Release chart 1.7.1 for native Server 3.9.2

k8s/helm/durable-workflow/Chart.yaml

@@ -5,11 +5,11 @@ type: application
 # The chart's own semver version. Bumped on every chart release; treated as
 # independent of the server image version (appVersion). Breaking-change rules
 # for this version live in docs/UPGRADING.md alongside the chart.
-version: 1.7.0
+version: 1.7.1
 # The immutable native Durable Workflow Server this chart release packages.
 # The onboarding default in values.yaml and appVersion are generated from the
 # checked-in source release record (helm_chart.app_version).
-appVersion: "3.9.1"
+appVersion: "3.9.2"
 kubeVersion: ">=1.27.0-0"
 home: https://durable-workflow.github.io/docs/2.0/deployment
 sources:
@@ -30,16 +30,16 @@ annotations:
   # exact commit that most recently changed the packaged chart.
   org.opencontainers.image.source: https://github.com/durable-workflow/server
   dev.durable-workflow.source-revision: "unreleased"
-  dev.durable-workflow.image-reference: "docker.io/durableworkflow/server:3.9.1"
+  dev.durable-workflow.image-reference: "docker.io/durableworkflow/server:3.9.2"
   artifacthub.io/license: MIT
   artifacthub.io/category: integration-delivery
   # Free-form changelog for the current chart release shown by Artifact Hub.
   artifacthub.io/changes: |
     - kind: changed
-      description: "Default image changes from native Server 3.8.0 to 3.9.1. Every backend needs a schema upgrade (SQLite 12 to 13, PostgreSQL and MariaDB 13 to 14, MySQL 14 to 15) that only creates the empty dw_command_intents table. Scale to zero, back up, run helm upgrade with native.schemaUpgrade.enabled=true, scale up; rolling back means restoring the backup (docs/UPGRADING.md)."
-    - kind: added
-      description: "Server 3.9.1: signal and update request_id values are durable command keys; reusing a key with different input returns 409 request_id_conflict. A run's own close settles its open activities and timers. https://github.com/durable-workflow/server/releases/tag/3.9.1"
+      description: "Default image advances from native Server 3.9.1 to 3.9.2. No schema step from 3.9.0 or 3.9.1; upgrades from 3.8.x or earlier keep the explicit 3.9 schema/backup/restore procedure in docs/UPGRADING.md."
+    - kind: fixed
+      description: "Server 3.9.2 accepts 255-code-point multibyte command keys and echoes literal keys with explicit fresh/retained intent metadata. Installed client acceptance remains separately qualified. https://github.com/durable-workflow/server/releases/tag/3.9.2"
     - kind: changed
-      description: "Server 3.9.1 honors the configured storage-admission observation: draining refuses new work while existing leases can finish; fenced permits only reads. Completion uploads during draining remain unavailable (server#951)."
+      description: "Storage-admission observation ownership is checked on the opened descriptor against root or the effective Server UID. Trusted ancestors remain operator-required; draining uploads and Cloud adoption remain separate (server#951)."
     - kind: fixed
       description: "Legacy command-key readback identifies unverified intent and refuses ambiguous identities. Oversized completion responses use a bounded drain, and discovery advertises the actual completion wire cap; installed SDK acceptance is tracked in shared#228."

k8s/helm/durable-workflow/README.md

@@ -77,7 +77,7 @@ helm install durable-workflow ./k8s/helm/durable-workflow \
 
 ```yaml
 image:
-  tag: "3.9.1"
+  tag: "3.9.2"
   # Pin a digest in production:
   # digest: "sha256:abc123..."
 

k8s/helm/durable-workflow/docs/UPGRADING.md

@@ -69,6 +69,36 @@ chart MINOR bump and an entry below.
 
 ## Per-version migration notes
 
+### Chart 1.7.1 / Server 3.9.2 (native)
+
+Chart 1.7.1 selects the native Server 3.9.2 corrective image. From Server
+3.9.0 or 3.9.1, no schema step is required: back up the database and external
+payload storage, stop the Server replicas, apply the new chart/image and
+verify readiness, reported version and worker registration. An explicit
+`image.tag` or `image.digest` override must select the intended qualified image too.
+
+From 3.8.x or earlier, follow the schema-upgrade procedure below using the
+3.9.2 image. The backend versions and restore-required rollback boundary are
+unchanged. A rollback to 3.9.1 uses the same schema but restores its Unicode-key
+and receipt-metadata defects and removes the observation-owner hardening.
+
+Server 3.9.2 accepts the existing 255-Unicode-code-point command-key boundary
+for multibyte keys. Fresh keyed signal/accepted-update receipts echo the literal
+`request_id` with `retained:false` and `intent_verified:true`; retained receipts
+echo their key while preserving original identities and legacy unverified
+intent. The body key remains distinct from the tracing header. Conflicts and
+ambiguous identity matches still refuse without writes.
+
+An enabled storage-admission observation must belong to root or the effective
+Server UID. Check the actual container mapping before rollout. Trusted parent
+directories remain an operator requirement; the runtime does not validate
+ancestors. This patch adds no draining-upload allowance or Cloud adoption.
+The encoded completion budget and bounded refusal delivery are unchanged.
+Installed client/physical upgrade acceptance under shared #216 and #228 stays
+separate. The MariaDB reliability investigation #1204 remains open.
+
+See [Server 3.9.2 release notes](../../../../docs/releases/3.9.2.md).
+
 ### Chart 1.7.0 / Server 3.9.1 (native)
 
 **From 3.8.x or earlier, every backend needs an explicit native schema upgrade.** Server 3.9.1 includes

k8s/helm/durable-workflow/values.yaml

@@ -42,7 +42,7 @@ image:
   # scripts/ci/sync-source-release.mjs. Do not edit this default.
   # A tag must match the runtime: 3.x (or latest) for native, 2.x for php.
   # The chart refuses a mismatch at render time.
-  tag: "3.9.1"
+  tag: "3.9.2"
   # Optional digest pin. When set, takes precedence over tag for change control.
   # Example: "sha256:abc123..."
   # The chart cannot see which runtime a digest names. Pin a native digest

resources/release/source-release.json

@@ -4,7 +4,7 @@
     "version": "2.11.8"
   },
   "helm_chart": {
-    "version": "1.7.0",
-    "app_version": "3.9.1"
+    "version": "1.7.1",
+    "app_version": "3.9.2"
   }
 }