fastcached v0.2.0

What's Changed

⚠️ Breaking changes

• node: the cache tier serves this machine, and no member list changes that by @christianparpart in #369

Features

• Say why a dependency path did not reach the compile-cache key by @christianparpart in #113
• Grow a cluster's Raft quorum at runtime, without restarting its members by @christianparpart in #110
• fastcache-compile-node: the leader learns what each member's cache holds by @christianparpart in #137
• fastcache-compile-node: a fleet dashboard, served by the leader by @christianparpart in #138
• Discover the machine's toolchains at compile-node startup by @christianparpart in #151
• Show what a toolchain is, beside the fingerprint that identifies it by @christianparpart in #219
• The fleet dashboard can now list the leases it counts, not just count them by @christianparpart in #222
• Dashboard history: eight windows to twelve months, surviving restarts and elections by @christianparpart in #227
• node: every port it opens is a row, and an opener takes the surface by @christianparpart in #359
• node: the worker's settings are a file, read through the one option table by @christianparpart in #399
• node: the scheduler verbs take an inbound credential, checked before the payload by @christianparpart in #409
• Verify one cache hit in N against a fresh compile by @christianparpart in #424
• A node serves its cache tier while it identifies its toolchains by @christianparpart in #428
• Six refusals answered correctly and counted nothing by @christianparpart in #430
• Compiles arrive on the merged 0xFC surface too by @christianparpart in #446
• A reactor listener can adopt an inherited descriptor by @christianparpart in #464
• One 0xFC listener: the node retires its dedicated compile port by @christianparpart in #467
• feat(net): notice a worker whose host went away, and say which happened by @christianparpart in #520
• A node reloads what it can, and names everything it cannot by @christianparpart in #533
• feat(node): a swept connection says which window it outran, and is counted once by @christianparpart in #525
• node: a toolchain change is reloadable, and re-registers with the fleet by @christianparpart in #590
• A worker learns the scheduler term from authentic grants, and refuses a deposed one by @christianparpart in #616
• A worker notices a client that left, and stops writing an object to nobody by @christianparpart in #669
• A dispatched compile pulses Status::Progress while it runs, so an idle bound of seconds can sit under a total that stays minutes by @christianparpart in #730
• A worker says once when it is refusing every grant on the scheduler term by @christianparpart in #768
• feat(testing): a flake-qualifying idiom that keeps a tally by @christianparpart in #936
• feat(node): say something about every client exchange, at a level chosen per verb by @christianparpart in #992
• feat(node): the compile-argument allowlist extends from configuration, and reloads by @christianparpart in #1020
• feat(node): the credential and the member list both reach a running worker by @christianparpart in #1028
• A node mints its own identity, and consensus is decided by --listen-raft by @christianparpart in #1043
• A worker can retire a toolchain it no longer serves by @christianparpart in #1091
• feat(launcher): say which kind of decline, so an operator knows what to fix by @christianparpart in #1094
• Let a site say its translation units are long by @christianparpart in #1120

