[lweberru]

Existing Application orders currently stop working after a Configurator release when their published Accelerator revision differs from the new Runner default. This change preserves execution of reviewed historical sources and adds an explicit upgrade of the same order, project and State instead of asking users to order replacement infrastructure.

The current patched Worker verifies immutable bundled sources, tool/provider locks and payload hashes before releasing credentials. Six reviewed native revisions are supported; withdrawn sources remain fenced. The order shows immutable template origin, desired execution source and last successful Apply source. Upgrades append an audited desired binding only, require a quiescent instance, invalidate old unused approvals and start no Plan or Apply. A fresh Plan and the normal Apply approval remain mandatory. Historical bucket names and proven retained resources survive source transitions; recovery uses the interrupted job source. Reports remain bound to their original opaque Runner ticket across API releases.

The UI, API, database migration 079, packaging and English/German documentation implement the same contract. Source-upgrade Assistant advice uses a fixed, read-only product explanation to keep Plan/Apply and recovery boundaries explicit; unrelated advice remains model-driven.

Validation:

• npm run check: 1,455 passed; 76 environment/optional skips. All database integration tests separately: 96/96 passed. Lifecycle browser coverage: 28/28 desktop/mobile cases. Archived native-source contracts: 72/72 passed across six exact Git revisions.
• Full local Runner packaging passed, including six verified source manifests, 72 native contracts, initial-platform-plan/image/Vault probes and three mandatory packaged-provider checks. Three additional artifact-dependent native validation/saved-plan tests passed. Database coverage includes concurrent upgrade/reservation, tenant isolation, source withdrawal, credential fences, historical naming and recovery gates.
• Real-model qualification: lifecycle 4/4 and Application templates 34/34 passed (two repetitions each), knowledge 2b2e5778aadcf7a6f70256fe8b5a89803b24f993c45e1ad6d021bc714b424834, suite ed612feee06aae62f45e0d927b124753d7c9231af6b35a6e82b9e1556e5c79fc. Earlier failed source-bound qualifications are retained; factual/semantic failures led to fixed production advice. Narrow German paraphrase assertions gained positive regressions; approval, withdrawal and Recovery checks remain mandatory.
• Independent reviews cover database/API, packaging/Worker, UI and mixed historical recovery. No customer Plan, Apply, State write or unlock is part of this PR.

Deployed and independently verified in Dev: qualified release 40721517548, source e8ae8a6b93506500b4b3a93d5e139ed1433a1143, pool size 1. All applicable CI passed, including 430 browser cases. Release qualification passed 152/152 repeated cases and 13/13 continuous-dialogue steps.

Read-only runtime verification confirmed migration 079 and its protected registry, all six native payload/provider-lock hashes, the actual current app/droplet, one live ready Runner and support for the pinned sources of eight existing historical orders. Existing interruption/recovery records and successful follow-up Apply evidence remain intact. No execution upgrade was applied automatically, no customer Plan/Apply was started, and no remote State or lock was modified. The temporary route-free diagnostic app was removed.