clink v0.8.0

clink v0.8.0 is the launch release: the production-qualification programme
run across the engine's guarantee surface, and the repository reshaped for
public use.

Ten qualification campaigns, published green. After v0.7.0's QUAL-01,
ten more campaigns ran under continuous fault injection, judged by
independent oracles, and were published only once green with evidence
retained: PostgreSQL two-phase commit, S3 staged multipart commits, 29 GiB
of keyed state on a disaggregated backend, bounded state through declared
retention, wide job graphs at 147 operators and 292 subtasks, content-level
agreement with an independent reference engine on 19 of 19 queries, a
rolling engine upgrade with exactly-once continuity, infrastructure faults
from ENOSPC to stepped clocks, a running job's keyed-state type changed and
migrated at restore, and a declared security-refusal matrix. Every result:
https://orhaugh.github.io/clink/qualification/

Engine fixes. The campaigns and the sanitizer matrix forced out a long
list of defects, fixed in this release - among them: savepoints pinned
against retention for the life of their job; a committing sink held open
until its final commit lands; a job whose checkpoints fail persistently
fails instead of crashlooping; a terminal job's HA manifest retired so
recovery cannot resurrect it; channel closes carrying a reason so a cancel
never reads as end-of-input; SQL sinks writing the table's declared schema;
declared state_ttl bounding DISTINCT and set operations; a wire decoder's
reserve bounded by the frame's bytes (one corrupt frame could otherwise
cost a 22 GB allocation); and a worker connection kept alive across an
off-lock send (a use-after-free in the coordinator under same-id worker
re-registration). The full list is in the CHANGELOG.

Runtime image. jemalloc is the image's default allocator with Arrow's
pool routed to it: under repeated recovery, allocator retention kept
gigabytes of freed memory resident, and the paired defaults return it -
measured, not inferred. The image is published for amd64 and arm64, and one
command runs a complete example, data included:

docker run --rm ghcr.io/orhaugh/clink-runtime:0.8.0 run /opt/clink/examples/sql/hello.sql

Compatibility. No REST API breaks. Wire protocol v2 unchanged in
negotiation (CommitCheckpoint gained a backwards-compatible tail field).
Snapshot format unchanged. Plugin ABI v1 unchanged.

Documentation: https://orhaugh.github.io/clink/

Artefacts

• ghcr.io/orhaugh/clink-runtime:0.8.0 - runtime image, linux/amd64 and linux/arm64.
• clink-v0.8.0-linux-x86_64-ubuntu24.04.tar.gz - relocatable SDK (CLI, headers, libraries); checksum published alongside it.
• pyclink-0.8.0-py3-none-macosx_14_0_arm64.whl - macOS arm64 wheel,
  sha256 b2d74f478d1cf355f1b08a9bf3c2a3917b99d43689c8597f2d42a0dc96164b5e.
  Other platforms: build from source, or point CLINK_LIB at an SDK library
  and pip install "git+https://github.com/orhaugh/clink@v0.8.0#subdirectory=python".