# Agent 0.6.43

Released 2026-10-29. Changes below are relative to stable 0.6.41; version 0.6.42 was not released.

- Newly rendered TLS routes using Impreza DNS wait 60 seconds before checking DNS-01 propagation and allow up to ten minutes for propagation checks. These are TLS issuer settings, separate from the DNS provider. Existing route fragments are not migrated automatically, and routes using other providers are unchanged. A fresh certificate challenge can take longer; the ten-minute setting is not a guarantee for total certificate issuance time.
- Incremental volume checkpoints report the actual capture window, from the start of the scan to the last protected read, before the round deadline. Upload completion or later delivery of a saved result does not make that window newer. A capture canceled or expired before its result is sealed is not reported as successful.
- Encrypted-root reporting recognizes additional operating system profiles. It still requires local enrollment and a policy naming this agent, and reports observed state only. Updating the agent does not encrypt a disk or enable reporting.
- The separate encrypted-root template tools include more distribution profiles, disable package upgrades during initial template boot, improve Debian encrypted-root boot and initramfs checks, and remove inherited unlock public-key files. Re-encryption uses a fixed key-derivation cost so smaller servers can unlock. These tools are separate from the agent executable: an agent update alone does not install them or make new templates available.
- The control-panel command group stays inactive without a local policy written by root and naming this agent. No panel capability is reported without that opt-in; aaPanel also requires local enrollment. Remote permissions or an agent update cannot create the local policy, and panel maintenance still needs its separate service rollout and approvals.
- I2P destination reporting, key export and removal commands remain inactive in this candidate: no local key-storage root is admitted. A panel policy does not enable them. Deployments do not start, stop or remove an I2P sidecar.
- Deployment completion now requires the requested public routes to be written and acknowledged by the proxy. A failed route apply or reload returns failure without advertising a working public address. Redeploys that intentionally leave routes unchanged must already have a matching published route for that deployment. Updating the agent alone does not backfill missing routes; support must review and repair the deployment through the control plane.
- Domain changes refuse an unpublished previous site before saving recovery material. An interrupted change on a proxy that never published a site can restore its saved environment and report rollback without inventing a previous route. Unresolved recovery keeps its private records and blocks proxy writers, while a minimal heartbeat continues as its recovery-required receipt awaits acceptance. A routing failure does not delete application volumes, but it is not an application-version or database rollback.
- Built with Go 1.26.10 for Linux amd64 and arm64. Dependency locks are unchanged from 0.6.41. Two local builds of each architecture produced identical binaries; this is not an independent build by another organization.
- Updates remain an explicit customer action and preserve the agent's identity, configuration and application containers. Finish active operations before updating.