Interface FleetSettlementContext

True only when an earlier successful settling write durably recorded this exact key on the fleet record. False includes the re-fire window where settle() succeeded but that write was lost, so false is never proof of a first delivery. Hosts must deduplicate on settlementKey and may use this field only for logging or alerting.

Proof of what is routed, read after the promotion converged.

Optional-normal, and its meaning is defined per entry: on 'migration', 'platform-only', and 'ready-convergence' it is the release this one replaced, where the deployment still retains it; on 'rollback' it is the release being ABANDONED, so a host reversing its own effects reverses the right one. Absent whenever no prior release is retained.

Identifies this settlement by what was settled — the deployment and the target release — not by when it happened. Every retry of the same settlement carries the same key, which is what makes at-least-once delivery safe to deduplicate on.

The release now serving traffic, and the only deployment identity settle() may depend on.

That limit is forced, not stylistic: on the convergence entry the prior release has already been retired by the time any settlement point is reached, and the plain backend retains no prior release at all. A host that needed the outgoing release to compute what it settles would work on some entries and silently misbehave on others.

On a backend that retains no release snapshots this is synthesized: its script name, specification digest, and artifact version are the attestation's, but releaseSchemaVersion and application are copied from the control-plane record — this deployment's belief about what it deployed, not something the provider confirmed.