v1.5.0

pg_hardstorage v1.5.0

See CHANGELOG.md for the full release notes.

Changelog

• eaccc61: Merge remote-tracking branch 'origin/dependabot/go_modules/go.opentelemetry.io/otel/exporters/otlp/otlptrace-1.45.0' (@postgresql007)
• 9bd1c86: Merge remote-tracking branch 'origin/dependabot/go_modules/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp-1.45.0' (@postgresql007)
• 843cd25: Merge remote-tracking branch 'origin/dependabot/go_modules/go.opentelemetry.io/otel/sdk-1.45.0' (@postgresql007)
• 3870cd2: Merge remote-tracking branch 'origin/dependabot/go_modules/google.golang.org/grpc-1.83.2' (@postgresql007)
• d4d4aba: Revert "fix(llm): give the model the negative half of the --repo question" (@postgresql007)
• 9976db2: build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace (@dependabot[bot])
• 9eb84b7: build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (@dependabot[bot])
• 9e0772a: build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 (@dependabot[bot])
• b47541b: build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 (#55) (@dependabot[bot])
• f29543f: build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 (@dependabot[bot])
• b54d40f: chore(llm): sync bundled CHANGELOG copy (@postgresql007)
• 1bc31d8: chore(llm): sync the bundled docs corpus with CHANGELOG (@postgresql007)
• 35ba92c: docs(changelog): #64 limit-unreachable skip and squeeze recovery retry (@postgresql007)
• ec2a6d1: docs(cli): recovery drill history names the real --no-history flag; regenerate CLI reference (@postgresql007)
• 2e5ad0e: docs(operator-guide): the email sink reads tls/auth/password, not tls_mode/auth_mode/password_secret (@postgresql007)
• 5f1ad06: docs(release): state what the heavy soak did and did not prove (@postgresql007)
• 079eaf1: docs(release): v1.5 release notes; complete and correct the changelog (@postgresql007)
• 95f1043: docs(release-notes): record the enterprise_heavy soak result (@postgresql007)
• a828281: docs(retention): backup does not run rotate, whatever the docs said (#66) (@postgresql007)
• 8b40663: feat(repo/gc): fenced, batched, single-walk sweep engine (@postgresql007)
• 10cdfb6: feat(sinks): declare config keys; warn on unknown ones; docs held to them (@postgresql007)
• c1b2b7c: feat(soak): a passing run removes its backup repository (@postgresql007)
• 120c28a: feat(soak): run retention (rotate + gc) the way a deployment does (@postgresql007)
• 52ead1a: feat(storage): optional LazyDeleter for deleting garbage without a per-object fsync (@postgresql007)
• 09060c1: feat(storage): reap staging temps a crashed writer left behind (@postgresql007)
• b09640c: fix(agent): a job cancelled on the control plane stops on the agent (@postgresql007)
• 1ae35cf: fix(agent): gate the control-plane URL through the air-gap policy (@postgresql007)
• 7c02232: fix(agent): scheduled and dispatched backups fail instead of going plaintext (@postgresql007)
• 9dbc30c: fix(airgap): gate s3, azure-kv and vault-transit endpoints (@postgresql007)
• c9b31ba: fix(airgap): strict mode checks gcs, aws-kms defaults and the operator's control-plane URL (@postgresql007)
• e631c61: fix(anomaly): report a zero-variance baseline explicitly (@postgresql007)
• 89384bc: fix(approval): trusted roster, exact target binding, single-use, TTL after approval (@postgresql007)
• b2fea0b: fix(audit): every audit event names an actor (@postgresql007)
• f67ccf6: fix(audit): verify-bundle checks each shard's chain separately (@postgresql007)
• 3ab5ea6: fix(audit): verify-bundle requires a trusted signer (@postgresql007)
• 60e24ab: fix(audit): verify-chain shows its findings on failure; fix summary example (@postgresql007)
• 3363b28: fix(azure-kv): record the wrapping key version and unwrap with it (@postgresql007)
• 4c83053: fix(backup): --incremental-from maps parent read failures per error class (@postgresql007)
• 0acddb9: fix(backup): control-plane backup forwards what the agent runs, refuses the rest (@postgresql007)
