GA of the PR2 + PR3 hardening release train. Byte-identical to 0.9.9-rc.3 (same commit dfec1c22) — a clean, suffix-free tag for the production rollout; all soak/failover validation from the staging campaign applies to these exact bits.
What's in 0.9.9 (vs 0.9.8-rc.1 in prod today)
- git resilience (PR3, #924): fetch timeout + zombie tracking + per-source backoff — a broken/unreachable customer repo can no longer wedge a worker or stall boot; server-side clone wait; boot 451s → ~182s with the tuned values.
- memory/disk leak fixed (PR2, #923) incl. fleet-purge delivery to client-less workers (#945, P5).
- broadcaster resilience (#945, P9):
permit-broadcaster0.2.7 — TCP keepalive on the Postgres backbone; a Multi-AZ failover of the broadcast DB is detected in ~60s and auto-recovers instead of leaving readers silently deaf. - Operability: namespaced boot metrics (P1),
OPAL_REPO_WATCHER_ENABLEDgating in scopes mode (P3), bounded sync-failure log volume (P6).
Rollout: via permit-deployments (prod values PR). Constraint: do not add keepalives* params to OPAL_BROADCAST_URI until the whole fleet is ≥ 0.9.9; the defaults need no URI change.
Full changelog: 0.9.9-rc.2...0.9.9