Release 1.13.0, and m0 0.10.0

[codetalcott]

The minor release that carries the rest of the 2026-10 lightbug fork review: everything on main since 1.12.1, cut from 71a1282.

What it changes (CHANGELOG [1.13.0])

• LF72 / A41, C19. A client pipelining a burst of requests held the event loop for more than a second, so every other connection on that loop waited. A burst of 20,000 small GETs now costs 1.2 µs a request, down from 78.
• LF73 / A42. On Linux, a 100 Continue could be cut short ahead of its response when the send buffer was full.
• LF75 / A5. On Linux, a client still sending its headers at the header timeout read a reset instead of its 408.
• LF25 / C17, I42. The memory a large upload grew goes back to the allocator when its connection closes.
• The rest of the fixes:
  • half-close and pipelining (A27–A30);
  • streams at shutdown (D12, D13);
  • CONNECT answered 501 (B18);
  • request targets and Host (B19, LF64);
  • transfer codings (B21);
  • listen addresses (LF44–LF48);
  • WebSocket framing;
  • the fork's dead code removed.

One change touches the served contract. A port outside 1–65535 (--port 0, M0_PORT=0) is now refused at startup with exit 78 (LF56). Before, M0_PORT=0 served on a port the kernel chose, and --port 0 exited 2. It is listed under Changed with the old and new behaviour; the owner chose to ship it in this minor release.

The m0 wheel ships the framework's source, so the bump is m0 0.10.0, a minor bump of a 0.x package. The removed fork names are ones a Mojo application could import.

This PR

• d09d541: the bump. It covers pyproject.toml, M0SERVE_VERSION, uv.lock, QUICKSTART's echo, m0's __version__ 0.10.0, CHANGELOG [1.13.0] with an introduction, and the audited note's release line. The two test-only entries (LF68, LF76) leave the release notes.
• 6bd05ca: the timing stage's Linux and pool-probe artifacts.
• 8c20f81: the quiet-machine A/Bs. It has both artifacts, offload.mojo's three corrected comments, both Known issues moved to Recently resolved (6 open), and the runbook, RELEASING and the audited note updated.

Pre-release gates: all green, run on d09d541 and its two follow-ups

stage	gates	result
timing: first, on a quiet machine, mediaanalysisd paused	probe-pool-fairness, probe-pool, stress-asgi, bench-linux-conclusions	pass. Pooled p99 0.1/0.2/0.2 ms; stress-asgi 30/30 in both modes; the four Linux conclusions hold, and ASGI per core still INVERTS (0.92) as BENCHMARKS.md already says
quiet-machine A/Bs (LF24, LF22)	pool_ab.py LF24, pool_ab.py LF22 at load 1.4–2.1	no difference in either, so both Known issues retire (8c20f81). LF24: the strides stay, and the three cache-line claims are corrected. LF22: about 2 µs either way, so the look stays. A first pass straight after stress-asgi (load 4–20) was discarded
quick	fuzz-request-long, soak-apps, smoke-wheel, the four browser gates, sabotage-differential 9/9, test-postgres-server	pass
container	autobahn (the I17 baseline), stress-pool 20/20 rounds and 40/40 holds in all three wake modes, probe-mojo-image, sabotage-mojo-image 10/10	pass
sabotages	notes-login 15/15, blobs 31/31, outbox-cap 4/4, m0-wheel 26/26, host 70/70	no MISSED, BROKEN or NOT APPLICABLE
images	sabotage-scaffold: 69/69 outside image: (1385 s), then the 12 image: rules one at a time, with a builder prune and an fstrim between each (70–130 s each)	81/81, no MISSED

After it merges

1. RELEASING's m0 checks on the merge commit, then the m0-v0.10.0 tag. The owner approves pypi-m0.
2. The v1.13.0 tag. The owner approves pypi.
3. The post-upload checks, then a docs PR with the release record.

🤖 Generated with Claude Code