test(release): verify alpha4 upgrade and production recovery

[RentnerKev]

Summary

Verify Alpha 4 against the published, digest-pinned Alpha 3 appliance. Preserve existing users, roles, settings, hosts, certificate fingerprints and traffic through migrations, repeated startup, fresh-volume restore, and failed-restore rollback. Keep the earlier Alpha 1 upgrade path covered through shared upgrade helpers.

Exercise real ACME candidate/account/operation and encrypted DNS cleanup state through the production archive filters with the controller stopped. Restore the files as the production UID, then recover with Pebble offline. Share backup and restore exclusions to prevent stale runtime files from returning.

Verify production backup/restore preserves durable binding jobs, renewal retry metadata, event receipts/cursors, and decryptable requests under the restored application key. Check verified HTTP/3, canonical origin, and trusted proxy configuration after restore. Keep fixtures split by persistence, encryption and seed responsibilities.

Related issue

Fixes #85

Built on the merged HTTP/3 and canonical-origin changes. The final rebase onto main preserves the exact locally tested file tree.

Type of change

• CI / tooling
• Refactoring
• Documentation

Testing

• bun run check: 777 Bun tests and 170 Rust tests passed, plus format, lint, types, migrations, and web/controller builds.
• bun run certificates:smoke: 51 checks passed with HTTP/3, durable jobs, active/candidate certificate restoration, ACME accounts, operation journals, encrypted DNS credentials, and offline recovery.
• bun run production:smoke: 39 assertions passed, including published Alpha 3 migration from 17 to 20 applied migrations, Alpha 1 compatibility, new durable-state backup/restore, verified HTTP/3 after restore, and transactional rollback.
• Focused final TypeScript, formatting and whitespace checks passed.
• Independent review found no remaining P1/P2 gaps in the release gate.

Checklist

• I tested the relevant functionality.
• Existing tests pass.
• I added or updated tests where appropriate.
• This PR does not include secrets, credentials, production data, or private certificates/keys.
• I updated documentation where necessary.
• I linked the relevant issue.

Breaking changes

None. This PR does not publish an Alpha 4 tag or release.

Screenshots

None.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 27006ff0-a3f1-4222-a5e6-30426895d619

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}