v1.0.0-rc.21

1.0.0-rc.21

Fixes

• Persist exact process identities for Stim-owned supervisors, log collectors,
  and managed tunnels instead of inferring host-process ownership through ps.
  Use unique-pid@0.1.1 so permitted process inspection works in macOS
  sandboxes that deny boot-session metadata. Cleanup retains unverified records
  and leaves replacement processes and their device claims alone.
  dfaeae32

Removed (breaking)

• Remove stop --force. Stim no longer terminates externally started Metro
  servers or infers process ownership from a port, command name, or directory.
  dfaeae32

Migration notes

• Stop a still-running legacy supervisor manually before starting a replacement
  when its saved state has no verifiable process token. Externally started Metro
  remains reusable but must be stopped by its owner.
• Process checks and signals are separate OS operations. On macOS, a token
  captured without boot identity cannot distinguish a repeated PID and exact
  start timestamp after a reboot or clock reset. Denied process inspection is
  not treated as proof that a process exited.

QA

Expedited RC authorized on 2026-09-07. Omitted locally before the version
commit: format:check, lint, typecheck, knip, unit tests, test:e2e, test:runtime,
and the pre-tag native/manual matrix. Retained before the version commit:
candidate build, CLI version/help/guide, and tarball inspection. Retained after
push: exact-release-commit CI, including its format, lint, build, typecheck,
knip, unit, cross-platform e2e, and published-runtime jobs.

The included PR passed independent review, 3,602 unit tests, 66 end-to-end
tests, and required CI before merge. Forty collector-ownership and reclaim
tests also passed inside the actual Codex sandbox with the published library.
These checks are not a substitute for the omitted candidate native/manual QA.