Bug fixes

• Fix needless re-elections when a follower loses contact with the leader by @christianparpart in #107
• cc,testclient: two review findings the launcher and the test client were carrying by @christianparpart in #114
• Refuse to cache a compile whose paths are neither keyed nor guarded by @christianparpart in #108
• Log the consensus term and what deposed a leader by @christianparpart in #123
• net: a listening socket keeps its address to itself on Windows too by @christianparpart in #127
• Name the path and the reason when a translation unit gets no direct-mode manifest by @christianparpart in #121
• macOS/Windows: let the compile worker install itself as a service by @christianparpart in #120
• Retire the cached manifests that can still direct-hit a drive-relative compile by @christianparpart in #150
• cluster: a discovery node answers from an address of its own by @christianparpart in #156
• Fix a healthy cluster re-electing while a follower still had a leader by @christianparpart in #152
• distributed: a peer that cannot name itself in UTF-8 cannot break /fleet.json for the fleet by @christianparpart in #160
• Emit MutationKind::Expire and ::Evict, and make NotifyingStorage's header true by @christianparpart in #163
• Convert an old on-disk store instead of refusing it as corrupt by @christianparpart in #165
• Refuse an unusable registration at install time, not at every boot by @christianparpart in #169
• Claim a CoW store file exclusively, so two processes cannot corrupt it in silence by @christianparpart in #161
• Fix clang-cl fingerprinting differently under a service than in a developer prompt by @christianparpart in #164
• build: say so when the compiler-cache fallback can produce a wrong build by @christianparpart in #171
• docs,fastcached: say what a shared sccache backend costs, where it is offered by @christianparpart in #182
• Fix a compile node reserving memory for a cache tier it never built by @christianparpart in #185
• Reclaim and report a key whose TTL lapses and which nothing touches again by @christianparpart in #184
• Fix nine defects verified from a mis-scoped master review by @christianparpart in #189
• node: the consensus tier's command-line refusals belong in the policy tables by @christianparpart in #190
• Fix a node frame endpoint answering only one request per connection by @christianparpart in #205
• Fix cache hits and remote compiles that ignored the compiler's target by @christianparpart in #192
• cc: every MSVC toolset keyed as the string "cl", so one served another's objects by @christianparpart in #204
• Fix non-ASCII arguments being mangled on Windows, which the fleet then refuses by @christianparpart in #193
• Fix a Windows service that could neither report a failure nor restart from one by @christianparpart in #211
• Report the RAM a cache tier's key index costs by @christianparpart in #218
• distributed: 0 compiling forever, and the operator's own build rendered as somebody else's by @christianparpart in #217
• node: a listen flag's grammar belongs in the policy table, not in the tier that binds it by @christianparpart in #216
• cluster: a member the fleet cannot name is refused at every door that can refuse one by @christianparpart in #199
• The scheduler never resolved a lease, so every dispatched key was pinned for ten minutes by @christianparpart in #221
• A chart that rendered as a broken image, and the clang-cl nothing looked for by @christianparpart in #224
• Refuse a toolchain fingerprint computed from a probe that never ran by @christianparpart in #228
• A worker serves its slots at once, not one at a time by @christianparpart in #231
• A machine with no shared cache has not failed to reach one by @christianparpart in #233
• No CMake + MSVC compile was dispatchable: /TP was refused, so the fleet distributed nothing by @christianparpart in #234
• node: a membership policy belongs to the node, not to its scheduler by @christianparpart in #250
• cc: a compile is bounded by how long a COMPILER runs, not by a round trip by @christianparpart in #253
• node: a machine's toolchains are re-derived, not fixed at startup by @christianparpart in #258
• A cluster's members are one route to admission, not the whole policy by @christianparpart in #261
• Vet a compile job's arguments against an allowlist, not a path-shape denylist by @christianparpart in #263
• Check a codec envelope's declared expansion before believing it by @christianparpart in #266
• Measure how far a registration's endpoint is from its caller, and fold the mapped form where membership is decided by @christianparpart in #268
• A declared count is a claim about bytes, checked before anything is sized by @christianparpart in #270
• Bound the worker's drain, so a stop states what it abandons instead of waiting for SIGKILL by @christianparpart in #276
• A set's member count is a claim about bytes, and a client chooses the flags by @christianparpart in #295
• A stream's declared counts are refused, not clamped, and the bound cannot be omitted by @christianparpart in #309
• node: the byte budget charges what a request costs, not what its frame is long by @christianparpart in #277
• cc: a worker's reply codec is the CLIENT's list, and no list is a literal by @christianparpart in #278
• An envelope refusal answered on the wire and counted nowhere by @christianparpart in #298
• distributed: a lease grant is a signed credential, and its MAC covers the worker it names by @christianparpart in #313
• cc: a cache that did not answer is not an answer about the fleet by @christianparpart in #328
• cc,node: a value stored through a node kept the producing checkout's paths by @christianparpart in #335
• node: a scratch root is claimed exclusively, so two nodes on one host cannot trade objects by @christianparpart in #334
• node: the cache tier refused AUTH with a code the launcher treats as fatal by @christianparpart in #341
• node: a cache port the operator named is a promise the whole way through by @christianparpart in #348
