v0.22.0

v0.22.0 — the release that stopped holding answers it would not give

Qualified on the bench through five prereleases. Three were refused, and
each refusal came from preparing the qualification rather than from a
test that was already red: the gap was found by someone measuring, not
by reading the diff.

Every fix here has one shape. Toise knew something and the surface did
not carry it. An impossible cadence recited as a bound. A provenance
field that meant two different things. Forty-seven thousand losses with
no trace. A join key offered for twice the cases it covers.

The last defect found was in the instrument. A counter added earlier in
this very release could not fire on a single tenant in production: its
reporter was installed after boot had already opened every persisted
tenant, and an engine takes that callback at construction. The drop was
logged; the series stayed at zero. Zero discarded edges and no
discarded edges are indistinguishable from the outside — the same
confusion between an absence and an answer that every other entry here
corrects, this time in the measurement.

An as_of read no longer borrows the present. Who asserts an entity, and
how often it is observed, are live state: replaying the log does not
rebuild them, and filling those fields from the live table named the
producers asserting an entity TODAY beside its state THEN. A withheld
field now carries a sentence naming what it costs the reader and how to
get the answer, because two null fields and no explanation cannot tell
withheld from unanswerable.

Added: host.service, a unit the system's supervisor manages, under a
spelling that stays proposed until an upstream experience report
settles it; k8s.node, the cluster's view of a machine; counters for
discarded edges and refused liveness promises; and two telemetry join
keys, the second one withheld where it cannot work rather than offered
everywhere with a caveat to read.