• a9bf810: fix(backup): essential-files gate looks where hba_file/config_file point (@postgresql007)
• 89cb49a: fix(backup): pin WAL with a temporary slot so --include-wal survives a busy database (@postgresql007)
• 3e3c0fd: fix(backup): stall watchdog counts stream progress; aborts keep their cause (@postgresql007)
• 0b3e671: fix(backup): the not-restorable warning broke backup -o json (@postgresql007)
• dbf4277: fix(basebackup): pg_backup_stop waiting on archiving no longer trips the watchdog (@postgresql007)
• 837f548: fix(capacity): fleet bytes/day is the sum of per-deployment slopes (@postgresql007)
• 9a4d695: fix(chain): a parent cycle is reported as a cycle, not an orphan (@postgresql007)
• 73bc9ed: fix(cli): one splitDSNPassword — drop the duplicate the restore branch added (@postgresql007)
• f69fa08: fix(cli): profiling flags were silently ignored after a subcommand flag (@postgresql007)
• 9c3ccf2: fix(cli): read-only and legal-hold guards on repair/wipe/import; trusted-key re-sign (@postgresql007)
• 9421ae4: fix(cli): redact DSN passwords with a real libpq tokenizer (@postgresql007)
• a3a642b: fix(cli): usage errors printed plain text even under -o json (@postgresql007)
• e92a62b: fix(cli/gc): repo gc and repair chunks --apply run the fenced Sweep; one JSON document; lease conflict exits 7 (@postgresql007)
• 0d36c67: fix(cli/partial dump): keep stdout SQL-only when the dump streams to stdout (@postgresql007)
• 0e94a77: fix(cli/recovery readiness): RPO/RTO targets default to the deployment's SLO config (@postgresql007)
• f761dc0: fix(cli/redact): --print-sql -o json returns a Result; psql gets the password via PGPASSWORD (@postgresql007)
• 401cdf4: fix(cli/repo check): a transient read error is not a signature failure (@postgresql007)
• eab58b8: fix(cli/repo replicate): exit code and text verdict count every failure class (@postgresql007)
• 51f6e65: fix(cli/restore): -o json emits exactly one document when latest/--to skips manifests (@postgresql007)
• 615c220: fix(cli/scrub): report skipped manifests, model a missing KEK, decrypt encrypted WAL (@postgresql007)
• d1f4a1b: fix(compat translate): redact secrets in unmapped-setting notes; bad --from is a usage error (@postgresql007)
• 0ae3964: fix(compat): restore_command shims abort recovery on non-notfound failures (@postgresql007)
• f234ead: fix(compat): shim restores replay all archived WAL; map pgbackrest --type; refuse offset-less target times (@postgresql007)
• 904ac30: fix(compat/barman): barman-wal-archive accepts its documented flags; --test checks the repository (@postgresql007)
• 081d4bf: fix(compat/barman): translated retention names its policy (@postgresql007)
• 3ee30d6: fix(compat/barmancloud): refuse --encryption; do not prefix absolute WAL paths with PGDATA (@postgresql007)
• 4b07fcc: fix(compat/pgbackrest): cipher settings demand native encryption instead of claiming the passphrase is honoured (@postgresql007)
• 1767172: fix(compat/walg): one shared deployment-name derivation; Unix-socket PGHOST falls back to "default" (@postgresql007)
• c868359: fix(compliance): controls no longer pass on failed runs or missing data (@postgresql007)
• e403f49: fix(config): explicit -c must exist; edits write only the target file (@postgresql007)
• 9532ae5: fix(controlplane): an agent with no deployments claims nothing (@postgresql007)
• a7c3b49: fix(db): keep the DSN password off psql's argv (@postgresql007)
• baf5f10: fix(doctest): a block's exit status sees every command (@postgresql007)
• a5529a5: fix(dsa): locate tombstoned backups, refuse unknown tenants, fail incomplete scans (@postgresql007)
• da51860: fix(durationx): reject day/week durations that overflow int64 (@postgresql007)
• b1f1c75: fix(errors): backup.wal_recycled gave advice the soak just disproved (@postgresql007)
• c6f3435: fix(errors): name the system that is actually down; classify recycled WAL (@postgresql007)
