v0.4.0

Added

• Add Inspector support for local and remote JSONStreamRecorder NDJSON,
  including blank-line tolerance, strict all-or-nothing entry validation,
  physical line-number errors, and an explicit source-format indicator.
• Add a bounded FIFO AsyncRecorder decorator with evidence-preserving
  AsyncBlock backpressure by default, explicit drop-newest/drop-oldest
  policies, context-aware background drain, optional downstream close
  ownership, contained sink failures, and concurrency-safe queue/block/drop
  statistics.
• Add opt-in size/interval-based AsyncRecorder batching through structurally
  discovered RecordBatch([]*Entry) error, with FIFO shutdown flush, reusable
  batch storage, built-in recorder support, and batch health metrics.
• Add opt-in bounded AsyncBlock waiting with explicit drop fallback, active
  oldest-block age, fixed timeout drop reasons, and a panic-contained drop hook
  for releasing external assets owned by discarded entries.
• Add bounded OpenTelemetry health metrics for AsyncRecorder queue depth,
  capacity, throughput, producer blocking, drops, and downstream failures via
  otelrecorder.Config.AsyncRecorder.
• Bound MemoryRecorder to the newest 1,024 entries by default, with an
  explicit custom-capacity constructor, O(1) ring-buffer eviction, atomic
  snapshots, and retention/eviction statistics.
• Add managed FileBodyStore lifecycle APIs with transactional partial-file
  commit/abort, opaque references, byte/file quotas, startup partial recovery,
  explicit release/reconciliation, lifecycle statistics, and OpenTelemetry
  metrics.
• Add separate head-sampling and finalized-entry retention policies, stable
  request/trace sampling keys, an allocation-free uninstrumented drop path,
  metadata-only capture ceilings, automatic discarded-asset cleanup, bounded
  statistics, and OpenTelemetry sampling health metrics.
• Add protected-token key-ID inspection and resolver-based decrypt/verify
  helpers so trusted archive tooling can process mixed key generations.

Changed

• Change Recorder.Record and the optional batch capability to return errors,
  so synchronous sink failures are routed through Transport's internal-error
  policy. Remove JSONStreamRecorder.Err; AsyncRecorder.Close returns worker
  and downstream failures after draining.
• Change AsyncDropHandler to return errors and remove
  FileBodyStoreDropHandler; callers can pass FileBodyStore.ReleaseEntryAssets
  through a small closure, while failures now use AsyncRecorder's internal-error
  policy, stats, OpenTelemetry metric, and Close result.
• Replace the single-method ProtectionKeyProvider/ProtectionKeyResolver
  interfaces and their Func adapters with direct function types.
• Freeze the pre-v1 public surface around explicit Config,
  AsyncRecorderConfig, FileBodyStoreConfig, and otelrecorder.Config
  values; remove functional option APIs and policy adapter/interface pairs.
• Make Transport internals private and require the recorder and complete
  configuration at construction time.
• Consolidate every recorder-specific HAR entry field under the versioned
  _recorder v1 extension and publish its JSON Schema. The Inspector consumes
  only this schema and rejects unknown versions.
• Keep batch delivery and entry-asset release as structurally discovered
  internal capabilities instead of exported maintenance contracts.
• Replace the pre-1.0 BodyWriter.Close contract with explicit Commit and
  Abort outcomes so custom stores cannot confuse retry cleanup with asset
  publication.
• Invoke OnEntryCompleted before retention and Recorder delivery, with
  borrowed asset ownership limited to the callback duration, so discard paths
  cannot invalidate body references before completion observers run.
• Centralize the OpenTelemetry adapter's setup, lifecycle, complete
  metric/unit/attribute reference, data-safety guidance, and production
  alerting scenarios in otelrecorder/README.md.
• Pass the original request context to ProtectionKeyProvider, enabling
  request-scoped key selection without mutable Transport configuration.
• Use one fail-contained internal-error policy for Transport and
  AsyncRecorder, and make both recommended default configs log evidence
  degradation while their explicit zero values remain silent.

Fixed

• Avalanche deterministic sampling hashes before threshold comparison so low
  rates remain statistically representative for common prefixed, sequential,
  and fixed-width hexadecimal keys. Existing keys may receive a different
  deterministic decision after upgrading to this fix.