Reference / Release notes

Opal 2.3.0

A Troubleshooting page that watches switches, access points and clients as they run, a terminal and remote desktop from the console, passkeys and security keys, the Steward tier and a port view you edit in place. Circuits is retired, and the database’s last old table names change, so 2.3.0 can’t be rolled back to 2.2.1; the backup taken before the update brings you back.

Release notesReleased October 26, 2026All releases

New

Network › Troubleshooting. An Operator or above starts a watch of up to 10 switches, 20 access points and 5 followed clients, for 15 minutes up to two hours by default. Switches are sampled every 30 seconds over one held session each. A watch shows its findings, a lane for each switch and access point, what stayed quiet, and each client’s sessions as a timeline. Watches never take more than half of Cenovel’s SSH sessions, and they stay within a Juniper Mist call budget that refuses a watch with the numbers rather than going over. On by default.
A terminal on the switch page. Open terminal gives Operators and above a terminal for show commands only: changes, restarts, erases, hops to another device, ping and traceroute are refused and never sent. It signs in with a read-only terminal credential or the person’s own switch account, used once and never stored. A session ends after 10 idle minutes or an hour in all, two per switch, and every command and its output is audited. Off until a District Administrator turns on Terminal on the switch page in Settings › System › Features.
A full terminal on the switch page, off until a District Administrator turns on Full terminal on the switch page, which needs the terminal on. The terminal opens full screen over the page, and every key goes to the switch, so its own prompts, paging and line editing work. Operators and above sign in with the read-only terminal credential or their own switch account; only District Administrators use Cenovel’s write account, and the switch and your TACACS+, RADIUS or ISE decide what the account may do. Before a line that restarts, erases, changes the stack or the configuration, or hops to another device is sent, Cenovel holds Enter and names what it affects; restarts, erases and stack changes need the switch’s name typed. Cenovel offers the switch’s own undo where it has one (the IOS-XE revert timer, Junos commit confirmed). Opening one needs a key touch or a fresh sign-in, each session is recorded (never a password) and kept 90 days, and the configuration read before and after is compared in Changes made.
Remote desktop for Windows servers, in the browser: Open remote desktop on the server page, for Operators and above, once a District Administrator turns on Remote desktop on the server page in Settings › System › Features. You sign in to Windows in the window; the password goes from your browser to the server and is never stored. Nothing runs beside Cenovel to do it. Clipboard, drives and printers stay off; a session ends after 15 minutes without input or 8 hours in all, at most two per server and one per person on each server; opening one needs a key touch or a fresh sign-in. Sessions are not recorded: who opened which server, when, from where, how long and how it ended is in the audit trail. Open a server’s remote desktop
Passkeys and security keys. People add keys on their Account page, and a key is asked for at sign-in and before risky changes: device changes and firmware, people and page rules, the license, sign-in and security settings. District Administrators always need a key; a setting on Access makes every tier need one. A passkey added in 2.3 can sign a person in by itself from the first screen. Ten single-use recovery codes come with the first key, and a District Administrator can reset another person’s keys. Sign-in and access
Account › Sessions lists every browser you are signed in on, from where and when it was last used, with Sign out this session and Sign out all other sessions. A District Administrator signs a person out everywhere from their drawer, or everyone else from Security › Overview.
Stop device communication. From Security › Overview, a District Administrator stops every connection to devices by hand, with a reason. It is audited and announced like an automatic stop.
The Steward tier, between Operator and District Administrator: everything an Operator does, plus the shared lists (categories, locations, manufacturers, models, statuses and funding sources, port profiles, the district standard, approved versions and support dates, and guides). A Steward never changes people, sign-in, the license, backups, security or credentials. Map a directory or Microsoft group to it like any other tier. Sign-in and access
The switch page’s port view is edited in place. The configuration bar is always under the faceplate; the picked ports’ fields open under it with no mode to enter; ports picked across stack members and both faces read Mixed where they differ; and one Save sends what is held. A plain click adds a port to the selection, and a plain click on a picked port takes it out. Leaving with unsaved changes asks first, and change progress opens in a large dialog. Change a switch port
