v0.2.0

celld v0.2.0 changes three foundations: how cells share memory, how
their state replicates, and how a fleet stays available when its
object store fails or slows.

Isolates and memory:

- Resident cells share isolates and run turn by turn on a shared
  pool. v0.1.0 held one OS thread and one isolate for each cell.
- A resident cell costs ~471 KB against ~3.4 MB in v0.1.0, measured
  linear to 2,500 resident cells (~1.2 GB) on one node. Memory no
  longer limits the resident population; admission and RSS shedding
  set the limit.
- A handler that awaits I/O releases its isolate between turns, so
  co-resident cells cannot stall each other.
- celld reclaims empty cell heaps and reuses retired isolate slots,
  so a long-lived node cannot leak isolates.
- jemalloc is the global allocator.

Two listeners:

- celld now separates the data plane from the control plane. The
  public listener (--listen) serves only your Worker's routes and
  /__celld/health. A new internal listener (--internal-listen)
  carries everything else: the operator API (/state, /shutdown) and
  all node-to-node peer traffic. Keep the internal port on a private
  network.
- A public listener on a non-loopback address requires an explicit
  internal listener. --advertise names the internal address, and
  celld diagnose probes peers at that address.

Replication and compaction:

- celld compacts many small level-0 replication objects into additive
  level-1 blocks (LTX v0.5.2 block format). Compaction is on by
  default and never deletes a source object.
- A takeover of a write-heavy cell reads tens of objects instead of
  thousands. In one measured case, a cell with 4,096 durable writes
  restored from 42 objects and 0.6 MB instead of 4,116 objects and
  19 MB, 3.8 times faster.
- A restore downloads the objects in its plan concurrently, under one
  ceiling for the whole node.
- A takeover pins the exact point in the replicated history that it
  restored from. celld never restores data that a fenced former owner
  uploads after that point, so a cell's history cannot fork and a
  failed write cannot reappear after a failover.
- Compaction runs off the request path with a bounded duty cycle. A
  node that restarts with a large uncompacted backlog drains it
  without blocking durable writes.
- celld and Litestream v0.5.16 can read both block and frame files.
  Litestream v0.5.11 can read only frame files.

Availability under storage faults:

- The time that remains on the last renewed lease bounds each lease
  renewal attempt, so one hung conditional write can no longer use
  the whole authority window. In a test that silently dropped all
  established storage connections for 20 seconds, a v0.1.0-class node
  fenced; a v0.2.0 node kept serving.
- The core event loop owns the lease timer on a dedicated thread.
  Restores, compaction, and diagnostics cannot delay it.
- celld logs each lease attempt at start and at completion, so a
  storage hang is distinguishable from a timer failure.

Shutdown and restart:

- SIGTERM starts a graceful drain. The drain hands each cell to a
  peer directly, so takeover does not wait for the lease TTL.
- POST /shutdown?handoff=preserve on the internal listener prepares a
  same-node restart. The replacement process resumes its local cell
  databases and performs no owner or replica reads.
- The drain waits for its ownership release writes and bounds each
  connection, so one idle connection cannot use the full deadline.
- The process exits without unwinding. This fixes a crash when a warm
  node stops.

Storage backends:

- A gs:// bucket selects Cloud Storage's generation-based
  compare-and-swap and authenticates with Application Default
  Credentials.
- A bucket can take a key prefix, so several independent fleets can
  share one bucket without collisions.

Workers surface:

- Wasm modules deploy and load as compiled WebAssembly.Module values.
  A workers-rs example shows the path, and older nodes refuse the new
  wasm-v1 deployment feature at deploy time.
- A new RPC example exercises entrypoints, callbacks, RpcTarget
  returns, and promise pipelining end to end. Cross-isolate stubs
  remain limited to single method calls on named entrypoints.
- Web Crypto and node:crypto expand: asymmetric import and export
  (SPKI, PKCS#8, JWK, PEM), generateKey, P-384 and P-521, Ed25519 and
  X25519, ECDH derivation, AES-CBC and AES-CTR, DigestStream,
  timingSafeEqual, and one-shot sign and verify.
- setWebSocketAutoResponse answers ping-style messages without waking
  the cell.

OpenTelemetry support (off by default):

- CELLD_OTEL=1 turns on OpenTelemetry traces and logs with no
  collector required: celld writes them directly to the bucket as
  Parquet under a telemetry/ prefix, and DuckDB can query them.
- A standard OTLP/HTTP collector is the alternative sink
  (CELLD_OTEL_SINK=otlp), and the usual OTEL_* variables apply.
- W3C trace context propagates end to end: celld adopts an inbound
  traceparent, and fetch spans, cell dispatch, and console logs join
  the caller's trace.

Overload:

- A stateless request that finds every slot held now waits, bounded
  by CELLD_ADMISSION_WAIT_MS, instead of an immediate refusal. At
  overload, the node no longer spends its capacity on refusals.
- CPU-based shedding is removed. RSS shedding (on by default since
  v0.1.0) is the only pressure trigger.

Configuration:

- celld validates every variable at startup, and an invalid value
  stops startup. Boolean variables accept only 0 or 1.
- Removed: CELLD_WORKERS, CELLD_MAX_COHOSTED, CELLD_MAX_CPU_PERCENT,
  CELLD_RESIDENT_LOW_WATER (ignored since v0.1.0), CELLD_VALIDATE,
  and the /js route.
- Renamed: CELLD_HIBERNATIONS is now CELLD_EVICTIONS.
- Changed: CELLD_IDLE_EVICT_S no longer defaults to 300; idle
  eviction is off unless set. CELLD_UNSAFE_PUBLIC_ADVERTISE takes 1,
  not on.
- Added, among others: CELLD_INTERNAL_ADDR, CELLD_MAX_STATELESS_ISOLATES,
  CELLD_ADMISSION_WAIT_MS, CELLD_LTX_COMPACTION, CELLD_SHUTDOWN_DRAIN_MS,
  and the CELLD_OTEL family.

Upgrading from v0.1.0:

- A v0.1.0 command line with a non-loopback --listen refuses to start
  until an explicit --internal-listen is added.
- The upgrade must not be a rolling update: stop every v0.1.0 node,
  then start the v0.2.0 nodes. v0.2.0 advertises the internal
  listener, which v0.1.0 peers cannot follow, and writes compacted
  block objects, which a v0.1.0 reader cannot restore. A fleet must
  not mix the two versions.

Co-authored-by: Nathan Whitaker <nathan@deno.com>
Co-authored-by: Connor Hindley <conn.hindley@gmail.com>
Co-authored-by: Yusuke Tanaka <yusuktan@maguro.dev>
Co-authored-by: Heyang Zhou <hello@su3.io>
Co-authored-by: Daniel Lee <danielylee@google.com>