knit-spool 0.7.0

The rotation release. Rotating a commons room, which is how an operator removes a member, is now
a SIGHUP instead of a restart: only that room's members reconnect, and every other room and
private conversation stays connected. Boot and knit-spool check now read SPOOL_RELOAD_FILE
too, so a restart keeps what the last reload installed instead of reverting it. Pre-1.0, so every
interface below is still subject to change. No record changes on the wire. One thing an operator
sees move: an existing reload file is now applied at boot, and one that cannot be read stops the
boot, under Changed. A 0.6 Spool with no reload file, or a current one, upgrades in place.

Added

• Commons rooms reload on SIGHUP, so rotating one no longer restarts the Spool. Put a room's
  new id in SPOOL_RELOAD_FILE and send SIGHUP: the Spool creates the new room before any
  hello lists it and closes only the connections in the old room, with 1001. Those members
  reconnect to a hello that no longer lists it, and every other room and private conversation
  stays connected. Adding or removing a room works the same way. So does a change to a room's
  bounds or SPOOL_COMMONS_<n>_ATTACH, which closes that room's members because their hello told
  them the old values. A rename or a new push budget closes nobody. SPOOL_COMMONS_RATE_TOTAL
  reloads with the rooms. If the store has no slot for a new room (SPOOL_MAX_SCOPES full, nothing
  bare to reclaim), every room stays as it was and the rest of the reload still applies. Follows
  knit-next spec S-7.4-21 (knit-next 0f8049cb8; ADR 2026-10.hs75).

Changed

• Boot and knit-spool check read SPOOL_RELOAD_FILE too, layered over the environment as a
  reload does. Before, a restart fell back to the environment for every line the file set, so a
  room rotated through the file came back as the old room, and a token promoted there reverted. A
  missing file is no overrides. An unreadable one now stops the boot instead of being ignored, and
  boot-only lines in the file take effect at the next boot (ADR 2026-10.hnqs).
• A blank SPOOL_COMMONS_RATE_TOTAL= reads as unset, as a room's id does, so a reload file can
  remove the last room the environment set.
• A SIGHUP that names a boot-only setting logs it as … needs a restart — ignored, and the
  reload's summary line reports what is now running rather than what the file asked for.

---

Container image

Published to GHCR and Docker Hub for linux/amd64 and linux/arm64:

docker pull ghcr.io/getknit/knit-spool@sha256:35622949ed627d14533b4d6aed1a6523d68e2d7ab99867b41bdc795953da0780
docker pull docker.io/getknit/knit-spool@sha256:35622949ed627d14533b4d6aed1a6523d68e2d7ab99867b41bdc795953da0780

Pin the digest in SPOOL_IMAGE rather than a tag — see deploy/.env.example. The GHCR
image carries a signed build provenance attestation:

gh attestation verify oci://ghcr.io/getknit/knit-spool:0.7.0 --repo getknit/knit-spool

Standalone archives

For running the daemon without Docker. SHA256SUMS covers every archive attached here.
Both need a JDK 21 runtime on the host; unpack and run bin/knit-spool.

Upgrading a live spool? HOSTING.md covers the operational side, and CHANGELOG.md calls
out anything that moves the wire, the on-disk store, or a configuration default.