Bounce and Cycle PoE are operations, not configuration changes: one confirm, sent at once, and a message says what the switch did.
Stack changes, on Cisco IOS-XE stacks, Junos Virtual Chassis and Extreme Switch Engine stacks. A Steward or District Administrator sets a member’s priority, makes one member the preferred primary, or admits a replacement unit. A District Administrator renumbers a member, swaps two members’ numbers through a spare one, or copies a Switch Engine stack’s settings to a node; these restart members one at a time and need the switch’s name typed. The preview says whether the switch undoes the change by itself, which members restart and for about how long. Cenovel never switches a stack over or restarts the primary, and a member that hasn’t rejoined 15 minutes after its restart stops the change as timed out. Each change is offered on a platform only once proven against that platform’s emulated stack; the switches’ own prompts and restart times are still to be confirmed on real stacks, so try a change on a lab stack before turning this on. Off until a district turns on Change stacks from the switch page, which also needs switch changes on. Change a stack
Monitoring credentials by purpose: Switch SSH, Switch SNMP, Switch terminal (read-only), UPS card, Server, Juniper Mist and ExtremeCloud IQ. Each is scoped by platforms, sites and subnets and is never used for another purpose. Test a credential on one device, and each device names the credential that reads it. Weak options are off unless you choose them, and then carry a Weak tag.
Smart-UPS network cards. Cenovel reads the card’s own settings, read-only, and checks them against the district standard: time from NTP, SNMPv3 only, alert receivers, the battery date against the install report, and whether the card sees its UPS. It trusts a card’s SSH host key on first contact in listed subnets; a changed key waits for a District Administrator. The APC Smart-UPS SMT, SMX, SRT and SMTL models have drawings.
A UPS install report files its unit in one step, from a wide drawer with a read view. Each site has a Battery backups tab: tiles, then each unit by closet with its reading, where a failed read, a silent unit and a missing address each read differently.
Customize Home: each person picks Home’s cards from a fixed set, their order and width, and up to six figure tiles. Your week stays first, and a card for a page the person can’t open is never offered. Start your day from Home
Arrange sidebar: each person orders and hides pages within each sidebar group, from the account menu. A hidden page is still found by the sidebar filter.
Connected licensing is built in: an appliance can activate and renew a signed lease from the Cenovel licensing service. Nothing changes on an appliance that isn’t set up for it, and Cenovel says when an install should be enrolled. Licensing
Automations and scripts: someone other than whoever saved an automation publishes it (on by default, and available for scripts); publishing and turning on the terminal, scripts, automations, locator lights or a connection beyond the district asks for a key touch or a fresh sign-in; and an automation runs the script revision it was published with.
Settings › Security › Log forwarding sends the audit trail to your syslog receiver over TLS (RFC 5425), optionally only security and sign-in entries, optionally with diagnostics. The receiver’s certificate is always checked, and a client certificate is optional. The appliance holds up to 50,000 entries while the receiver is away; past that it skips the oldest, tells the receiver how many, and audits the skip.
Security › Overview lists every automation, script, watch, collector, notification channel and API token, with who changed each last and when, and what Cenovel may do on devices right now and why.
One terminal look. Both terminals and Device logs sit on a deep blue field that fades to near-black, with a dark input band at the foot and a cyan cursor. Every color reads at 4.5:1 or better from top to foot.
Colors as you type. In both terminals the command line is colored as you type it, and so is every past command line: the command, its keywords, interfaces, VLANs and other numbers, IP and MAC addresses, quoted text and filters, for IOS-XE, Junos, Switch Engine and Fabric Engine. A line Cenovel will hold or refuse shows its command in orange, or in red for a restart, an erase or a stack change, before you press Enter; these colors come from the same rules that hold Enter. In the full terminal the colors are drawn on your screen only; what is sent and recorded is unchanged. Turn them off for this browser in the terminal’s More menu.
Device logs color each message’s severity: errors and worse in red, warnings in orange, the rest muted. Nothing else in a log is colored.

