These are administrative commands on the hosting machine, not dot commands to send in osu! or Discord. Use the protected admin entry from the currently registered release, as root, with the exact instance selected. An entry from an old release intentionally refuses after upgrade. Get the entry path and artifact hashes from the qualified kit or maintainer; do not guess a release directory.

The examples use $E as shorthand for the complete, instance-bound protected administrator invocation. It must already select the correct installed entry and instance. Do not paste the shorthand until your kit has defined it.

Systemd failure and room ownership are different facts. A stopped old process can leave a failed unit while the authoritative journal and committed recovery receipt report clean ownership. A local start_allowed: false with startup_admission_not_evaluated_by_local_status means status has not performed startup admission. recovery_required is a real recovery hold. Fresh startup still checks identity, client/scopes and ownership; do not treat a valid token alone as permission to start.

Configuration and catalog actions have additional required arguments or protected standard-input schemas. Follow the shipped guide rather than running an incomplete action name. Hub contribution permission is separate from enrollment and sharing consent. Running two controllers on one hosting account is not a supported way to add rooms.

These retained worker actions operate through the registered v7 controller. Signed automatic releases normally use the independent updater instead of manual staging.

$E worker-stage --bundle /path/to/approved-worker.zip --sha256 <runtime-sha256>
$E worker-queue --sha256 <runtime-sha256> --room room1 --room room4
$E worker-status
$E worker-cancel

Omit –room to select all configured rooms. Stage verifies compatibility and writes a root approval bound to this installation; it does not replace the controller. Queue waits for native empty/idle admission, and status reports its durable progress. Cancel affects pending rooms after an active handoff settles. A failed attempt needs explicit requeueing. Completed promotions remain selected after a clean restart.

Shared controller changes use the all-configured-rooms-empty maintenance window. The first v7.1.0 storage migration remains manual and stopped; later compatible signed releases can use automatic delivery. Do not install an owner-only historical controller on a community host.

Ownership, pacing and catalog recovery commands require fresh evidence and exact transaction or journal bindings. Use REPAIR_UPGRADE.md from the actual kit with the maintainer. Do not delete journals, reset state or repeatedly start to escape a hold. systemctl reset-failed only clears systemd's failure marker; it does not prove a room has closed or repair ownership.

Return room links, times/timezone, versions, completed maps, player-visible behavior and redacted support/network/ratings output. For failures include the safe failure code, HTTP status when known, and a short relevant traceback. Never send OAuth credentials/codes/URLs, token files, bound invitations, private state hashes, backups or raw player chat.

Hosting checklist · Hub participation · Updates and recovery

Use the current release’s README and V7_1_1_OPERATOR_GUIDE.md for complete schemas. Missing v7.1.1 policies default to sharing and automatic updates, while saved false values, independent reading, pauses and stopped polling are retained. Local network-start can initialize a missing updater only after enrollment; it does not grant server contribution rights. Private diagnostics are scrubbed and bounded, not publicly visible chat.