Who is Enterprise for?
Operations teams managing recovery objectives, operator roles and change evidence need to know which node may write and who requested an action.
Enterprise adds fenced active–standby operation, identity-governed commands, durable audit, support workflows and lifecycle packaging to Max.
When may the standby take traffic?
The external fencing/router layer must exclude the old writer, acquire a new term and complete durable replay on fresh local rings. The full stack becomes routable only when the node and shard are ready and the current writer term is owned. Heartbeat and liveness can detect suspicion; they cannot grant ownership.
You supply the fencing/router authority, PostgreSQL, identity service and deployment-specific recovery procedure. A node comprises nginx, its local broker/bridge processes and local rings; traffic moves between whole nodes. Read HA operations and the Enterprise skill.
How are operator changes reviewed?
The panel and direct HTTP API share the same authenticated origin, verified roles and live backend scope. Governed workflows cover node drain, selected bridge drain, configuration preflight and redacted support evidence. Configuration preflight checks an existing staged reference; applying it remains the controlled deployment process.
Retain exact intent, idempotency key and command/audit IDs. Acceptance stays pending until the daemon records matching reconciliation evidence. Role, configuration or fence changes invalidate an open confirmation. The API skill explains observation and lost-response recovery with your chosen agent/tools.
What does the operating commitment cover?
The service unit is an active–standby pair for the same workload.
The selected agreement covers artifact access, updates and priority support, with initial response targets of four hours for P1 and 24 hours for P2.
Infrastructure, identity, PostgreSQL and provider costs remain part of your deployment. Review the exact terms at checkout.
Helm/CRD/fleet workflows preserve external ownership and readiness. Their presence cannot grant a writer term. Current scope excludes active-active broker operation, horizontal broker sharding and managed cloud service. Cross-version upgrade/rollback needs an explicitly qualified compatibility path; preserve that gate before selecting an upgrade.