Fix frozen v1 session-bound token schema

COMPATIBILITY.md

@@ -6,7 +6,7 @@ New operator-facing names use PastureStack and `PASTURESTACK_*`. Compatibility i
 
 ## Docker host policy
 
-Release `0.183.307` preserves the Docker host policy introduced in `0.183.299`,
+Release `0.183.308` preserves the Docker host policy introduced in `0.183.299`,
 which adds Docker Engine `29.8.0` as an exact supported
 version alongside the preserved legacy ranges, `24.0.9`, and the existing
 `29.4.1` through `29.7.2` interval. It does not widen the interval to admit
@@ -33,11 +33,20 @@ requests and repeated deletes return `204` without an expiry cookie. Unbound
 tokens created by older consoles retain their established delete behavior so a
 rolling upgrade does not strand legacy sessions.
 
-Release `0.183.307` normalizes the authenticated current-token representation
+Release `0.183.308` normalizes the authenticated current-token representation
 before the ownership lookup, so both a cookie's bare key and an
 `Authorization: Bearer <key>` header revoke the same matching session. It does
 not accept another authorization scheme or a malformed multipart value.
 
+The same release updates every shipped frozen v1 schema that exposes `token`
+(`base`, `superadmin`, and `token`). Each snapshot retains `clientSessionId` as
+a nullable password field with exact length 78, create access only, no update
+access, and read-on-create-only semantics. This closes the v1-specific gap in
+which authorization was correct in the dynamic schema but the frozen snapshot
+silently removed the generation before token creation. Server release gates
+must exercise session-bound creation and deletion through both `/v1/token` and
+`/v2-beta/token`; a v2-only runtime check is not sufficient.
+
 When `api.auth.restrict.concurrent.sessions=true`, replacement is protected by
 one distributed lock per token account and authenticated account. The Engine
 compares the fixed-format generations, rejects a delayed older or unbound
@@ -51,11 +60,11 @@ it does not replace the cookie, grant access, or appear in URLs. The Web Console
 must keep JWT material out of Web Storage and hold its cross-tab mutex through
 the complete explicit-delete response before clearing its local state.
 
-The token authorization overlay must retain `clientSessionId` as a
-read-on-create-only input. Removing it from the public token schema turns every
-new login into an unbound legacy token even when the Web Console supplies a
-valid generation, so schema authorization is covered by a shipped-overlay
-regression test.
+The token authorization overlay and every frozen token schema must retain
+`clientSessionId` as a read-on-create-only input. Removing it from either API
+surface turns new logins on that path into unbound legacy tokens even when the
+Web Console supplies a valid generation. Separate regression tests therefore
+cover both the dynamic overlay and the deserialized frozen snapshots.
 
 ## External identity types
 

README.md

@@ -9,8 +9,8 @@ PastureStack is an independent community effort to preserve, audit, and moderniz
 ## Project status
 
 The current public GitHub Release
-[`v0.183.307`](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.307)
-produces engine version `0.183.307`. It retains the existing Java 25, Ubuntu
+[`v0.183.308`](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.308)
+produces engine version `0.183.308`. It retains the existing Java 25, Ubuntu
 26.04, Maven, Liquibase, MariaDB/MySQL, WebSocket, dependency, concurrency, and
 runtime-hardening work from the maintained compatibility line. Release builds
 consume the exact `5.7.4` runtime JAR published by
@@ -21,11 +21,18 @@ product identity and provenance are carried by the artifact name, metadata,
 SBOM, and release evidence. Provenance and scope are documented in
 [`third-party/HAZELCAST.md`](third-party/HAZELCAST.md).
 
