Prepares 0.10.0

[johnnyt]

Release prep for statifier_router 0.10.0 (sr-i8e5): the bump and the changelog promotion, and nothing else. No tag and no publish here: the merge and the annotated v0.10.0 tag at the merge commit follow the tagging row of CLAUDE.md's authority table; mix hex.publish is the operator's.

What changes

The four entries of .claude/wurk/release.md's file table, and no other file:

• mix.exs: @version from 0.9.2 to 0.10.0.
• CHANGELOG.md: a ## [0.10.0] 2026-10-02 section under a lead paragraph, its bullets carried over byte for byte from the fragments and ordered Added, Changed, Security; the header's changelog.d/ link moved to blob/v0.10.0.
• README.md: the install pin from ~> 0.9.0 to ~> 0.10.0, as a minor moves it.
• changelog.d/sr-t36w.md, changelog.d/sr-7zxe.md, changelog.d/sr-d2j1.md: deleted, promoted. changelog.d/ holds only its README.

The version word: 0.10.0, a minor

The whole-delivery wrapper (:around_delivery) is on main, so the release adds public surface and removes or narrows none; the version word follows the rule that the release is 0.10.0 when that option lands and 0.9.3 when it does not (ruled by the operator, 2026-10-01).

The closed-set question

For every promoted fragment and every lib/ file changed since v0.9.2 (git diff v0.9.2..main --stat -- lib: ten files), does it grow a closed set or public union a host pattern-matches (an outcome, a refusal reason, a door atom, an event list), and does it change an existing answer for a configuration that sets no new option?

Item	Grows a closed set	Changes an existing answer
fragment sr-t36w (Added)	yes, new surface under a new key: the door type :route | :partition | :basichttp, the refusal {:invalid_value, :around_delivery, value} and the wrapper's ArgumentError, reachable only when :around_delivery is set	no
fragment sr-7zxe (Changed)	no	no: the statement shape on Postgres changes, every reap answers the same counts (named in the release rulings)
fragment sr-d2j1 (Security)	no	the router's own debug query log no longer prints the location token on the three statements that bind it (named in the release rulings); no function answers differently
lib/statifier_router.ex	no	no: route/3 runs its work through Config.around_delivery/4, which calls the work directly when the key is unset; the rest is moduledoc
lib/statifier_router/addresses.ex	no	no: the reap's stamp and delete take one array on Postgres, an IN list elsewhere; counts unchanged
lib/statifier_router/basic_http.ex	no	no: rotate_location/2's upsert gains log: false
lib/statifier_router/basic_http/front.ex	no	no: the delivery runs through Config.around_delivery/4 (direct when unset); the token lookup gains log: false
lib/statifier_router/binding.ex	no	no: moduledoc and doctests only
lib/statifier_router/broadway.ex	no	no: the partitioner's bindings read runs through Config.around_delivery/4 (direct when unset), under the same ArgumentError rescue
lib/statifier_router/config.ex	yes, as for sr-t36w: the new key, its type, its refusal; new/1 refused :around_delivery as an unknown key before	no: a configuration without the key builds the same value in every existing field (the new field is nil) and refuses the same input in the same order
lib/statifier_router/delivery.ex	no	no: the location insert at create gains log: false; the rest is moduledoc
lib/statifier_router/migrations.ex	no	no: moduledoc only
lib/statifier_router/migrations/v04.ex	no	no: moduledoc only; the DDL is unchanged

Nothing changes for a configuration without the new key beyond the two changes the release rulings name (the query log and the Postgres reap statement), so the prep is not held. The lead says the token is gone from the router's own debug query log only: it is still in the execution's persisted state and in the query telemetry event.

Gate

Full mix quality on this exact tree under the repo gate lock and a machine slot, held across the commit (staged tree identical before and after the run, so the commit took no second run):

Running quality checks...

✓ Format: No changes needed (321ms)
✓ Compile: dev + test compiled (warnings as errors) (31.6s)

Running analysis stages in parallel...

○ Doctor: skipped (:doctor not installed)
○ Gettext: skipped (:gettext not installed)
○ Sobelow: skipped (:sobelow not installed)
✓ Isolated tests: Passed (2.0s)
✓ Doc links: 1 link checked (10ms)
✓ Dependencies: No unused dependencies (401ms)
✓ Credo: No issues (1.4s)
✓ Docs: No warnings (1.5s)
✓ Tests: 460 of 460 passed, 98.0% coverage (4.1s)
⋯ Dialyzer: building PLT (this is a one-time cost)
✓ Dialyzer: No warnings (PLT built this run) (47.7s)

✓ All quality checks passed!

mix hex.build builds statifier_router 0.10.0; the tar it wrote was deleted before the commit.

Refs: sr-i8e5