v0.2.4

Changed

• A throttle's rollback now looks at each value on its own. Before, if
  you changed CPUWeight by hand during a throttle, the whole rollback was
  skipped and MemoryHigh stayed at the throttled value until the next
  reboot, while the record said rolled_back. Now your CPUWeight stays,
  MemoryHigh goes back, and the note names the value left alone.

Fixed

• A daemon that was killed or crashed while holding a throttle or freeze,
  and then couldn't start again (for example because its configuration no
  longer loaded), left that unit throttled or frozen until someone fixed
  it. The unit now runs sentry-v2 --rollback-only after every stop, which
  puts everything back straight away and falls back to the default settings
  if the configuration is broken.
• In a denial storm the daemon can read denials seconds late. A failure
  was finalised a second after it happened, before its own denials had
  been read, and a denied process that had exited by then had no cgroup
  left to match. On a 1-vCPU test VM a failing service's denial was missed
  this way. A failure now waits until the audit stream has been read past
  its window (at most 30 s, after which the bundle says
  audit_caught_up: false), and a denial from a process that has exited
  still matches if its PID was the unit's main process.