From 4780bd77330726a7352fff929c05914da1a06fee Mon Sep 17 00:00:00 2001
From: n30nex <blushellneon@outlook.com>
Date: Fri, 2 Oct 2026 18:27:03 -0400
Subject: [PATCH] Verify upgrades from the published Worldwide release

---
 .github/workflows/ci.yml | 6 +++++-
 CHANGELOG.md             | 1 +
 docs/audit-2026-10-02.md | 4 ++++
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 28449ef..669da3e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,6 +15,8 @@ concurrency:
 
 env:
   IMAGE_NAME: ghcr.io/n30nex/cartolite-server
+  # Exact published 0.6.2, in addition to the legacy 0.4.1 source migration below.
+  UPGRADE_FROM_IMAGE: ghcr.io/n30nex/cartolite-server@sha256:acb8a95101655cc0ded3971d1999390c5aff3dd276c97d3dc1f44dbfd408331d
 
 jobs:
   backend:
@@ -305,8 +307,10 @@ jobs:
         run: |
           mkdir -p "$RUNNER_TEMP/anonymous-docker"
           DOCKER_CONFIG="$RUNNER_TEMP/anonymous-docker" docker pull "$CANDIDATE_IMAGE"
+          DOCKER_CONFIG="$RUNNER_TEMP/anonymous-docker" docker pull "$UPGRADE_FROM_IMAGE"
           test "$(docker image inspect "$CANDIDATE_IMAGE" --format '{{.Architecture}}')" = "${{ matrix.arch }}"
-          bash scripts/compose-smoke.sh "$CANDIDATE_IMAGE" "$GITHUB_SHA"
+          test "$(docker image inspect "$UPGRADE_FROM_IMAGE" --format '{{.Architecture}}')" = "${{ matrix.arch }}"
+          bash scripts/compose-smoke.sh "$CANDIDATE_IMAGE" "$GITHUB_SHA" "$UPGRADE_FROM_IMAGE"
       - if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 12b8f23..a897e58 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@
 - Drain accepted observations into the final checkpoint and cancel active event streams during shutdown.
 - Generate unique clean-session MQTT identities for unconfigured installations; explicit broker IDs remain unchanged. Clear an old shared default when upgrading multiple installs on one broker.
 - Record the end-to-end audit, synthetic regressions and index benchmark in docs/audit-2026-10-02.md.
+- Verify anonymous published-image upgrades from the exact 0.6.2 image on AMD64 and ARM64, retaining the legacy 0.4.1 migration check.
 
 ## 0.6.2 - Compact map controls
 
diff --git a/docs/audit-2026-10-02.md b/docs/audit-2026-10-02.md
index 1151f98..881c840 100644
--- a/docs/audit-2026-10-02.md
+++ b/docs/audit-2026-10-02.md
@@ -22,6 +22,10 @@ Source inspection and read-only operational checks established the findings belo
 
 The index is private to the engine. It does not supply evidence to route inference: an unpositioned or ambiguous regional hop stays unresolved. Packet classification, audio timing, route meaning, public API v2 and checkpoint v1 are unchanged.
 
+Worldwide release verification also now upgrades from the exact published 0.6.2 digest in the anonymous-install job on both architectures. Previously this job restarted the candidate itself; the separate legacy 0.4.1 source migration test remains required.
+
+Initial Actions medians (three samples, representative operation only): Canada at 10,000 nodes changed from 2.029297 ms / 320,032 B / 10,001 allocations to 0.1917 microseconds / 32 B / one allocation; Worldwide changed from 2.094656 ms to 0.1937 microseconds with the same allocation reduction. Sources: [Canada Go job](https://github.com/n30nex/CartoLite/actions/runs/37070813706/job/111049557273), [Worldwide Go job](https://github.com/n30nex/CartoLite-Server/actions/runs/37070821388/job/111049580955). These are not end-to-end throughput results.
+
 ## End-to-end review coverage
 
 | Area | Reviewed paths and retained constraints |