Space administration and the operations that are hard to undo.
One article here so far, and it is about getting a space back out of Confluence: exporting to a real folder tree that keeps the page hierarchy, and taking only the attachments you want instead of everything ever uploaded. More will follow. Until then this page is not pretending to be a section.
Space-level operations on Confluence Cloud that the UI does not offer.
Confluence Cloud has no built-in way to lock attachments. This walks one file through Sentinel Vault 6.6.0 on a real site: seal it, overwrite it as someone else, watch the sealed version come back in seconds, read both versions in the history and over the REST API, then unlock it. Plus a bug in our own app that we hit while running it.
Confluence data classification needs Atlassian Guard Premium, and admins keep finding that out on the Atlassian Community. Sentinel Vault 6 gives every page a classification level either way: its own levels, levels imported from Jira Service Management Assets, or Confluence's own when your site has them.
Sentinel Vault is one of the Runs on Atlassian apps that review Confluence content with AI. It calls Atlassian-hosted LLMs through the Forge LLMs API, so there is no API key to paste and no external data egress declared. What that buys an admin, who pays for the tokens, how the cost ceiling actually works, and the four places it is weaker than it looks.
An Atlassian data security policy has seven controls, and only one of them works without Atlassian Guard: blocking all Marketplace and custom apps from chosen spaces. This post walks through what each control blocks, what the app access rule really takes away from an app, what the admin API says when you try a Guard control without Guard, and what happens to policies and classification levels on a Data Center to Cloud or Cloud to Cloud migration.
Confluence space permissions after migration break in two directions: people lose spaces and private pages, and other people quietly gain access when groups merge by name. This tutorial gives you a dependency-free Node script that snapshots every space permission, role, page restriction and group member, then diffs the before and after into two lists. Run on a real Cloud site, with the Data Center queries alongside.
Nested bodied macros are the one Confluence Data Center content pattern a Cloud migration cannot carry across intact, and since April 2026 there is no legacy editor left to hide them in. This walks the discovery probe on the Data Center database, the triage against what the Cloud editor actually accepts, a REST probe that shows exactly how Cloud wraps a nest it cannot render, the error string your users will paste, and the repair patterns, with the parts of the script that matter and not the whole thing.
You added emitsReadyEvent to a Confluence macro to speed up PDF export, called view.emitReadyEvent(), and every normal page view now logs "Unable to emit ready event." The shipped @forge/bridge source says why it happened, why it was harmless, and which version made it stop.
Confluence 10.2 ships a 1 GB heap; the Cloud Migration Assistant refuses to be safe below 4 GB and, in its own code, will not start an attachment step above 80% of whatever heap you give it once its memory budget is on. This is the DC-side preparation for a large migration: a heap calculator from Atlassian's node splits, its tested heaps and your GC log, the 32 to 47 GB band to avoid, the Synchrony JVM, the thread-to-pool pairing, the assistant's documented floor and undocumented mechanics, and what Atlassian has actually tested at 102,000 users.
"The request stays available even if I approve it" was a missing else branch. "I cannot tell which image is which" was a 5 MB base64 preview we had hidden to save bandwidth. What users report and what is wrong are rarely the same sentence.
A DC to Cloud migration moves pages. It does not guarantee that what is inside them still works. Here is how to find the broken macros and lost restrictions, repair them with a backup before every write, and prove the fix on the page rather than in the API response.
A semantic hash makes a re-run cheap. Ours also erased a mention's accountId, so two different users hashed the same and a corrected mapping would be silently skipped. Here is the pattern, the bug, and the tests that would have caught it.
Two triggers fired on the release that took us to 4.0.0, not one. I wrote a tool that knew about six of them when the docs list eleven, published a thesis that inverted the truth, and found the correct answer sitting in a comment in the same commit.
Atlassian publishes what each migration tool copies. Turning that page into a scope document takes six steps and one insight most people miss: some things are copied partially, and a tool that reports those as done will cost you the migration.
DC to Cloud spends its budget resolving who everyone is, because usernames do not exist in Cloud. Cloud to Cloud gives you identity for free and a first-party copy tool — then bills you for the specific things that tool does not take.
The @forge/api route template throws on two different mistakes with one identical message. Six steps to tell them apart and fix each, with a probe that prints exactly which characters it rejects in a path and which it silently encodes in a query.
A Forge resolver that takes a page id from the payload and writes with asApp() will write to any page the caller can name. Six steps to gate it, with a test suite that fails 5 of 6 before the fix and passes 6 of 6 after.
Forge delivered one page edit twice, 400ms apart. The duplicate didn't post a second comment — it wiped the 24-hour window that stops second comments. Then I wrote the whole thing up backwards, and the test I built to prove it agreed with me.
Forge gives you no veto over a Confluence save. Product events arrive after the change is already committed, which means a lock on Confluence content cannot prevent anything — it can only detect and restore. Here is what that constraint does to an app: why the restore has to ignore itself, why reverting the whole page is the wrong fix, and why a licence check in a protection app must fail open.
The native HTML export flattens your page tree and renames every attachment to its ID. Here is what the zip actually contains, how to trigger it without a browser, and a v2 API script that rebuilds the tree — including the two bugs that silently ate a page in my first version.