• 2ade7c2: fix(external): reap the plugin process on every Call error path (@postgresql007)
• 81afa02: fix(fips): require an active validated module, not just the build tag (@postgresql007)
• ae32fb2: fix(fleet): search verifies manifests and reports unreadable ones (@postgresql007)
• 46c7a07: fix(forecast): regress database size, not the running total of backups (@postgresql007)
• b551043: fix(fs): fsync the parent of every directory Put creates (@postgresql007)
• 86626b7: fix(gameday): patroni_failover observes the slot on the new leader and honours patroni.slots (@postgresql007)
• 408819f: fix(gameday): s3_throttle refuses without --repo instead of passing (@postgresql007)
• 2df07b1: fix(gcs): classify 412 by googleapi.Error type, never by error text (@postgresql007)
• 1f5aeb5: fix(gcs,azblob): roll back an unlockable object on a detached context (@postgresql007)
• 9a0d9ce: fix(hold): never silently weaken a legal hold; audit the releasing operator (@postgresql007)
• 0f12564: fix(integrity): transient Stat errors are not missing chunks; an errored run exits non-zero (@postgresql007)
• 4bee061: fix(jit): jit show reports unreadable revocation markers instead of 'active' (@postgresql007)
• 90f3d70: fix(jit): tenant-bound tokens don't verify for tenant-less ops; document enforcement gap (@postgresql007)
• f918e1f: fix(keystore): read-only verbs never mint a signing keypair (@postgresql007)
• 033a0a3: fix(keystore): refuse an all-zero KEK; shred renames before zeroing (@postgresql007)
• 6c3433f: fix(kms): classify UnwrapDEK failures and keep the typed cause (@postgresql007)
• abe3c5f: fix(kms): never echo a KEKRef's PIN or other secrets in errors (@postgresql007)
• de90d52: fix(kms): rotate rewraps WAL segment manifests and tombstoned backups (@postgresql007)
• dbd2cf2: fix(kms): verify cloud-KMS envelopes through the KMS-aware unwrap path (@postgresql007)
• 4e0c961: fix(kms,rotate): shred scope covers every local ref; read-only + conflict gates (@postgresql007)
• 4af1fa3: fix(lease): a failed or abandoned break claim no longer stops backups forever (@postgresql007)
• f0892fd: fix(llm): 38k tokens of prefill on every question, and a leaking retry (@postgresql007)
• c10b46c: fix(llm): a slow model is not a hung connection (@postgresql007)
• 077ee99: fix(llm): accept --history-key-file on llm history list/show/shred (@postgresql007)
• 5058599: fix(llm): doctor probes the requested provider and exits 1 on failure (@postgresql007)
• acb5b5b: fix(llm): give the model the negative half of the --repo question (@postgresql007)
• 29eb7a3: fix(llm): hot-command help dropped high-priority entries for smaller ones (@postgresql007)
• dadbcce: fix(llm): only exempt back-filled flags when the positional is a deployment (@postgresql007)
• 8743f11: fix(llm): stop loading skills from a CWD-relative share/skills (@postgresql007)
• cb586c0: fix(llm): stop model-supplied tool args from smuggling CLI flags (@postgresql007)
• d6c9ce5: fix(llm): the command validator rejected valid commands, then invented bad ones (@postgresql007)
• b4b126d: fix(llm): the queue wait is not a stall — give it its own budget (@postgresql007)
• 4bee937: fix(llm): the stall watchdog fired but could not unblock a silent stream (@postgresql007)
• 995e535: fix(llm): tool names are not CLI commands — say so in the prompt (@postgresql007)
• 5be627a: fix(llm): validate skill names and make rollback a strict history stack (@postgresql007)
• 88e0176: fix(llm): wire the anomaly detector's topics and the execute audit callbacks (@postgresql007)
• cc5688b: fix(llm/chat): redact preload output and operator context in the system prompt (@postgresql007)
• cba14a7: fix(llm/mcp): apply privacy redaction and local-only policy to tools/call (@postgresql007)
• 1fce73a: fix(llm/privacy): JSON-aware credential redaction (@postgresql007)
• a61435a: fix(llmprovider/openai): surface mid-stream errors, accept "data:" without a space (@postgresql007)
