezonde HTTP-respons bevestigt niet dat achtergrondtaken draaien.",
+				"guideRecovery": "Maak voor het upgraden een databaseback-up en controleer de herstelprocedure. Een image terugzetten draait migraties niet terug. Compatibiliteit met eerdere databaseversies is niet gegarandeerd."
 			},
 			"importHistory": {
 				"cancelled": "Geannuleerd",

src/messages/no.json

@@ -4062,7 +4062,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"importHistory": {
 				"cancelled": "Cancelled",

src/messages/pl.json

@@ -4062,7 +4062,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"importHistory": {
 				"cancelled": "Cancelled",

src/messages/pt.json

@@ -4062,7 +4062,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"importHistory": {
 				"cancelled": "Cancelled",

src/messages/ro.json

@@ -4062,7 +4062,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"importHistory": {
 				"cancelled": "Cancelled",

src/messages/ru.json

@@ -4060,7 +4060,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"importHistory": {
 				"cancelled": "Cancelled",

src/messages/sk.json

@@ -4062,7 +4062,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"importHistory": {
 				"cancelled": "Cancelled",

src/messages/sr.json

@@ -4062,7 +4062,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"importHistory": {
 				"cancelled": "Cancelled",

src/messages/sv.json

@@ -4062,7 +4062,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"importHistory": {
 				"cancelled": "Cancelled",

src/messages/tr.json

@@ -4062,7 +4062,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"importHistory": {
 				"cancelled": "Cancelled",

src/messages/uk.json

@@ -4062,7 +4062,13 @@
 				"migrationsHint": "Number of packaged migrations absent from the database history. Apply migrations through the release process.",
 				"workerHint": "Last worker heartbeat in Redis. More than two minutes old needs investigation; no heartbeat cannot establish whether the worker is running.",
 				"rendererHint": "The client uses the configured address or /nitro-client/ by default. Open the game separately to verify rendering and assets.",
-				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea."
+				"registryHint": "Registry credentials live in CI, not in the CMS. Check the image publication job and its immutable release tag in Gitea.",
+				"guideTitle": "Installation and updates",
+				"guideHost": "Run these commands in the repository clone on your Linux Docker host. This page only checks status; it does not control Docker.",
+				"guideAccess": "Source builds need repository access. Private prebuilt images also require registry package access. The wizard preserves existing settings.",
+				"guidePinned": "For a reviewed version, check out its commit on the host and run bash cms update --skip-pull. Paired application and migrations digests are optional in prebuilt mode; see docs/operations/docker-installation.md.",
+				"guideWorker": "After startup, check storage, migrations and worker heartbeat below. HTTP health alone does not confirm background jobs are running.",
+				"guideRecovery": "Back up the database and verify its restore procedure before upgrading. Image rollback does not undo migrations. Database downgrade compatibility is not guaranteed."
 			},
 			"importHistory": {
 				"cancelled": "Cancelled",

src/test/docker-update-harness.sh

@@ -19,8 +19,11 @@ docker() {
    if [ "${@: -1}" = previous123 ] || [ -f "$TEST_DIR/restored" ]; then echo sha256:old; return 0; fi
    if [ "$SCENARIO" = wrong-image ]; then echo sha256:old; else echo sha256:new; fi ;;
   'image inspect')
+   if [[ "$SCENARIO" = migration-revision-mismatch && "$*" = *epicnext-cms-migrations* ]]; then echo unknown; return 0; fi
+   if [[ "$SCENARIO" = migration-revision-missing && "$*" = *epicnext-cms-migrations* ]]; then echo '<no value>'; return 0; fi
    if [[ "$*" = *org.opencontainers* ]] && [[ "$*" = *sha256:old* ]]; then printf 'b%.0s' {1..40}; echo; return 0; fi
    if [[ "$*" = *org.opencontainers* ]]; then echo "$TEST_SHA"; else echo sha256:new; fi ;;
+  'compose run') [ "$SCENARIO" != storage-failure ] ;;
   'compose config') return 0 ;;
   'compose build') [ "$SCENARIO" != build-failure ] ;;
   'compose up')