v1.10.0

1.10.0 (2026-08-26)

Features

• boot: warn when postgres has no relay (ac2f235)
• config: add SITE_RESERVATION_GRACE (d47f8dc)
• drift: report aliases with no registry row (cbed6bd)
• gc: reclaim origin bytes before freeing the name (d86484c)
• gc: release a reserved name once its grace expires (2f8d9ff)
• handler: add undelete and retire the purge flag (4804e9e)
• handler: delete takes the site dark and reserves it (bd2bcd0)
• pg: detect a lock session that stops answering (ba46fb5)
• pg: read the unpublished outbox backlog (def4bde)
• pg: store the per-site reservation clock (e8f3291)
• r2: add a one-attempt bounded Ping (e291526)
• r2: add DeleteAlias to take a site dark (1c92d84)
• registry: add the reserved site state (0066eac)
• relay: page when the outbox stops draining (b468f74)
• site: let an approver release a reserved name early (65db0fd)
• sites: expose reserved state on the list (435d954)

Bug Fixes

• boot: construct the reservation sweep wiring (15ea03e)
• boot: wire the reservation store into the handlers (e5cb256)
• config: order the PUBLIC_URL checks (4a1306c)
• config: own the alias key tail rules (613fe8f)
• config: validate alias and deploy key formats (46344c0)
• drift: keep an orphan verdict a partial scan already proved (8c6d0af)
• drift: report a reserved name still serving (d5862da)
• drift: stop the reclaimable alert claiming a trend (b22ce44)
• gc: stop the reclaim sweep racing an undelete (cabc693)
• handler: audit a promote or rollback that half-commits (8df9c81)
• handler: closure verdict beats the locker (9202659)
• handler: fence a reserved site at every entry (e42a2c5)
• handler: fence every alias write on the site row (a381ca0)
• handler: retry and audit the commit leg (9e81645)
• handler: unpublish first, audit every purge (b201e6a)
• handler: unpublish first, audit every purge (#46) (d75f92e)
• observability: classify errors by cause (5c4f5d1)
• observability: escalate transients per cause (7fb7d77)
• observability: fingerprint background issues by cause (f6e9c2e)
• observability: split DNS faults on NXDOMAIN (98f03b5)
• pg: budget each connect attempt separately (0df7226)
• pg: cancel the locked closure when the session dies (0b3ddea)
• pg: stop promoting a failed unlock (469ce44)
• r2: let a page finish when one object fails (c761436)
• readyz: degrade on an R2 fault, keep the pod (4c8c37b)
• relay: bound the outbox backlog probe (9de0cd2)
• site: free a released name only after its bytes are trashed (837f9f5)
• site: restore alias pins on undelete (d84bcc4)
• sweep: lock each reclaim and isolate failures (f472f2b)
• valkey: budget each connect attempt (97379ec)

Performance Improvements

• r2: move a prefix concurrently, bounded at 16 (d24258b)