Bug fixes

Selected; the ones whose absence changed behaviour an operator would notice.

Subscriber simulator (CPESIM)

• The demo passes traffic again. CPESIM 0.4.17 shipped without the commands
  that clear stale veth devices before recreating them, so the simulator's
  uplink path came up half-built and the demo onboarded subscribers while moving
  no traffic — ~0 Mbps, with the Simulator page showing subscribers connected and
  reporting no error, because the engine's failure logging had been dropped in
  the same build. 1.4.0-14 pins CPESIM 0.4.18, which restores both, and makes
  a burst that moves no bytes report the reason it already had. Measured on an
  evaluation appliance: 0.001 Mbps before, 1,097 Mbps after.

Sessions

• An unavailable session list no longer renders as an empty one. A failed
  fetch of the session list reported nothing, so the table came up blank and
  silent — indistinguishable from "this box has no sessions". That is the most
  misleading thing the page can say, because the request is most likely to fail
  precisely when there are a great many sessions to return. The page now says
  which it is, and a failed refresh keeps the last good list on screen rather
  than blanking a table you are reading. This makes a failure legible; it does
  not change how the page performs at scale — see Console polling load under
  Known issues.

Snapshots

• A restore now actually restores. Per-block PUTs could only restore what had
  an endpoint a restore could safely drive; the subscriber base, the
  access-interface set and the switch registration had none, so a REPLACE restore
  could not put a wiped box back however many blocks it applied. It now applies
  the controller's whole captured state.
• A restore would have disabled every access port in the snapshot. The
  access-port call sent the wrong key names with no address, which the schema
  rejected — and that rejection was the only thing preventing worse. The field it
  read to decide enabled/disabled does not exist on 1.4.0, so it evaluated false
  for every interface.

Accounting and the ledger

• Three residual ways the daily maintenance could destroy billing data.
• A quarantined billing record is no longer invisible.
• An implausible retention_days is refused rather than silently deleting a year.
• A retained live population no longer starves the drain forever.
• CDRs are filtered in SQL, so an old date range is reachable.
• A failed CDR fetch is distinguished from an empty ledger.

Data caps

• Cross-subscriber leakage in the grant panel.
• Disabling enforcement clears every overlay.
• status() queries hoisted out of the per-subscriber loop.

Controller state

• The retained config history is now bounded (upstream bng#41). Nothing read
  old config revisions, and unbounded growth cost provisioning latency roughly
  tenfold at the same subscriber base — a slowdown that survived a restart.
• Importing as non-root no longer dies on the CA probe.

Console

• The captive-portal portal_ip save no longer erases the walled garden.
• The metrics sampler no longer fetches the whole controller config every tick —
  about 1.9 MB per call at 10,000 subscribers, every five seconds, for a key no
  controller has ever published.
• The cap caption no longer says "Community" on a licensed box, and the sessions
  chart draws the cap line at the cap actually in force.
• AAA faults surface in the alert centre.
• The wipe notice names aaa_source among what was not restored.