v1.9.0

Upgrade notes

• UPGRADE: SSE reports connected at the first frame, not at the 200
  response (minor, qfg-goi1.10.9 / qfg-goi1.10.44). A stream connection now
  counts as connected, for connection_state(),
  on_sse_connection_state_change, the reconnect backoff and the fallback
  poller, only after it delivers its first valid frame: a config envelope or a
  keepalive. Before, it counted as soon as the 200 response headers arrived.

  • Against Quonfig's servers the headers and the first frame arrive together,
    so you should see no difference.
  • Behind a proxy or server that sends 200 headers early, connected is
    reported when the first frame arrives: at most one keepalive interval
    (30 s) later.
  • A connection that closes before any frame is now a failed attempt. The
    reconnect delay grows, on_sse_connection_state_change receives error,
    the client reports disconnected, and the fallback poller takes over after
    its usual threshold (at once if the stream never delivered a frame since
    boot).
  • After a connection that delivered a frame ends cleanly (a load-balancer
    recycle), connected is still held across the reconnect with no state
    edge, but only for one connection: if that connection ends with no frame,
    error is reported at once.
  • connection_state() no longer reports connected from the initial HTTP
    fetch alone while a stream is configured: it reads initializing until the
    stream's first frame (datadir mode is unchanged).

  Before this change, a server that answered 200 and closed at once made the
  SDK reconnect in a tight loop and keep stale config indefinitely.

Fixed (patch)

• SSE: the reconnect backoff resets after a connection that delivered a frame
  even when that connection then dies with an IO error (a reset, a truncated
  chunk, a read timeout), not only after a clean end. Before this fix, which
  only affected the unreleased parser above, each such blip doubled the delay
  until every reconnect waited 30 s (qfg-y0lf; supervisor contract Test 2).
• Dependencies: declare urllib3 >= 2.3. It was already pulled in through
  requests, which accepts urllib3 1.21.1 and up, but the SSE parser needs
  urllib3 2.2's read1 to see a lone keepalive at once, and close() needs
  2.3's shutdown() to close the live SSE connection. On older urllib3,
  close() left the SSE socket open until the next keepalive or the 60 s
  read timeout. If another dependency pins urllib3 below 2.3, the resolver
  now reports the conflict (qfg-pfmi).

Changed (minor)

• SSE: own text/event-stream parser, so keepalive comments are seen (they
  mark a connection connected) and a lone keepalive on a non-chunked stream is
  read as soon as it lands. The sseclient-py dependency is removed.

Tests

• Supervisor contract Test 9 (a)-(d) and the Test 2 reset rule against a local
  server (tests/unit/test_supervisor.py). integration-test-data pin in
  test.yaml bumped to v2026.10.16.4 (the get_or_raise init-timeout cases
  now target http://192.0.2.1:1; both green).