• 99a1e5e: fix(logical): CDC sinks confirm only durably-stored commit end LSNs (@postgresql007)
• 6a88c07: fix(logical): acknowledge keepalive WAL end when nothing is pending (@postgresql007)
• a2de5f6: fix(logical): restart a stream the server ended with a clean CopyDone (@postgresql007)
• cddfa4c: fix(logical): solicit a keepalive on a quiet stream so the watchdog only catches stuck connections (@postgresql007)
• 14b103b: fix(logical): validate the slot name logical add will actually use (@postgresql007)
• ccc3452: fix(logs): --follow honours the output format (@postgresql007)
• 1f012e1: fix(manifest): one-meaning guard folds keys like encoding/json; VerifyEmbedded applies it (@postgresql007)
• cf759f5: fix(manifest-store): undelete re-checks ancestors after the flip; failed re-checks and WORM locks roll back (@postgresql007)
• 894f112: fix(notify): repeatable --set keys build lists; redact URL credentials (@postgresql007)
• d7adf94: fix(output): keep -o json stdout to one document; bounded ordered sink delivery (@postgresql007)
• 673937e: fix(partial): a table that does not exist was reported as a tool failure (@postgresql007)
• 5fe1565: fix(partial): refuse incremental backups, extract tablespace tables, accept inspect output as --relfilenode-map (@postgresql007)
• 829d381: fix(partial): the dump sandbox borrowed the host's identity and the backup's auth policy (@postgresql007)
• 1b33adf: fix(partial/sandbox): stop the forked postmaster when pg_ctl start fails (@postgresql007)
• a66267d: fix(patroni): system-identifier probe uses the configured client (@postgresql007)
• aafed65: fix(pkcs11): share one module and login per process (@postgresql007)
• d00cc2b: fix(preflight): own existing slot is not a full table; superusers may replicate (@postgresql007)
• fa52cf9: fix(recovery): PITR windows no longer report a fake archive hole at the frontier (@postgresql007)
• 5bbbca9: fix(recovery/drill): tablespace drills work in the Docker sandbox; scratch is cleaned; ManifestCaptured set (@postgresql007)
• 9f52443: fix(recovery/readiness): cloud-KMS KEKs are checked by unwrapping the DEK, like restore (@postgresql007)
• f196f48: fix(replicate): warn when a replica cannot restore because WAL was not copied (@postgresql007)
• 5f50868: fix(repo check): name the manifests that fail verification; L4 scenario checks them (@postgresql007)
• 8c10e50: fix(repo/bundle): import chunks first, manifests last (@postgresql007)
• dacae6c: fix(repo/cas): a seen-cache hit no longer vouches for a chunk gc may have swept (@postgresql007)
• eb147ba: fix(repo/cas): bound the seen cache on the GetChunkBytes path (@postgresql007)
• 201abb0: fix(repo/cas): extend an adopted chunk's WORM lock to the adopting manifest's deadline (@postgresql007)
• 9e4cd3d: fix(repo/gc): skip a manifest deleted between List and Get (@postgresql007)
• d83b9c0: fix(repo/heal): verify the replica's copy before calling an identical pair AlreadyOK (@postgresql007)
• 8300136: fix(repo/replicate): refresh rewritten manifests, extend dst locks, verify WAL chunks (@postgresql007)
• 5f966e9: fix(repo/sharedkey): a transient unwrap failure never re-seeds the canonical shared DEK (@postgresql007)
• f3edd30: fix(repoaudit): latest.has_replica_copy reflects the _replicas index (@postgresql007)
• 468cff8: fix(restore): --preview emits estimated_rto_ms in milliseconds (@postgresql007)
• 62aae3e: fix(restore): --skip-gap-check overrides backup_wal_missing on a plain restore (@postgresql007)
• bfa46dc: fix(restore): a missing host extension was reported as a failed backup (@postgresql007)
• 2405faa: fix(restore): a trailing slash in --target no longer breaks chain restore (@postgresql007)
• 2023bf8: fix(restore): an interrupted restore with a non-default tablespace can be resumed (@postgresql007)
• 02a6656: fix(restore): chain (incremental) restore lays out non-default tablespaces for pg_combinebackup (@postgresql007)
• 7479daa: fix(restore): control-plane restore refuses --preview and unhonourable flags (@postgresql007)
