v0.10.0

What's Changed

• New opt-in OldestJobProbe recovery strategy. At Laravel Live Denmark I was asked where the test job goes when a half-open circuit probes: it goes to the back of the queue, and a failed probe lands behind the other held jobs, so the next probe is a different job every cycle. With this strategy the oldest held job (by dispatch time in the payload) is the probe, it stays the probe across reopen cycles no matter how many workers run, and it is the first job through when the service recovers. If it exhausts maxExceptions, the next oldest takes over. Enable it per service with 'recovery_strategy' => OldestJobProbe::class; the README section "Where does the probe job go?" covers what it guarantees and what it doesn't.
• Fixed a race where a worker that lost the open-to-half-open transition lock ran its job with no circuit protection at all. Found by running 3 workers against a Redis queue; the loser of the lock race read the stale open state and fell through to the closed path.
• Fixed a race where two jobs could probe in the same half-open cycle: the probe lock was released before the circuit reopened, and a second worker slipped through the gap.
• The probe lock now outlives slow probes. It was a flat 5 seconds, so any probe slower than that (a 30-second HTTP timeout, say) let a second probe start mid-run. Default is now 65 seconds, configurable via default_probe_lock_ttl or per-service probe_lock_ttl, and a job that declares $timeout gets at least $timeout + 5.
• fuse:status gained a Probe column (probe_candidate in --json), and the status page shows the candidate while the circuit is open and the elected probe while half-open. New RecoveryStrategy implementations can opt into job identity via the JobAwareRecoveryStrategy interface; the existing contract is unchanged.

Upgrading

No signature changes. The behavior to watch is the probe lock TTL: if a probing worker is killed mid-probe, the next probe attempt now waits for the lock to expire, up to 65 seconds instead of 5. Normal probe failures release the lock immediately, so only a crashed or OOM-killed worker hits this. Set probe_lock_ttl per service if 65 is wrong for you, and give probe-guarded jobs a finite $timeout so the lock tracks it.

Full Changelog: v0.9.0...v0.10.0