v0.21.0

The release where a warning became a control, and a convergence stopped being read as a route.

Qualified on the bench through two prereleases, because three of these changes cannot be verified by reading a diff. All three were measured on real data rather than in a test of ours.

Upgrading

Nothing to do: the data directory is read in place and the log sequence continues. An upgrade from 0.20.0 was exercised on the bench, and so was one from the prerelease — sequence advancing, no spurious retraction, provenance unchanged at +2, +5 and +10 minutes.

One answer changes shape. find_path no longer routes through a network.neighbor or an aggregated network.interface by entering and leaving on the same relation type. Two interfaces that heard the same hardware address are not connected to each other by that fact, so a path now reports the device that carries them instead of the cache entry they share. If you depended on the old answer, you were reading a co-observation as a hop.

What this fixes, and what it cost to find

A liveness reference now names the speaker — a producer and its collection method. Before, one method of a producer that lost sight of an edge retracted it for all of them. An independent review found two grave defects in the change on the day it merged, and a third was found later by reading another session's upgrade plan rather than the code; all three are fixed here.

A deletion's reason reaches the sentence beside it. A producer reporting a disappearance because it stopped watching is making the opposite claim from one that watched the thing end. The reason sat in the payload while the plain-language answer asserted the latter for both. It now quotes the producer's own word and widens the reading, without interpreting a term Toise does not define. Measured end to end: a switch paused for six minutes, fifteen entities, the right sentence.

monitors no longer propagates a monitored target's failure into the agent watching it. The agent is healthy and its reading is bad, which is a different fact. One unreachable target was inflating the blast radius by the whole fleet that agent watches, and the error would have widened with every probe shipped.

The conformance kit refuses a hardware address that is not in the normative rendering, wherever it appears. Not an advisory, for the reason that made host.id non-advisory: the failure is silent and permanent.

And the demonstration fixture no longer contradicts the identity rule it exists to teach. It keyed a route on a host's name and carried the next hop as a descriptive attribute, so it produced the exact defect the three-key identity eliminates — and the documentation presented that as expected. Found by a consumer session running it, which nobody had done since September.

Reservations, stated rather than omitted

• Link aggregation is absent from the bench, so the half of the traversal rule that concerns an aggregate was never exercised. A gap in the bench, not a property of the model.
• The traversal rule's proof for neighbours is three queries, placed where the rule decides. Weak, and worth saying.
• From and To in the relation registry are read by nothing, so they describe rather than constrain (#494). monitors declared the wrong target for three releases and no test could notice.
• A restored log re-stamps commit_seq in batches of a thousand, so pairing events on it after a disaster recovery groups unrelated changes (#496). The field is least trustworthy where it matters most.

Full detail, with causes, in CHANGELOG.md.