v0.25.0

Added

• Daemon.Idle reclaims a session's lane slot after that long with no frame and
  no request in flight; 15m when zero. A peer that neither sends another frame
  nor closes its socket — suspended, asleep, or partitioned behind a connection
  the kernel never tears down — held its slot until the daemon restarted, so a
  machine running enough concurrent clients exhausted the lane and every later
  attach was refused. The timer runs only between requests, so a slow request is
  never idle; expiry closes the transport, and that close is what frees the slot.
• ErrSessionCapacity, the public identity for a lane with no free session slot.
  classifyWire preserves it rather than passing it through unclassified, so a
  consumer can tell transient saturation from a daemon that is not installed —
  captain-hook reported the former as the latter and sent operators to reinstall
  a healthy host.

Fixed

• A business lane attaching into a momentarily full slot table retries inside its
  existing bounded attempt budget with a short backoff, instead of surfacing the
  refusal on the first attempt. The backoff stays short deliberately: the slot is
  freed by another peer finishing, not by waiting, so a caller starved past the
  bound is told rather than held.

Removed

• The legacy bbolt sweep in internal/proc, and the go.etcd.io/bbolt
  dependency with it. Store.Recover no longer takes a legacy []string
  parameter: both call sites already passed nil, so every machine the fleet
  runs settled its prior generation from the JSON record alone. The dependency
  cone loses bbolt entirely, which is what DESIGN §8 said the cut was for.
• The pre-rename deployment-metadata migration in deploy. A .daemonkit-deploy
  tree is the only shape any install has, so archiveLegacy had no
  .daemonkit-deployment tree left to move aside and layout no longer carries
  a path to one.
• Client.Stop's markerless-plist fallback. Every plist daemonkit writes has
  carried the ownership marker since v0.21, so removeAgent is
  launchd.Remove and nothing else — a plist that fails its ownership proof is
  now refused rather than deleted through the escape.
• docs/MIGRATING-0.21.md, the v0.20.x repin guide. The migration it describes
  closed with v0.21, and nothing referenced the file.
• launchd.SessionType, its five constants, launchd.ParseSessionType, and
  launchd.Agent.LimitLoadToSessionType. v0.21.0 deprecated them and named a
  future breaking release as where they go; this is it. The field had been
  accepted and zeroed ever since — never rendered into the plist, never stored
  with the agent, cleared from every agent daemonkit canonicalized — and no
  fleet consumer set it. acceptIgnoredSessionType goes with them, so
  canonicalAgent and canonicalPlanAgents now only copy reference-typed
  fields. The export census drops eight symbols, 522 → 514.
• Breaking. launchd.RemoveUnmarked and launchd.ErrMarked — the
  pre-marker era's named waiver of the ownership gate, and the sentinel that
  kept it from reaching a marked plist. The waiver outlived what it waived:
  Client.Stop gave up its markerless fallback above, captain-hook dropped its
  own pre-v0.21 LaunchAgent sweep, and cc-pool's cross-era migration was the
  last caller anywhere in the fleet. Remove is now the only verb that takes a
  plist down, so the applier's removeWhen goes too — with one plist shape
  left to accept, remove reads the marker itself rather than through a
  predicate. The export census drops two more symbols, 514 → 512.

Fixed

• Every rendered LaunchAgent now carries PATH (AgentPath, Homebrew-first).
  launchd's default PATH has no Homebrew prefix, so a daemon execing git
  reached the Xcode shim at /usr/bin/git, which re-execs Xcode's binary and
  pays a second endpoint-security exec check per call — enough to push
  cc-review's turn-start hook past Claude Code's 10 s budget on a loaded
  machine. launchctl config user path only applies after a reboot and never
  reaches a job bootstrapped before it, so the value now rides the plist.