> **Plain-language companion:** [v0.84.0.md](v0.84.0.md)

## v0.84.0 — Catalog, Privilege, and Upgrade Integrity

**Status: Implemented (2026-08-16); full manual CI matrix pending.** Derived
from [ROADMAP.md](../ROADMAP.md) and
[plans/PLAN_0_84_0.md](../plans/PLAN_0_84_0.md).

> **Release Theme**
> Make fresh installs, upgraded installs, documented role setups,
> backup/restore, and mutating SQL APIs agree on one enforceable contract.

---

### Correctness and integrity

| ID | Title | Effort | Priority |
|----|-------|--------|----------|
| CAT-81-1 | Canonical fresh-install and upgrade schema | Large | P0 |
| CAT-81-3 | Typed identifier and snapshot provenance safety | Large | P0 |
| CAT-81-4 | Lifecycle API correctness | Large | P0 |
| CAT-81-5 | Truthful logical backup and restore | Large | P0 |
| CAT-81-6 | Real upgrade and version verification | Large | P0 |

### Security and API contracts

| ID | Title | Effort | Priority |
|----|-------|--------|----------|
| CAT-81-2 | Explicit SQL privilege matrix | Large | P0 |
| CAT-81-7 | Validated API contracts and generated reference | Medium | P0 |

---

### Recommended Implementation Order

1. WP0: machine-readable API and catalog contracts.
2. WP1: bootstrap repair, migration, and bidirectional parity.
3. WP2: privilege matrix and runtime authorization.
4. WP3: typed identifiers and snapshot provenance.
5. WP4: atomic bulk lifecycle and complete cleanup.
6. WP5: logical restore reconciliation and CDC rebuild.
7. WP6: real old-binary upgrades and version integrity.
8. WP7: shared validation and generated SQL contracts.
9. WP8: documentation and release gates.

---

### Implementation Status

| ID | Title | Status |
|----|-------|--------|
| CAT-81-1 | Canonical fresh-install and upgrade schema | ✅ Done |
| CAT-81-2 | Explicit SQL privilege matrix | ✅ Done |
| CAT-81-3 | Typed identifier and snapshot provenance safety | ✅ Done |
| CAT-81-4 | Lifecycle API correctness | ✅ Done |
| CAT-81-5 | Truthful logical backup and restore | ✅ Done |
| CAT-81-6 | Real upgrade and version verification | ✅ Done |
| CAT-81-7 | Validated API contracts and generated reference | ✅ Done |

---

### Exit Criteria

- [x] All P0 items are ✅ Done.
- [x] Fresh and upgraded normalized catalog manifests match.
- [x] `just fmt`, `just lint`, unit, integration, and light E2E tests pass.
- [x] `just check-version-sync` exits 0.
- [x] CHANGELOG.md entry is written.
- [x] ROADMAP.md v0.84.0 row is marked ✅ Implemented.