-Release `0.183.307` fixes session-bound logout for both cookie and standard
-`Authorization: Bearer` transports. Current-token discovery preserves the
-transport representation, so the delete path now normalizes it to the database
-key before checking session ownership; other schemes and malformed multipart
-values remain fail-closed. It also retains the integrated project-member
+Release `0.183.308` completes session-bound logout for both v1 and v2 API
+clients. The frozen v1 `base`, `superadmin`, and `token` schema snapshots now
+publish the same fixed-format, sensitive, create-only `clientSessionId` input as
+the live schema. Without that snapshot update, `/v1/token` silently discarded a
+valid browser generation and created an unbound legacy token even though the
+dynamic authorization overlay was correct. A regression test deserializes every
+frozen schema that exposes `token` and checks the complete field contract.
+
+Current-token discovery also preserves the transport representation, so the
+delete path normalizes both cookie keys and standard `Authorization: Bearer`
+values to the database key before checking session ownership; other schemes and
+malformed multipart values remain fail-closed. It also retains the integrated project-member
 identity fix from `0.183.306`. The reviewed external identity list lives in the
 IAAS API packaged defaults
 that production Archaius startup actually loads, and the core schema factory
@@ -35,7 +42,7 @@ clean runtime without a Compose override. Base and configured options are
 merged in stable order without duplicates. `0.183.305` contained the schema
 ordering fix but left the reviewed list only in the installer resource, so it
 is superseded for this contract. This release retains
-the browser-session ownership, fixed-format create-only `clientSessionId`,
+the browser-session ownership and fixed-format generation validation,
 unknown identity rejection, and provider-state restoration introduced in
 `0.183.304`; deployment overrides remain dynamic without becoming required
 defaults.
@@ -103,7 +110,7 @@ dependency line. The existing platform JSON surface remains on
 `com.fasterxml.jackson` 2.22. Packaging gates admit only the reviewed,
 version-pinned pair and verify that their class namespaces are disjoint.
 
-Host compatibility is evidence-based. Release `0.183.307` preserves the legacy ranges and Docker Engine `24.0.9`, retains the bounded `29.4.1` through `29.7.2` interval, and supports exactly `29.8.0`. It does not admit unverified `29.7.3` or `29.8.1`, or Docker 25 through 28. The frontend marks versions above the configured newest version as *untested*, not *supported*. Every Server release that consumes this policy must still pass its Ubuntu 26.04 host and installed firewall-backend runtime acceptance gate.
+Host compatibility is evidence-based. Release `0.183.308` preserves the legacy ranges and Docker Engine `24.0.9`, retains the bounded `29.4.1` through `29.7.2` interval, and supports exactly `29.8.0`. It does not admit unverified `29.7.3` or `29.8.1`, or Docker 25 through 28. The frontend marks versions above the configured newest version as *untested*, not *supported*. Every Server release that consumes this policy must still pass its Ubuntu 26.04 host and installed firewall-backend runtime acceptance gate.
 
 The build and Dapper images still compile the Docker `29.7.2` CLI from the pinned official tag commit with Go `1.27.0`; the CLI tool version is separate from the Docker daemon host support setting. They do not import Docker's precompiled Go `1.26.5` binary. The source archive SHA-256 and Go builder image digest are enforced by the source gate and the resulting images are scanned before release.
 
@@ -151,7 +158,7 @@ The gate performs dependency-hygiene checks, builds every Maven module with JDK
 To create the complete release archive after the gate passes:
 
 ```sh
-ENGINE_VERSION=0.183.307 bash scripts/build --release
+ENGINE_VERSION=0.183.308 bash scripts/build --release
 bash scripts/check-release-artifact dist/artifacts/cattle.jar
 ```
 

code/framework/api-pub-sub-jetty/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/api-pub-sub/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/api/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/archaius/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-meta-parent</artifactId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../meta-parent/pom.xml</relativePath>
     </parent>
 </project>

code/framework/async/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/auditing/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
 

code/framework/db-loader/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/deferred/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/encryption/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/engine/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/eventing/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/events/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/extension-spring/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/extension/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/java-server/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/jmx/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/jooq/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/json/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/launcher/pom.xml

@@ -4,7 +4,7 @@
 	<parent>
 		<groupId>io.cattle</groupId>
 		<artifactId>cattle-parent</artifactId>
-		<version>0.183.307</version>
+		<version>0.183.308</version>
     <relativePath>../../parent/pom.xml</relativePath>
 	</parent>
 	<dependencies>

code/framework/lock/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/logback/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-meta-parent</artifactId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../meta-parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/managed-context/pom.xml

@@ -4,7 +4,7 @@
   <parent>
     <groupId>io.cattle</groupId>
     <artifactId>cattle-parent</artifactId>
-    <version>0.183.307</version>
+    <version>0.183.308</version>
     <relativePath>../../parent/pom.xml</relativePath>
   </parent>
   <dependencies>

code/framework/metrics/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/module/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/object/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/pool/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/resource-monitor/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/schema/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/server/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-meta-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../meta-parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/spring/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/system-task/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/token/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.307</version>
+        <version>0.183.308</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>