• 3c4fcf8: fix(restore): pg_verifybackup runs before the boot test; boot test leaves the target clean (@postgresql007)
• 5c640e7: fix(restore): recovery settings inherited from an earlier restore no longer apply (@postgresql007)
• 6323599: fix(restore): refuse a backup whose WAL exists nowhere; backup says when it is not restorable (@postgresql007)
• 2ab8844: fix(restore): refuse an LSN target beyond the archived WAL (@postgresql007)
• 51861bd: fix(restore): refuse an LSN target whose replay must cross a recorded WAL gap (@postgresql007)
• 1e46f09: fix(restore): restore_roots gates tablespace_mapping destinations too (@postgresql007)
• c227bba: fix(restore): validate flags before requiring the keypair (@postgresql007)
• 26275f6: fix(restore/combine): PG-major uniformity check compares manifest majors (@postgresql007)
• 539d6ac: fix(restore/naturaltime): accept RFC3339 timestamps without seconds (@postgresql007)
• 0741c20: fix(restore/redact): hash SQL digests the same bytes as the dry-run preview (@postgresql007)
• 111238b: fix(rotate): a broken pg_hardstorage.yaml fell back to GFS instead of refusing (@postgresql007)
• 588303f: fix(rotate): manual rotate ignored the deployment's retention block (#66) (@postgresql007)
• 3ee4f12: fix(rpm): the WAL-stream unit was pasted into %install instead of %files (@postgresql007)
• 4204fdd: fix(s3): retry 409 ConditionalRequestConflict on conditional writes (@postgresql007)
• 9bc3d17: fix(schedule): last-run state is written durably and survives a crash-leftover tmp (@postgresql007)
• 414d8f4: fix(schedule): persist task last-run so restarts don't starve every: tasks (@postgresql007)
• f75ee84: fix(scim): creates assign the id and never overwrite an existing resource (@postgresql007)
• 2dbda12: fix(scp): keepalive, reconnect, ctx-aware reads, and sync on Put (@postgresql007)
• 3c3a430: fix(server): abandoned-job sweep stamps real instants on non-UTC servers (@postgresql007)
• cbc37ca: fix(server): bound the cost of unauthenticated /metrics scrapes (@postgresql007)
• eae0faf: fix(server): redact repo credentials in job and deployment responses (@postgresql007)
• 97b2d49: fix(sftp): atomic overwrite via posix-rename, fsync staged files (@postgresql007)
• 6fb0a1e: fix(show): accept latest; generated docs held fresh by a test (@postgresql007)
• dba02fd: fix(simple): Ctrl-C stops wal stream gracefully and only the running flow (@postgresql007)
• 0a9bffe: fix(simple): setup wizard keeps config private, loadable and intact (@postgresql007)
• 8ff551e: fix(sink/cef): re-open the destination after logrotate move-and-create (@postgresql007)
• f220381: fix(sink/email): bound the SMTP conversation, stop double dot-stuffing, honour airgap (@postgresql007)
• b598883: fix(sink/jira): dedup on exact summary and serialise find-or-create (@postgresql007)
• 2eb5ee1: fix(sink/syslog): check the collector address against the air-gap policy (@postgresql007)
• 2fa771e: fix(soak): Docker reported a dead container as running; trust the exec error (@postgresql007)
• 529554f: fix(soak): a backup killed by its container restarting is cell-down, not a failure (@postgresql007)
• 5d5540a: fix(soak): a backup whose container a fault stopped is the testbed's, not a failure (@postgresql007)
• fd97c1b: fix(soak): dockerd refusing a backup's exec is the testbed's, not a failure (@postgresql007)
• 3c27cfc: fix(soak): hold fault injection during retention windows too (@postgresql007)
• cf7b2df: fix(soak): let a retention window wait 10m for the fleet to drain (@postgresql007)
• 9a67f74: fix(soak): retention runs fleet-wide in a maintenance window (@postgresql007)
• fe680bb: fix(soak): stagger restore-verify across cells (@postgresql007)
• 0faf671: fix(soak): supervise the sustained writer; measure it in a way that survives faults (@postgresql007)
• 41ac135: fix(soak): wait at least as long as the testbed itself allows PG to start (@postgresql007)
