Add fail-closed shutdown drain checkpoint

2026-08-26 12:02:37 +02:00
parent fe3c84a27f
commit b18adab26d
21 changed files with 520 additions and 44 deletions
@@ -1,6 +1,20 @@

 # Changelog

+## [2.3.2] - 2026-08-26
+### Added
+- A persisted, fail-closed operator drain checkpoint between the global receive-location phase and all later real shutdown phases.
+- Durable `Continue`, `Stop` or `Error` checkpoint evidence plus `NotExecuted` results for every protected downstream plan row.
+- Regression coverage for checkpoint ordering, continuation after an early receive-location failure, explicit operator stop, missing-handler fail-closed behavior and dry-run isolation.
+- A dedicated PROD runbook and plain-text handoff for drain verification and BizTalk application status semantics.
+
+### Changed
+- Real shutdown now pauses with a default-No dialog that summarizes receive-location outcomes and asks the operator to verify Group Hub and enterprise monitoring before continuing.
+- A safe operator stop still attempts the partial-state snapshot and execution report and is shown as stopped rather than a completed shutdown.
+
+### Security
+- The tool deliberately does not issue a broad application-level stop merely to change `Partially Started`; stronger BizTalk application stop modes can remove subscriptions, unenlist artifacts, undeploy policies or terminate running instances.
+
 ## [2.3.1] - 2026-08-26
 ### Added
 - A real runtime-log write/read roundtrip to the WMI-free installer self-test and a durable startup verification record naming the active daily file.