v0.50.3

v0.50.3

Emergency patch. Fixes a crash that could take down the AFT process under multi-session load, plus a scheduler responsiveness defect found in the same investigation.

Crash fix: condvar panic in the hashline binding registry

Since v0.50.0, the hashline binding registry held one process-wide condition variable but waited on it with each session's own mutex. The first session's wait bound the pair; a wait from any second session then crashed the whole process (attempted to use a condition variable with two mutexes). The trigger is a multi-session teardown burst — daemon restarts, route churn, or resource-pressure storms — which is why the defect stayed latent until one such storm hit. The registry now keeps a per-session mutex/condvar pair. Regression fence: draining_two_sessions_uses_each_sessions_mutex_partner.

This crash affected daemon-supervised (subc) deployments; standalone NDJSON bridges host one session per process and could not hit the two-session shape.

Scheduler responsiveness under sustained load

The executor's scheduler loop drained its event stream without a bound while holding scheduler state, so a sustained burst of wakes could starve everything else contending for that state — including health probes, which reported hours of contention before the crash above. Event processing is now capped per lock acquisition, with excess wakes carried to the next turn. Regression fence: scheduler_event_batch_leaves_excess_wakes_for_the_next_lock_turn.

Also included

• Glob edit targets format each matched file again (deterministic cross-platform ordering for equal-mtime results, verified natively on Windows).
• Test-infrastructure hardening from the same window (fixture warm-exec on macOS, governed-manifest refresh).