• cc: a NotLeader refusal is an instruction, and the launcher followed none of it by @christianparpart in #338
• actions/labeler replaces the whole label set, whatever sync-labels says by @christianparpart in #350
• A worker checks the lease it was handed, and says which check it can do by @christianparpart in #342
• node: a worker follows the leader redirect it was already being told by @christianparpart in #353
• node: the scheduler and compile ports refuse AUTH the way the client expects by @christianparpart in #367
• ci: the local gate pins its analyser, and checks the pin against the cache by @christianparpart in #378
• A COMPILE reply is correlated with the request that asked for it, or refused by @christianparpart in #373
• cache: a client's malformed value moved the disk-failure signal on a healthy store by @christianparpart in #381
• A decoder that borrows says so, or owns — and which one is per type by @christianparpart in #392
• tests: a registration that starts the daemon is guarded on the daemon existing by @christianparpart in #391
• node: a stranger's frame is refused before its payload is read by @christianparpart in #394
• node: a scheduler settles the leases it issued, whoever leads now by @christianparpart in #400
• tests: a placed clock is read from a thread the case does not own by @christianparpart in #407
• cc, node: an ignored credential is reported on every path, not just the cache one by @christianparpart in #411
• A stacked pull request produced no build check runs at all by @christianparpart in #419
• Thirteen hygiene checks reported PASSED whatever they found by @christianparpart in #426
• A lease grant names the fleet and the term that issued it by @christianparpart in #422
• The worker killed to test SIGTERM was still leasable, and case 12 got the corpse by @christianparpart in #429
• Restore the serialisation of the fixture's three toolchain walks by @christianparpart in #433
• The cheapest probe against a worker left the series flat by @christianparpart in #432
• Two defects behind #388: a quorum proposal that outlives its term, and a node that cannot say what it counts by @christianparpart in #436
• A leader that has lost quorum contact never stepped down by @christianparpart in #438
• Release discarded the lease token's own key claim by @christianparpart in #439
• A pin and an unstampable probe were spelled the same way by @christianparpart in #459
• A compile no longer holds endpoint budget for its whole duration by @christianparpart in #461
• a shutdown drain that counts its polls does not know what it waited by @christianparpart in #470
• net: an IOCP completion outlives the object that submitted it by @christianparpart in #476
• fix: a handler freed earlier in a dequeued batch is no longer dispatched on by @christianparpart in #480
• build: the tsan gate proves instrumentation from the objects, not the runtime by @christianparpart in #477
• build: the tsan canary is judged by a rate, not by a green run by @christianparpart in #478
• The local gate builds through no compiler cache, and checks that it did by @christianparpart in #486
• fix(node): the merged listener's refusals are answered and counted by the surface that owns them by @christianparpart in #490
• fix(node): --log-timestamps, and a signature that makes omitting it a compile error by @christianparpart in #500
• fix(test): the refusal check globs src/ instead of a hand-kept file list by @christianparpart in #503
• FASTCACHE_VERIFY compared objects byte-for-byte, so every Windows hit reported a wrong object by @christianparpart in #504
• fix(test): a Catch2 SKIP is scored as skipped, not as a failure by @christianparpart in #505
• Map debug paths so a replayed object names no checkout by @christianparpart in #508
• fix: stamp log lines by default where nothing else stamps them by @christianparpart in #511
• Hygiene checks traverse each directory once, not once per file pattern by @christianparpart in #509
• Three hygiene checks could be silently truncated by one unbalanced bracket by @christianparpart in #514
• Two file(STRINGS) readers went blind on one bracket and kept passing by @christianparpart in #519
• No cmake -P check may emit CMake warnings, and the guard is shown to refuse by @christianparpart in #528
• A dead template failed -Werror whenever the compiler cache missed by @christianparpart in #539
• Decide every cache-surface refusal: four counted, six argued uncounted by @christianparpart in #551
• Pin the canonicalization spec to the generation byte that names it, and refuse a value from another one by @christianparpart in #555
• node: refuse a worker that registers loopback with a remote scheduler by @christianparpart in #567
• Bound every dependency transfer, so a stalled fetch ends instead of hanging by @christianparpart in #566
• migrate-storage-e2e: wait for the store count the caller asserts, not for the first file by @christianparpart in #577
• A red local-gate run names every leg, including the ones it never reached by @christianparpart in #586
• tidy-sweep: register the scope self-test in the default ctest set by @christianparpart in #599
• tidy-sweep: a unit that produced no code is not evidence about its file by @christianparpart in #604
• The tidy sweep database is configured the way CI configures it by @christianparpart in #612
• launcher: a dispatch axis in --show-stats, so a fleet that stopped helping is visible by @christianparpart in #621
• config: reloadability is a column of the daemon's option table by @christianparpart in #624
• A swept connection says why, from the one writer that owns the socket by @christianparpart in #631
• A foreign value generation gets its own wire code, on both 0xFC servers by @christianparpart in #647
• test: wait on the stage a node reaches, not on its bind by @christianparpart in #651
• compile-cache: one predicate answers "is this path under this root" (#562) by @christianparpart in #656