• 7210bee: fix(soak): wait for PostgreSQL to finish recovering instead of three seconds (@postgresql007)
• 986b6da: fix(storage): lock the committed key, not the staging temp, on the rename fallback (@postgresql007)
• 36640b3: fix(systemd): ship a unit for the WAL streamer (#56) (@postgresql007)
• 4cb4e58: fix(testbed): entrypoint gave up on crash recovery after 60 s and restart-looped (@postgresql007)
• f19a992: fix(testkit): a --faults/--profiles path that does not exist is an error (@postgresql007)
• 18b942b: fix(testkit): a fault-injection failure was truncated before the reason (@postgresql007)
• 1e29d25: fix(testkit): a hung docker CLI call wedged a scenario run for 25 hours (@postgresql007)
• 8f5cbee: fix(testkit): a soak cannot pass on a dead cell or an unreverted fault (@postgresql007)
• d9e61d9: fix(testkit): apply *_mid_backup faults while a backup is running (@postgresql007)
• 1c9b6c1: fix(testkit): cgroup_squeeze recovery retries a container restart racing it (@postgresql007)
• 940722e: fix(testkit): classify a dying cell per exec attempt, and the same way for verify (@postgresql007)
• bc6f9da: fix(testkit): confine repo-corruption faults to the injecting cell (@postgresql007)
• 7b10b04: fix(testkit): decode scenario steps strictly; make two L4 asserts real (@postgresql007)
• 760686e: fix(testkit): enterprise_heavy could never seed — sudo from a user without sudo (@postgresql007)
• 0de467a: fix(testkit): gc every repository, and fail a run whose gc never gets through (@postgresql007)
• a35b373: fix(testkit): let the retention gate's timer, not the clock, end a quiesce (@postgresql007)
• c4b3aaf: fix(testkit): llm run cannot pass a one-question rubric or a crashed LLM (@postgresql007)
• 820085c: fix(testkit): logical-replication scenarios end the stream with SIGTERM (cli_run stop_after) (@postgresql007)
• 15c0c9f: fix(testkit): only skip a cgroup_squeeze the kernel actually refused (#64) (@postgresql007)
• 3ca4269: fix(testkit): pass -n to pg_verifybackup, as the product already does (@postgresql007)
• 6f1c442: fix(testkit): pause_archive and disk_full do what they say, reverts report failure (@postgresql007)
• 1317514: fix(testkit): reserved assertion kinds fail instead of passing unchecked (@postgresql007)
• 1b2fc77: fix(testkit): scenario runner removes its own temp dir after a passing run (@postgresql007)
• ed925bb: fix(testkit): speak tar to docker cp in DockerTarget.CopyIn/CopyOut (@postgresql007)
• 5ace556: fix(testkit): synchronise the sidecars' captured output (@postgresql007)
• 3059e59: fix(testkit): the image-arch guard blamed the architecture when it simply could not ask (@postgresql007)
• 2db9153: fix(timetravel): recovery target is inclusive, like restore --to (@postgresql007)
• fd81c39: fix(undelete): a WAL-coverage probe error fails closed (@postgresql007)
• 0b6984c: fix(undelete): audit resurrections already applied when a later ID fails (@postgresql007)
• ae4b6c4: fix(wal): --verbose reported no progress for a stream that ended before the first tick (@postgresql007)
• a38c71b: fix(wal): cross-timeline resume starts at the fork; gap detection is timeline-aware (@postgresql007)
• cdbe81a: fix(wal): gap-purge --orphans fails closed on unreadable manifests (@postgresql007)
• 5f4111f: fix(wal): split-brain never carried its documented splitbrain.* code (@postgresql007)
• f419146: fix(wal): wal fetch .history surfaces timeline-store read errors (@postgresql007)
• 1a342e8: fix(wal): wal prune exits non-zero on failures and ignores gap records (@postgresql007)
• 4528fe7: fix(wal): wal push --tde suggests --system-identifier (@postgresql007)
• 1da945b: fix(wal): wal stream checks sysid and wal_segment_size on every attempt (@postgresql007)
• 10b3231: fix(wal,logical): WAL and logical writers join the gc exclusion protocol (@postgresql007)
• 1ad6075: fix(walsink): keep a batch-shared adopted ref until its last segment commits (@postgresql007)
