v0.44.1

Added

• synapse arm now keeps a worker listener armed across repeated wakes and
  reconnects. The ergonomic syn arm and syn-wait wrappers use this persistent
  path instead of the one-shot synapse wait wake primitive.
• synapse init now prints or installs local user services for the hub, project
  presence, and provider-neutral wake arming. synapse git-init can install/start
  the same services, and synapse doctor --fix prints or applies the exact setup.
• synapse worker-session launches an arbitrary provider command with
  SYN_PROJECT/SYN_IDENTITY set and a cheap syn arm sidecar while the command
  runs.

Security

• synapse a2a-serve now refuses a non-loopback bind unless Bearer auth and
  --a2a-token are configured, or unless the operator explicitly passes
  --insecure-off-loopback. This mirrors the hub's exposed-bind posture for the
  A2A HTTP edge and keeps unauthenticated network exposure opt-in.

Fixed

• The client now classifies multi-address OSError connection refusals as a
  refused hub connection and keeps quiet mode quiet, matching the documented
  non-running-hub behaviour across Python versions.
• Hub-initiated name takeover, takeover-cooldown, and name-conflict closes now
  wait for close propagation when the WebSocket implementation supports it,
  making the coordination edge deterministic under CI timing.
• One-shot query and task CLIs now await client-task cancellation during cleanup,
  avoiding identity reuse races between sequential real-hub commands.
• Real-socket hub tests now handle Python 3.10 timeout semantics and wait for
  observable presence updates before asserting takeover or name-conflict close
  behaviour, keeping the CI matrix deterministic without fake sockets.
• The team launcher now waits after escalating a stubborn child process from
  terminate to kill, so shutdown returns only after the subprocess has exited.

Documentation

• SECURITY.md, README.md, and the benchmark notes now state the current exposure
  and token behavior: metrics tokens use the Authorization: Bearer header by
  default, query-string metrics tokens require --metrics-query-token-ok, A2A is
  documented as a local HTTP+JSON bridge rather than an externally validated
  implementation, and the scalability notes describe the current heap expiry,
  replay, and scope-conflict scan measurements.