• A cmake -P script states its policies, and a check requires it by @christianparpart in #676
• WaitReadable reports which kind of readable, not merely that it is by @christianparpart in #681
• A dispatched compile records the compilation directory a local one records by @christianparpart in #667
• compile-cache: -c on clang-cl left the marker on the /EP probe line by @Yaraslaut in #689
• Hold the operator port docs to NodeSurfaceTable, both directions by @christianparpart in #686
• EOF means finished-sending, and ShutdownWrite is on ISocket by @christianparpart in #690
• compile-cache: carry whether dependencies were observed, never infer it by @christianparpart in #693
• Wait for the refusal tally instead of sampling it by @christianparpart in #701
• Arm keepalive on the compile leg, where #247 meant it to be by @christianparpart in #695
• compile-cache: ask the probe in English, and take its dependency set by @christianparpart in #702
• tsan-gate: bound through run_bounded, deleting a fallback that never ran by @christianparpart in #704
• A service registration carries what the operator named, not what differs from a default by @christianparpart in #705
• compile-cache: one toolset keeps one identity across Visual Studio UI languages by @christianparpart in #714
• A SIGHUP reassembles the configuration instead of re-reading the file, and the three L1 codec settings get flags by @christianparpart in #719
• Make the daemon's readiness, bind-failure and refusal-counter signals say what they mean by @christianparpart in #722
• The in-memory socket retrieves a parked read, so a wait at teardown is not a leaked coroutine by @christianparpart in #731
• Fix the ~1%-flaky readiness ordering assertion #722 merged by @christianparpart in #733
• A gate that does not report reads as a gate that passed (#684, #687) by @christianparpart in #721
• Name the readiness markers in a table, and stop calling the node's a bind by @christianparpart in #742
• Bracket exposure is per (reader, file, surviving lines), and two of the readers were silent (#518, #517, #510) by @christianparpart in #745
• The node's startup refusals live in one table, and --print-surfaces reports them by @christianparpart in #749
• Name the selftest case that failed, and keep the evidence past the next run by @christianparpart in #750
• Refuse an --advertise naming this machine at a port the node does not serve by @christianparpart in #754
• A clustered scheduler waits for consensus before it claims leadership by @christianparpart in #762
• Warn when a secret comes out of a configuration file anyone on the machine can read by @christianparpart in #746
• The advertise-port rule judges a port the operator NAMED, not a default by @christianparpart in #772
• doc-subject-checks' self-test asserted through a racy | grep -q (#766) by @christianparpart in #775
• Compiler-cache seam: honour an empty FASTCACHE_ADDR, give the gate its own build directories, and join the version-mismatch fallback to its hazard by @christianparpart in #783
• Two awaitable-lifetime defects nothing could reach: a dead local, and a watcher settled too early by @christianparpart in #764
• The shipped compile-node unit names a working directory, and one it creates by @christianparpart in #786
• Two instruments that could not report correctly on their own subject by @christianparpart in #795
• Spend the lease grant, and let a dispatched object name the client's source by @christianparpart in #811
• Two configurations that behaved differently depending on what touched the tree last by @christianparpart in #818
• A vanishing client's departure is waited for, not raced (#691, #776) by @christianparpart in #821
• A rulebook entry that has gone false, and a scan that could not read the file that broke it by @christianparpart in #827
• Reap what the selftest starts, and bound the listener that outlived every run (#839) by @christianparpart in #842
• fix: unblock gate-gcc-release under GCC 16, three at the source and two by fatality by @christianparpart in #847
• Make the TERM-ignoring stand-in one process deep (#839) by @christianparpart in #844
• Close a connection that never sent anything instead of answering it 400 by @christianparpart in #834
• sccache is never selected for you, and a refused daemon is announced by @christianparpart in #823
• A worker learns its fleet from its registration, not from its configuration by @christianparpart in #853
• A bound that could not resolve the gap it was measuring (#678) by @christianparpart in #848
• Make a reactor's teardown rule askable of every reactor by @christianparpart in #855
• Bound every unbounded call in the notarize hook by @christianparpart in #863
• Give the seeded machine-wide config an access list of its own by @christianparpart in #865
• Warn about every file a secret lives in, on both binaries and at every reload by @christianparpart in #862
• Let a dispatched compile write the /showIncludes prefix its build expects by @christianparpart in #882
• Free a frame endpoint's listener with its reactor stopped (#840), which is what #737 was by @christianparpart in #890
• A dispatched object records the paths a local one records: the scratch root, the daemon directory and the source name by @christianparpart in #886
• Post the peer server's closes onto its reactor (#885), and ask the teardown rule on every reactor by @christianparpart in #900
• An empty read buffer is refused, and a blocking read retires its readability watch by @christianparpart in #904
• Ask about every file a secret lives in on BOTH binaries, and at every reload on both by @christianparpart in #898
• A /showIncludes note the grammar cannot see is a stored value carrying the producing checkout by @christianparpart in #905
• The readiness announcer states the seal, not just the count by @christianparpart in #911
• One parser decides whether --advertise names a port by @christianparpart in #912
• Split the admin surface's two request-head deadlines by @christianparpart in #914