Improved

A refined look: cards are the background’s blue titanium a step lighter, with a lighter head band and a soft light from above; corners are squircles, easing into each curve, where the browser draws them; and every rounded edge is one clean line, with no fill showing under it.
Buttons and field boxes wear one lighter outline: a fine hairline over a lifted face, fields with a clear base line, a neutral hover apart from pressed, a red edge on an invalid field, a dim label on a disabled button, and small buttons at one height with the pickers beside them.
Sharper up close: icons draw one even stroke at every size and sit level with their words, lines and marks land on whole pixels, the switch faceplate stays crisp, split bars and meters show clean gaps, and the keyboard focus ring is never cut off and stands out clearly on every surface, the side rail and header included.
More cards draw what they say instead of listing it: closet devices, access point radios, configuration changes, monitoring credentials, automations and their runs, a battery backup’s due items, contract renewals, E-Rate cycles and budgets, alert rules, connectors, license history, malware scanning and controller connections. Home’s figure tiles split OS versions into approved, to upgrade and unknown, show battery due dates, and show the week’s resolved outages.
Registers show every row of their page: the card grows with the page, the page scrolls, and the column header row stays in view.
Whether a switch answers ping and whether Cenovel can read it are two facts, each with its own mark and time. A switch that refused Cenovel’s sign-in is drawn as refused, not as not answering Cenovel.
Home counts the devices that answer the one-minute checks. With those checks off, it gives the figure from the reads and says so.
The switch page’s compliance card is called Compliance, since it judges firmware and switch templates as well as ports.
The sidebar and header are one color in both themes. The light background is brighter, dark drawers sit on the header’s color, and the account icon matches the other header icons.
Now and Changes sit at the foot of every page that has them, page head actions appear only where they can act, and a page opened anew starts at its top.
Picking ports or diagram parts never opens the side panel. Port details, Part details or Details opens it, and it then follows the pick.
One sign-in layout for every method: the directory first, then a security key, Microsoft and the recovery account, with the brand in one place.
A project is one long page led by where it stands and the next step, with On this page beside it and no tabs. Old addresses open the matching part. Projects
Asset tags is a tab of Inventory.
Lists draw what they hold. Changes, service history, terminal sessions, moves and other dated lists are timelines; Bookmarks, Recently opened, saved views and a device’s guides are lists you open from; an outage’s Hardware and environment card shows each fan, supply and PoE budget under the stack member it belongs to; a server’s temperatures are levels toward their limit; and a reading Cenovel doesn’t judge carries no mark.
Signing in arrives through a brief opening screen on the sign-in scene, then the console fades in.
The dark background carries the sign-in screen’s soft white light from the top left, under the sidebar and header too.
Automation proposals check the switch’s forwarding table before picking a port, and say so when it disagrees with the neighbor name.
The console opens on the sign-in screen’s own look, and signing in with Microsoft shows the same brief Signed in screen.
Home › Your week marks an overdue item as needing a look.
Stack roles use each platform’s own words (Active and Standby on Cisco; Primary, Backup and Linecard on Junos; Primary, Backup and Standby on Switch Engine), the same on the Stack slots card and in the stack change drawer.
On a server page with Cenovel’s remote desktop on, the .rdp file is Download .rdp file in More; the Host address row stays on one line.
Signing in goes straight to the Signed in screen, with no flash of the previous screen.
Pickers and segmented controls match the buttons beside them, and stray outlines in light mode are gone.
Lifecycle tiles say what they count. The support runway names its dates in words (Support ends 2026, End of life 2027) and marks today.
Inventory tags say No support and End of life instead of abbreviations.
Project board lanes are flat, and the battery backup register keeps its controls on one row.
Chart series with no judgment are drawn in grays, so they no longer outweigh warning colors, and a figure in a warning or danger color draws its meter in that color.
Registers lock their column header row under the console header as you scroll, and keep it in step when the table scrolls sideways.
A register's sideways scroll cue is a thin, quiet shade on the side with more columns, shown only when there is more.
Register columns open at sensible widths for what they hold: headers stay on one line, long values end in an ellipsis with the full value on hover, and Reset columns restores the defaults.
Inventory rows are one line at the standard register height, Not recorded no longer looks like data, and the red edge on a row is explained as E-Rate funded and announced to screen readers.
On a site's network equipment, Role, Closet and Model read in full at 1280, State shows only when a device isn't answering, and each row has one quiet More.
Outages state each fault once, with its severity in words for screen readers, and give the year only for another year.
Lines and text are crisper in light mode, on a slightly deeper Platinum field, and lines are a step crisper in dark mode.
Saved views show their description in its own column, so every row is one line.
A funding source or line count that isn't recorded looks different from recorded data.
Reports › Saved: Schedules and Delivery history rows are one line, and a schedule's rule and a copy's reason have their own column with the full text on hover.
Reports: the table behind a chart fits its card at 1280 with no sideways scroll, a row's records open from a quiet icon button, and groups with nothing recorded read as Not recorded.
Light is the default theme for a browser with no saved choice; anyone who chose a theme keeps it.
In light mode, the sign-in column is the same dark color as the header and sidebar, with the white Cenovel mark.
Opening a port's details on a switch is quicker.