• 15b1c51: fix(writers): backup, replicate and bundle import commit under the gc fence (@postgresql007)
• 99588e2: fix: finish cross-branch follow-ups from the review merges (@postgresql007)
• f3d5ad3: fix: gc reaps crashed writers' staging files; repair stops minting keypairs (@postgresql007)
• ec66bca: fix: scenario-campaign findings — jit/threshold identity key, logical slot names; scenarios follow the review's behaviour changes (@postgresql007)
• 6dcb58a: merge fix/backup: review findings (KEK rotation incl. WAL, holds, leases, watchdog, manifest guard, preflight) (@postgresql007)
• f02654a: merge fix/cli-output-config: review findings (JSON stdout contract, config layering, redaction) (@postgresql007)
• cd6d618: merge fix/compat-misc: review findings (compat shims, logical, forecast/compliance, simple, gameday) (@postgresql007)
• ddc0b8b: merge fix/controlplane-governance: review findings (approvals, audit, control plane, server, scheduler) (@postgresql007)
• 561f0fe: merge fix/llm-sinks-part-cli: review findings (LLM, sinks, llm CLI) (@postgresql007)
• f869e57: merge fix/llm-sinks-part-sinks: review findings (LLM, sinks, llm CLI) (@postgresql007)
• 6c3cdf3: merge fix/llm-sinks: review findings (LLM, sinks, llm CLI) (@postgresql007)
• 06d3112: merge fix/repo: review findings (gc exclusion + speed, CAS, scrub/repair, replicate, integrity) (@postgresql007)
• 99e0455: merge fix/restore: review findings (chain tablespaces, recovery settings, postverify, partial, drills) (@postgresql007)
• 5684f2d: merge fix/storage-kms: review findings (storage backends, KMS, crypto, airgap) (@postgresql007)
• acd20b2: merge fix/testkit: review findings (soak verdict, faults, scenarios, doctest) (@postgresql007)
• 3374c4d: merge fix/wal: review findings (WAL stream/fetch/prune/gaps, walsink) (@postgresql007)
• 91ed5e0: perf(gc): delete chunks concurrently; one fsync-bound delete at a time took minutes (@postgresql007)
• 76fd2af: release: v1.5.0 — cut the changelog, record how it was tested (@postgresql007)
• e7a918b: style(forecast): reword a comment gofmt read as a list item (@postgresql007)
• dbf4e5b: style(logical): gofmt local-PG integration test (@postgresql007)
• 9e13c13: style(restore): gofmt gapcheck.go (@postgresql007)
• f2af654: style(runner): gofmt stall watchdog files (@postgresql007)
• 3b95294: style: gofmt the RPM section test (@postgresql007)
• 5d19663: test(cli): drop the duplicate setReadOnly helper two branches added (@postgresql007)
• 347d059: test(cli): hermetic under -shuffle — TestMain mints the shared signing keypair (@postgresql007)
• 506a81b: test(cli): permanent -o json stdout contract across the whole command tree (@postgresql007)
• 7b09553: test(docs): every documented command must pass the real CLI validator (@postgresql007)
• 2d2f237: test(docs): every documented pg_hardstorage.yaml example must load (@postgresql007)
• d94c854: test(llm): pin the two stream budgets, and make the test prove it (@postgresql007)
• 1d216d6: test(patroni): the failover-interruption test takes restorable backups (@postgresql007)
• 50f5ba5: test(repo): WAL-prune frontier fuzz uses canonical segment keys (@postgresql007)
• 4b0278c: test(scenarios): two L2 partial scenarios were green on an accident (@postgresql007)
• f89b81f: test(soak): the event stream announced a writer that never started (@postgresql007)
• 28de5fd: testkit: cover cgroup memory.max refusal matching (@team-humaki)
• 7637da1: testkit: lock skip for ErrLimitUnreachable soak events (@team-humaki)
• 111b007: testkit: skip unreachable cgroup limits instead of apply-failed (@team-humaki)
• 9d57991: testkit: type cgroup memory.max refusal as ErrLimitUnreachable (@team-humaki)

All artefacts are cosign-signed (keyless / Sigstore). Verify with:

cosign verify-blob \
  --certificate-identity-regexp 'https://github.com/cybertec-postgresql/pg_hardstorage' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate <artefact>.pem --signature <artefact>.sig \
  <artefact>