• A Windows service is the machine-wide instance, not an administrator by @christianparpart in #915
• fix(ci): read the machine-wide config as root now that it is 0640 by @christianparpart in #916
• fix: a decided cache outcome carries no transport failure, and jobs_started-minus-completed is not in-flight by @christianparpart in #922
• fix(core): the storage source tag owns its bytes, and meta ms keeps its own across a suspension by @christianparpart in #920
• fix(node): report and count the compile node's persistent write failures by @christianparpart in #923
• fix(scripts): make the documented gate invocation work, and unbreak rulebook-open-work on master by @christianparpart in #921
• fix(gate): a reference build refuses a compiler that IS the cache by @christianparpart in #926
• fix(admin): ask, join, then close — the admin listener teardown race by @christianparpart in #924
• fix(e2e): the bound-outcome helper stops answering "finished" for a record it could not read by @christianparpart in #928
• fix(win): clear the clang-tidy-windows findings, the last red on master by @christianparpart in #925
• fix(cmake): -Werror no longer depends on the pedantic warning set by @christianparpart in #927
• fix(ci): check that a workflow's script invocation agrees with its file mode by @christianparpart in #929
• fix(compile-cache): tag GNU diagnostics with a grammar that can see their paths by @christianparpart in #934
• fix(node): refuse a cache the operator NAMED when no surface can serve it by @christianparpart in #940
• fix(launcher): a /-rooted layout is not walked where / is drive-relative by @christianparpart in #939
• fix(cmake): bound every configure-path subprocess, and guard that they stay bounded by @christianparpart in #948
• fix(cache): the expiry sweep reads a TTL without inflating the value by @christianparpart in #945
• fix(node): a clustered scheduler needs no --fleet-member by @christianparpart in #941
• fix(ci): a third-party apt source can no longer fail a Linux job by @christianparpart in #935
• fix(ci): resolve the rulebook's open-work entries where the verdict gates master by @christianparpart in #960
• fix(protocol): a blocking read's waiter is unregistered when its frame is torn down by @christianparpart in #953
• fix(net): a write-slot discipline, mirroring the read slot by @christianparpart in #955
• fix(node): refuse an --advertise clients cannot dial by @christianparpart in #961
• batch: the $planting mask mirrors PlantingRights, and a case that pins ClosedLocally by @christianparpart in #959
• fix(cache): bound the expiry sweep by measured cost, not by entry count by @christianparpart in #964
• batch: eight hygiene and tooling tickets on one CI cycle by @christianparpart in #952
• fix(launcher): a cache-flow fall-back must say which continuation it takes by @christianparpart in #954
• fix(node): a toolchain sweep that changed nothing narrates itself at Debug by @christianparpart in #996
• fix(node): a heartbeat round no longer reports itself as a registration by @christianparpart in #1000
• fix(launcher): a cache refusing every request says so, once, whatever the verbosity by @christianparpart in #1001
• fix(cache): the expiry sweep runs on an injected executor, not on the reactor by @christianparpart in #1002
• feat(node): a peer this node cannot speak to is named, once, at Warn by @christianparpart in #1004
• fix(storage): the free list is persisted in dedicated pages, so a restart reuses freed space by @christianparpart in #1005
• fix(net): a negative peek is a departure, not pending data by @christianparpart in #1009
• fix(storage): a reopened store knows its own size, so --cache-disk is enforced by @christianparpart in #1010
• fix(node): a disk-only node holds back what its key index costs by @christianparpart in #1011
• fix(storage): eviction reaches entries the session never touched by @christianparpart in #1015
• fix(ci): the closing-keyword refusal names both causes, not just the likelier one by @christianparpart in #1014
• fix(ci): judge rulebook entries against what the pull request itself closes by @christianparpart in #1017
• fix(build): the gate read its build directory from a variable that is not there by @christianparpart in #1037
• A reactor frees the await chains it will never resume by @christianparpart in #1044
• A borrowed wall clock refuses a temporary, at the parameter rather than the store by @christianparpart in #1046
• Three gate and CI guards: header filter, stale mode claims, unguarded prerequisites by @christianparpart in #1049
• A line ending in a backslash no longer swallows the line below it by @christianparpart in #1059
• An empty file list is a refusal, not a clang-format failure by @christianparpart in #1065
• Tell a survey that was refused from one that could not be asked by @christianparpart in #1072
• The required-contexts check no longer kills its own producer by @christianparpart in #1076
• fix(consensus): a leader is not deposed by the member it has just admitted by @christianparpart in #1082
• fix(packaging): retire compile-node.env from installed systems on upgrade by @christianparpart in #1081
• The reloadable column reaches a checker, in both directions by @christianparpart in #1069
• fix(scheduler): count the release that says a lease bound is too short by @christianparpart in #1086
• fix(e2e): the silence probe reads what ENDED a read, not a stepping clock by @christianparpart in #1077
• fix(test): the fast-path cases drew a verdict from a clock that can be stepped by @christianparpart in #1096
• fix(scripts): a killed hygiene check no longer reports as a failing one by @christianparpart in #1101
• fix(test): the fast path's healthy end was never re-derived, so the ceiling could stop separating silently by @christianparpart in #1113
• fix(consensus): CheckQuorum consults the committed configuration while a change is in flight by @christianparpart in #1117
• fix(test): the fixtures' bounds are monotonic, so a stepped clock cannot cross them by @christianparpart in #1121

