v0.4.1

You can do a rolling upgrade from v0.4.0.

Highlights:

• Balance cell ownership across the fleet. A node that joins takes hibernated cells from the nodes that hold the most, so it carries its share within minutes instead of waiting for new traffic. The fleet evens out again after a node leaves. One node samples the leases for the whole fleet, so the cost does not grow with the square of the fleet.
• Restore a large cell page by page. The cell reads each page from the object store on first use, so it serves requests before the download completes. A large cell also hands off through its LTX chain instead of a whole-database snapshot.
• Queue throughput improves by an order of magnitude. Producer calls share transactions and durability rounds, and each message gets a time-ordered id. One Queue sustained 7,357 sends per second over a 300,000-send soak with exact delivery, up from a few hundred.
• Fewer false durability timeouts under load. The budget measures a stall: a queued write waits while the node keeps landing proofs. A follower commits a burst of frames as one fsync chain, and CRC64 verification uses SIMD.
• Alarms scale to the due work. The waker lists one bucket per armed minute and opens only the due ones. Only the elected waker probes the fleet, and the activation bound derives from store latency, so alarms of evicted cells fire on time under load.
• Recover from a whole-fleet restart. A restarting node serves follower fragments while it recovers its own predecessor, so nodes that restart together recover acknowledged writes. Recovery checkpoints its progress and holds a heartbeat, so a retry skips finished work and peers do not repeat it.
• Durable Object facets. ctx.facets provides get(), abort(), and delete(). Each facet gets an isolated SQLite database that celld replicates with the root object.
• More Node.js and web platform APIs. node:fs, node:os, node:diagnostics_channel, a read-only /bundle, and a per-request /tmp. HTMLRewriter, EventSource, MessageChannel, the Cache API surface, outbound TCP through cloudflare:sockets, and Web Crypto KDF derivation, key wrapping, and RSA signing.
• A tighter output gate. An error answer, each chunk of a streaming body, a call into a loaded Worker, and the answer of a handler that fails after it commits all wait for the proof of the writes they depend on. storage.sync() returns after the cell's writes are proven durable, and a rollback discards writes submitted without await.
• A lease reports why it lost authority. A self-fence names its cause, and a failed renewal retries before the authority expires.
• Operator commands page. A cell listing and a KV bulk export no longer load a namespace into memory. A lease records store outcomes and owned cell count, so celld diagnose shows each node's load. celld dev --clean discards the local state.

Issues fixed:

• #176
• #178
• #179
• #180
• #182
• #183
• #184
• #185
• #186