Fixed

A read that got no answer no longer dates a switch’s poll, so an old answer never outranks the one-minute checks’ silence.
An outage’s Hardware and environment card no longer says a switch was not answering Cenovel when the switch answered after a timed-out check.
Health risks on a network Cenovel has never polled, and an access point nothing has checked, say Not polled yet or Not checked yet instead of a clean result.
A switch change that stopped partway always ends: failed at once if nothing was sent, timed out after three tries otherwise, and audited. The switch page follows open changes until they end.
Canceling a change’s timer waits up to 75 seconds for a free connection to the switch, so a checked change is not left unsaved.
Ask now says a recent read in the past, in your time zone, with the switch’s name.
Removing someone’s access updates their Effective access tab at once.
A picker option’s name stays whole when its hint runs long, and an alert delivery’s failure reason stays inside its cell.
Deployment settings no longer break when the console’s HTTPS reading fails; it says so.
A second press of a control that opens details right after closing it is no longer ignored.
Cards on Security › Overview no longer jump down as the page loads.
A switch that Find devices bound to SSH now says it is read over SSH wherever Cenovel lists what it polls, as it is, instead of SNMP whenever an SNMPv3 credential was active.
A scheduled or manual backup could, rarely, finish and report success with an empty database dump inside it, when the dump ended while the console was busy. A backup now reads the dump from its first byte and refuses one with nothing in it, so a backup that reports success holds the database.
The Sites directory marks a site healthy only when none of its switches is down or refusing Cenovel and it has no open outage.
The Security Controls figure counts what its legend counts.
Dates no longer break across lines, and the vendor case board leaves out the current year.
The public demo names each model's real maker.
Under Docker Compose, cenovel check and the deployment and production checks run inside the console container again.
During a database outage, the console's log says so once a minute instead of several times a second.
Consoles installed before October 4 no longer warn at every start that a content template changed, and can create content pages again.
The upgrade script uses an exported COMPOSE_PROJECT_NAME instead of the default stack.
The deployment check and the audit archive use the configured database port.
Lifecycle dates show the year and month they were recorded with in every time zone, so a support date of January 1, 2027 no longer shows as 2026.
Seeded end-of-life dates name their source as the Operator end-of-life list instead of an abbreviation, and existing records are renamed when you update.
Open consumables on the automations page opens Storage › Consumables; it did nothing before.
The project timeline scrolls sideways inside its rounded card instead of clipping at the corners.
When the database stops answering, the console replies that it is temporarily unavailable instead of leaving pages waiting, and recovers on its own once the database is back.
Restarting or updating the console no longer leaves a lasting “no recent heartbeat” warning in Settings › Execution; a stopped background process reads Stopped.
The runtime check says when a server runs a Node version older than this release needs (24.18.1).
With a switch SNMP credential set to retry, the one-minute checks waited too long on a silent switch, so a not answering outage could open late.
The switch page's port bar says what a click does: a click adds or removes a port, and Shift picks a run.