Performance

• cc: the toolchain walk reads 345 MB before a worker can accept a job by @christianparpart in #364
• node: bind the compile port before walking the toolchain, not after by @christianparpart in #412
• A fingerprint hands back what it was computed from by @christianparpart in #453
• Diff-scope the clang-tidy sweep inside the merge queue, and put a reader on the master push by @christianparpart in #569
• A ccache step saves on a branch push and nowhere else by @christianparpart in #789
• perf: batch of four -- FindIfOrNull, PathCanon root folding, ByteCursor conversion, upstream address reuse by @christianparpart in #1018

Documentation

• Move the AGENT.md rulebook into .agent/rules/ by @christianparpart in #106
• docs: the distributed pages described a layout two releases old by @christianparpart in #207
• docs: a page that explains the thing, not just its flags by @christianparpart in #209
• docs: the fleet's own side of a compile, and every connection it makes by @christianparpart in #230
• docs: the team protocol is a guide, the board is the issues by @christianparpart in #294
• A tool that reports success for work it did not do, from the authoring side by @christianparpart in #345
• docs: caching an expensive repeated answer is a principle, and safety decides it by @christianparpart in #356
• docs: skipped, absent, unstarted and failed are four states by @christianparpart in #374
• docs: pairwise clean is not serially clean, and the scratchpad is shared by @christianparpart in #393
• An empty or unexpected value must not be sorted into a named outcome by @christianparpart in #515
• docs: two more ways the gate reported on the wrong tree, and the form they share by @christianparpart in #521
• docs: an instrument that edits its subject, and a stale checkout that corrects you confidently by @christianparpart in #527
• docs(rules): three constraints, and the general form that explains them by @christianparpart in #530
• docs: a ctest total counts only the target set it was configured with by @christianparpart in #532
• docs: what an operator does when a store reports Corrupt by @christianparpart in #579
• docs: the expensive CI event is the PR being open, not the push by @christianparpart in #585
• Documented command lines that start, and a check that keeps them starting by @christianparpart in #600
• docs: the PSK signing seam's tripwires reach the files a session reads by @christianparpart in #659
• docs: two rulebook entries — an unobserved dependency record, and a reconstructed identifier by @christianparpart in #703
• docs: a report is a set of claims about state, and every one of them decays by @christianparpart in #708
• docs: the operator page promised a repair that fsync does the opposite of by @christianparpart in #727
• docs: the fsync exposure is one commit wide, not permanent by @christianparpart in #728
• Record three ways an instrument reports on something other than its subject by @christianparpart in #757
• The read-slot rule kept its conclusion and lost its reason by @christianparpart in #758
• Carry the positive-control rule to typed probes, and state the rule five green tests were instances of by @christianparpart in #777
• Stop asserting byte-order-qualifier's cost, and point at the conditions instead by @christianparpart in #773
• A counterfactual must be re-run after a refactor — a refactor can move what it was catching by @christianparpart in #798
• A census over corrected prose must classify, not count by @christianparpart in #803
• docs: the SECONDS reading has a one-second band, and it falls on the safe side by @christianparpart in #851
• Prefer attempting the action over reporting the last read (#531) by @christianparpart in #850
• A retraction reaches people; the artefact goes on asserting by @christianparpart in #852
• State the /showIncludes channel once, and mark the cl half unverified (#825) by @christianparpart in #856
• Two doc transcripts that had drifted from the binaries they quote by @christianparpart in #913
• docs(rules): retire the #260 open-work entry, and correct #316's premise by @christianparpart in #932
• docs(config): the memory-compression rows refuse reload deliberately, not by default by @christianparpart in #931
• docs(rules): retire #724's open-work entry, and keep the rule it carried by @christianparpart in #987
• batch: four docs and test tickets on one cycle (#265, #831, #175, #181) by @christianparpart in #989
• docs(storage): the free-list walk finds nothing, and say so where the reach is described by @christianparpart in #991
• fix(docs): measure the cl /showIncludes channel, and it is neither answer by @christianparpart in #983
• docs(node): the fleet-setup page recommended a flag the launcher refuses by @christianparpart in #997
• docs(storage): repoint the Open work entry at what survived #990 by @christianparpart in #1007
• docs(operations): a fleet upgrade is a flag day, and say so before the rollout by @christianparpart in #1019
• docs: compile-cache-testclient is internal QA infrastructure, not a shipped tool by @christianparpart in #1034
• A conflicting pull request is a fourth door to the never-arrives failure by @christianparpart in #1073
• docs(rules): verifying the fact a check is about is not verifying the check by @christianparpart in #1107

