2026.09.31 — 2026-09-21

Added

• Pause, resume, purge and delete queues in bulk (3db6da8d)

  Adds bulk queue operations: preview a pause, resume, purge or delete over an explicit list of queues or every queue matching a filter, confirm the blast radius (typed confirmation for purge/delete), and watch the run execute one queue at a time through the same single-queue command, live over SSE, stoppable, and recorded.

  • New feature/bulk module: preview freezes the matched set for 10 minutes, is capped by safety.bulk-queue-cap (default 200 queues) and by the existing message cap (overridable on execute), and reuses the single-queue command for every preflight check, per-node fan-out and audit event. A run stops at the first failure by default, or continues past failures when the operator chose to; a crash mid-run marks the in-flight queue unknown and the rest cancelled on restart, never resumed.
  • Audit events gain an optional parent: a bulk run commits its own event before any queue is acted on, and each queue's event names it as the parent. The audit trail can be filtered to a run's children.
  • Frontend: the queues screen gains row selection and "select all N matching", a bulk action bar gated on the single-queue permission, a preview dialog stating the blast radius (unknown figures stated, never shown as zero), and a run view announcing the outcome for assistive technology.

  Archives the bulk-queue-operations OpenSpec change into openspec/specs/bulk-operations (new), openspec/specs/audit-log and openspec/specs/operator-ui.

Fixed

• Import broker.xml files as they come off disk, and say what a misplaced element needs (150cf273)

  The Import XML drawer on the Configuration screen now:

  • reads a file with a byte-order mark, a comment before the XML declaration, or a DOCTYPE. These were refused as "not well-formed". The DOCTYPE is dropped, never resolved.
  • tells you what to wrap a misplaced element in instead of claiming the management API cannot set it. A bare <queue> or <anycast> is told to go inside <address>, a lone key such as <max-delivery-attempts> inside <address-setting match="…">, and a <permission> inside <security-setting>.
  • loads a .xml file directly ("Load a file…") as well as a paste.

  Single items — one <address-setting>, <security-setting>, <divert>, <bridge> or <address> — were already accepted and merged into the current declaration; the field's description now says so.

• Stop refusing broker.xml import with 403 (8db0ec5d)

  Importing broker.xml on the Configuration screen now works. The request carried its own content type, and the shared request helper let that replace its default headers — including the CSRF token — so the server refused every import as a cross-site request.

  Any request that sets its own headers now keeps the CSRF token.

• Read back every divert apply, so a dropped transformer fails loudly (cef1783b)

  Broker config now reads a divert back after creating it, as it already did for bridges, and a divert whose transformer did not deploy fails that step naming "transformer class-name" instead of reporting success.

  If you applied a divert with a transformer before 2026.09.30, it was deployed without one (the flat transformer-class-name key the broker accepts with a 200 and ignores; fixed in the routing-builder release). Nothing to hunt for: open Broker config, the divert shows as drift, and one Apply replaces it with the transformer the declaration asks for.

  Creating a divert from the queues screen also compares the transformer now, so an existing divert without one is no longer reported as "already in place".