Security

Recovery codes carry 80 bits in four groups of four and are stored only as salted scrypt. Codes made before 2.3 still work once.
A certificate check weakened by the deployment is marked Weak on its setting, with the reason, and Security counts it together with unverified servers.
Releases, update bundles, OS updates, malware signatures and collector releases can be signed through a chain: an offline root per purpose certifies a short-lived online key, and a signed revocation list can withdraw one. The appliance refuses a file signed for another purpose. The earlier single signing keys stay trusted through 2.3, so installs from before 2.3 keep updating.
Fixes from a review against ASVS 5.0: audit rows and sign-in lockout use the address the trusted proxy added; outbound requests never follow a redirect; signing in on a browser that holds a session ends the old one, and signing out clears the browser’s data for the console; an erased person’s sessions end at once; and a download named outside Latin-1 works.
The request body parser is updated to 1.20.9 for advisory GHSA-27r3-jxmh-p828.
Each release carries a CycloneDX 1.7 bill of materials, checked against its schema on every build.
The appliance’s clock keeps time while outbound traffic is held: the firewall always lets its own time servers through on UDP 123, and nothing else on that port. They are the ones DHCP hands out and any set in Settings › System › Deployment › Appliance clock, which says whether the clock is synchronized and when it last was. Under Docker Compose the host sets the clock.
The appliance firewall refuses outbound traffic from the first boot: before the console hands over its first allowlist only name lookups and time leave, and after that only what Settings allow. Refusals are recorded, shown on What Cenovel talks to and audited, with Allow it beside each. Record-only mode and destinations allowed by hand need a key touch or a fresh sign-in.
HSTS is sent for a year with subdomains by default, but only while people reach the console with a trusted certificate; never with the certificate the appliance makes for itself.
Each sign-in address is tied to the account that signs in with it: the Microsoft tenant and object id, or the directory’s objectGUID. A different account arriving with the same address is refused, audited and shown in People, where a District Administrator keeps refusing it, allows both, or moves access to it. Sign-out, erasure and key checks act on the account.
Published automations and scripts carry a seal; one changed outside Cenovel won’t run until it is republished.
Adding or changing a notification channel or webhook asks for a key touch or a fresh sign-in; pausing automations no longer does, and resuming still does.
Explore reads only through its read-only database account in production, and says so when that account is missing.
The collector service runs under a system-call filter, and image and release builds run only reviewed install scripts.
An unexpected error no longer shows its internal message: the console gives a reference to find it in the logs.
cenovel-agent verify says UNSIGNED and fails on an unsigned tree unless --allow-unsigned is given.
Remote desktop needs Network Level Authentication and TLS 1.2 or newer, reaches only recorded Windows servers inside your listed networks on TCP 3389, and pins each server’s certificate the first time; a changed certificate stops the session until a District Administrator trusts it.
Errors from notifications, page rules, history, design, diagnostics, the sidebar, preferences, lifecycle standards and switch polling give a reference instead of internal details.
A key touch or a fresh sign-in is asked for however a request names the address, so another spelling of the same address can’t skip it. Connecting the license, trusting one device’s key or one server’s certificate, and giving an API token security read now ask for one too.
Before anyone signs in, the console tells them only how to sign in: it no longer says whether a recovery account is set up, a console with no sign-in set up refuses a password exactly as it refuses a wrong one, without naming its settings, and connections that ask to become something the console doesn’t offer are closed instead of held open.
The full terminal holds a risky command however it is ended or shortened (wr er, req sys reb, comm), waits for the switch’s prompt before taking more typing, so a password typed ahead is never recorded, and keeps and audits commands with their secrets masked.
Remote desktop reads a browser’s channel request exactly where Windows does, so a modified client can’t turn on clipboard, drive or printer redirection.
A watch on Troubleshooting names no wireless client, in its findings, timeline or evidence, to someone who can’t open Endpoint finder.
Erasing a person also clears them from watches and terminal and remote desktop sessions, and removes their security keys and recovery codes.
Log forwarding refuses a receiver that is the appliance itself, however its address is written.
The full terminal holds a save on IOS-XE (write memory, wr, copy run start and their short forms), as the guide and the window say, and a Junos save to a file in configuration mode.
A shutdown is held at any configuration level, including after interface range.
A full terminal’s recording of a District Administrator’s session downloads only for District Administrators. Other recordings download for the person who ran the session, Auditors and District Administrators, and for a Steward only when the session ran at or below the Steward tier. Changes made says who a recording is for instead of offering one you can’t have, and every download, or refusal of one, is audited with whose recording it was.
The release SBOM and the dependency check cover the packages bundled into the browser console, such as React, the terminal, the editor and the passkey client, so a high or critical advisory in one stops a release as it does for the server.
The malware scanner’s image, and the image release builds run in, are pinned by digest like the database and web server images, and a check refuses any third-party image named by tag alone.
An automation’s or a script’s seal stays on the server: the pages and the API say whether a revision runs, never the seal itself.
The step-up check reads an address exactly as the console routes it, so a raw request with a fragment, an encoded digit or a word sent as a list can’t skip it.
Your browser no longer fills your Cenovel sign-in into a switch's credential fields or any other device credential, so a saved console password can't be sent to a network device.
Sign out everywhere also revokes the API tokens the person made, and Sign out everyone can revoke every API token too (the dialog asks, on by default).
People: a District Administrator can see a person's API tokens and revoke one, after confirming who they are.
A Microsoft sign-in ends within 5 minutes of the account being blocked or deleted in Entra ID. This needs the Microsoft Graph application permission User.Read.All; without it, sessions continue and the audit trail says the check didn't run.
Resetting a person's authenticator signs them out, and sign-outs and blocks after too many attempts are recorded in the audit trail.
A session stays tied to the browser it signed in from, even after a restart.