Internals

• Make outbound connections coroutine-aware and non-blocking by @christianparpart in #102
• net: sever Net/ from Core/, and make the boundary a test by @christianparpart in #109
• Add a label taxonomy, categorized release notes, and PR auto-labeling by @christianparpart in #115
• Guard every enum-indexed table the same way, and fix the six that failed open by @christianparpart in #118
• Remove the PathCanon error type nothing could produce, and the wire code nothing could send by @christianparpart in #119
• Test the two premises #140's MSVC fingerprint fix rested on by @christianparpart in #157
• Measure test coverage in CI and put the figure on the README by @christianparpart in #158
• ci: cut the critical path from 28.6 minutes to one that is not a single job by @christianparpart in #256
• ThreadSanitizer runs in CI, and proves it ran before believing itself by @christianparpart in #314
• cc: the corrupt-payload refusal has a case, not just a table row by @christianparpart in #321
• A docs-only change reports every required check without building anything by @christianparpart in #329
• A bounded wait that cannot say which failure it was is half a guard by @christianparpart in #343
• Windows builds a Debug leg, and proves its checked runtime is live by @christianparpart in #344
• tests: a cumulative CPU figure cannot say what a process is doing now by @christianparpart in #358
• ci: every required check reports inside a merge_group, or the queue stalls by @christianparpart in #361
• tests: a compile fleet that runs in one process, and the first thing it caught by @christianparpart in #375
• tests: report descendant evidence over the whole wait, not only the window by @christianparpart in #389
• ci: build a real target through the launcher and run its tests by @christianparpart in #382
• node: a stall in the toolchain survey says which phase it stopped in by @christianparpart in #398
• wire: a verb's payload ceiling is its own, and a row that omits it does not build by @christianparpart in #410
• node: pre-payload admission answers on the verb as well as the peer by @christianparpart in #413
• node: the credential gate answers on the verb as well as the surface by @christianparpart in #414
• node: the toolchain hash reports its rate while it runs by @christianparpart in #417
• node: a refusal is counted against the surface whose verb was refused by @christianparpart in #415
• e2e: the stop bound is the drain the worker was started with by @christianparpart in #420
• node: remove the username nothing parses from NodeConfig by @christianparpart in #418
• node: the cache and scheduler verbs share one 0xFC listener by @christianparpart in #416
• Cover re-election after an admission, and stop misreporting it by @christianparpart in #434
• One place arms a deadline that closes a socket by @christianparpart in #440
• A cache root nested inside another root by @christianparpart in #441
• The compile accounting moves out of the accept loop by @christianparpart in #442
• The dispatch deadline and the lease timeout are one number by @christianparpart in #443
• Nothing proved a flag that parses also merges by @christianparpart in #444
• The distributed e2e now dispatches from an address that is not loopback by @christianparpart in #445
• Seven copies of one wait, and a bound nobody measured by @christianparpart in #458
• An IocpListener destroyed without Close releases its socket, and now says so by @christianparpart in #468
• test: a byte-order call cannot be scope-qualified, and now a check says so by @christianparpart in #474
• test: cluster-e2e bounds its probe, and a probe that did not finish says so by @christianparpart in #481
• Pin the hollow-manifest failure #368 turned out to be by @christianparpart in #524
• test: put every leader-pinned mutating command to whoever leads now by @christianparpart in #529
• What CI costs, measured per event, with the conditions attached by @christianparpart in #546
• One signing seam for the cluster pre-shared key, with a required domain label by @christianparpart in #578
• node: state each surface's bind-failure policy, and why, in one place by @christianparpart in #609
• distributed: CallerContext owns its peer id instead of borrowing it by @christianparpart in #620
• coverage: find python3 with the lookup that runs it by @christianparpart in #610
• test: pin the free-list damage refusal the operator page promises by @christianparpart in #635
• test: dist-compile-e2e.sh takes the shared e2e helpers by @christianparpart in #641
• sccache-backend-caveat measures itself instead of asserting a margin by @christianparpart in #664
• A case that could not run is skipped, not passed by @christianparpart in #694
• test: pin what one damaged meta slot actually costs, and the diagnostic the page quotes by @christianparpart in #718
• test: correct the claims the meta-slot fixtures and their rulebook entry were making by @christianparpart in #739
• A scope default is accepted per flag, so a service can be file-configured without also claiming a storage path by @christianparpart in #740
• HealthProbe takes the ports it is given, and the vanishing-client wait says which failure it was by @christianparpart in #744
• Socket-activate the compile node in a fixture that runs in seconds, and record that #401 does not reproduce by @christianparpart in #781
• Check the daemon's shipped reference configuration against its option table, and fix the duplicate listeners block it finds by @christianparpart in #771
• The corrupt-store page's verbatim diagnostics are asserted by something (#633) by @christianparpart in #787
• Three CI-hygiene tickets: a permissions floor, one sweep table, and a measurement that does not reproduce by @christianparpart in #788
• Check the node's documented series against what it actually renders (#553) by @christianparpart in #802
• Pin the interpreter every script test runs under, and measure what it was by @christianparpart in #809
• Three gates that could not render a verdict: tsan-gate per target, local-gate on a signal, and a rulebook table's own total by @christianparpart in #812
• A case that can see the distinction the serving-wait message draws by @christianparpart in #836
• Gate the set of translation units no analyser sees by @christianparpart in #857
• docs(rules): retire the #723 open-work entry, closed by its own fix by @christianparpart in #947
• docs(rules): retire the #174 open-work entry, closed by its own fix by @christianparpart in #956
• docs(probes): commit the MSVC /showIncludes measurement, unrun by @christianparpart in #962
• docs(rules): repoint the dialled-address entry at an OPEN issue by @christianparpart in #969
• docs(protocol): record the RST route ArmDisconnect's uncovered list omits by @christianparpart in #963
• test(net): measure what WaitReadable answers for an abortive close, on every platform by @christianparpart in #1003
• Check that the Tools page names exactly the installed set by @christianparpart in #1047
• Pin the bound that keeps a timer-parked connection off the drain ceiling by @christianparpart in #1056
• Say what Attach guarantees, where a reader infers it wrongly by @christianparpart in #1067
• Show the teardown drain's loop red on a reactor that owns descriptors by @christianparpart in #1071
• The macOS package fixture keeps the reason the job gave by @christianparpart in #1063
• test(consensus): pin the bare-quorum admission, and say at the site why _admitted is never cleared by @christianparpart in #1088
• test(node): FrameEndpoint's bounded waits go through WaitFor, and four comments match their contracts by @christianparpart in #1097
• test(ci): derive the unguarded-prerequisite audit instead of running it by hand by @christianparpart in #1110

Other changes

• compile-cache: a bare root is its own trailing separator, on both sides by @christianparpart in #593
• Triage the scheduler's and daemon's 0xFC refusals: nineteen sites, and the backlog assertion that follows by @christianparpart in #606
• fix: ArmDisconnect reads the count, so a graceful close is detected by @christianparpart in #707
• fix: the page store owns the meta-slot alternation, not the caller by @christianparpart in #748
• fix: a reserved generation range tells a moved framing from an opaque blob by @christianparpart in #760
• fix: draw the migrate fixture's port from below the ephemeral range by @christianparpart in #763
• fix: a launchctl timeout reports what it measured, and the XProtect reaper kills its group by @christianparpart in #782
• fix: give PreprocessedInputSpelling::language an initialiser by @christianparpart in #767
• Trim the master push and stop pull requests filling the Actions cache by @christianparpart in #785
• fix: the node's service argv emits on provenance, not on value by @christianparpart in #801
• clang-tsan and clang-asan-ubsan become required contexts by @christianparpart in #832
• Analyse the _WIN32 half: a Windows clang-tidy leg, scoped and unrequired by @christianparpart in #869
• fix(scripts): no pipefail script pipes into grep -q, and a scan keeps it that way by @christianparpart in #972
• batch: a dispatched gcc object keeps its source name, and one LLVM install serves two grammars by @christianparpart in #971
• fix(node): the addresses a node DIALS are judged for shape, each by its own grammar by @christianparpart in #973
• batch: five CI tickets on one cycle (#974, #774, #866, #966, #965) by @christianparpart in #988
• fix(packaging): one reference configuration, every platform by @christianparpart in #1021
• The closing-keyword check re-runs when the body it reads is edited by @christianparpart in #1050

Full Changelog: v0.1.1...v0.2.0