Upgrade notes

Back up first, and check the backup. On the appliance, Settings › System › Updates takes one for you; under Docker Compose, run the backup script before you pull. Backups
2.3.0 is one way. The update gives the last database tables under the old prefix the Cenovel name, in one step, and 2.2.1 can’t start on the renamed database, so a rollback from 2.3 to 2.2.1 is refused. The way back is the backup taken before the update, restored under 2.2.1: on the appliance with cenovelctl restore apply and --previous-release while 2.2.1 is still on it, otherwise on a fresh 2.2.1 VM; under Docker Compose with the restore script. Upgrades and rollback
Any Opal 2 release updates straight to 2.3.0, with no release in between: on the appliance from Settings › System › Updates, and under Docker Compose with the usual steps or the upgrade script. Docker Compose installs take the new docker-compose.yml.
Several database changes, all applied in this one update: UPS install report fields and card settings, circuits removed, connected licensing, security keys and recovery codes, troubleshooting watches, the license cutoff, terminal sessions and full terminal recordings, credential scope, an API token permission, key-only sign-in, each sign-in address tied to its account, the locator lights setting, seals on automations and scripts, remote desktop sessions, and the table names.
Circuits is removed. The update deletes every circuit and provider record, so export any you need first. A connection’s free-text circuit field stays and is searchable, and the old Circuits address opens Sites.
District Administrators need a passkey or security key from 2.3. Open the console by its DNS name, not an IP address, because keys work only with a name. At the first sign-in after the update, a District Administrator without a key gets one sign-in that can only add a key. The recovery account never needs one.
There is no grace period after a license ends: at the end of its last day, Cenovel stops polling, device connections and outbound traffic, and the console becomes read-only until a renewal is entered. Sign-in, the license, updates, backups and log forwarding keep working. Check the license’s end date in Settings › System › License before you update.
The update keeps each monitoring credential’s coverage and splits one that served two purposes into one per purpose. A credential that needs a look says Check this credential.
An automation’s latest revision must now be published by someone other than whoever saved it; turn this off on the Automations page if one person runs them. Automations saved before 2.3 run the current published script until they are saved again.
API tokens act at most as a Steward.
People stay signed in across the update, and older console backups still restore beside the new ones.
Webhooks and evidence downloads now send only the Cenovel headers: Cenovel-Event, Cenovel-Delivery, Cenovel-Signature, Cenovel-API-Version and X-Cenovel-Evidence-SHA256. The deprecated headers under the former product name are gone, so update any receiver that still reads them before you update.
Docker Compose: settings under the former product name are read for the last time in 2.3, with one warning at start-up naming each one. Rename them to their Cenovel names now.
Troubleshooting is on after the update. The terminal, stack changes and connected licensing stay off until someone turns them on; connected licensing needs details that Cenovel supplies.
The appliance asks only time servers someone named: the ones DHCP hands out, and the ones set in Settings › System › Deployment › Appliance clock. Debian’s public servers are no longer a fallback. If your DHCP hands out none, set one there after the update; until then the card says the clock is not synchronized.
An appliance that is updated keeps the outbound allowlist it already holds. Each sign-in address is tied to the one account that has signed in with it, and sessions open during the update are tied on their next request.
Locator lights now start off on new installs and work only while Let Cenovel change switch ports is on. Installs that already used them keep the setting, and also need switch changes on.
Automations and scripts published before 2.3 are sealed during the update.
Remote desktop is off after the update.
Under Docker Compose, the way back from 2.3.0 is to restore the backup taken before the update under the rollback image that the upgrade script names, with the restore line it prints at the end. A restore under the new image brings the backup forward to 2.3.0.
Run the restore drill on your most recent backup after the update. Before 2.3.0, a backup could rarely hold an empty database dump while reporting success; the drill shows whether yours holds the database.