New version released 0.6.0 yes, the beta tag is officially gone!

The library has been in use for some time now and has been stable. While I still have many ideas for new features, the core functionality and public API will likely stay as they are unless there is a clear need to change them.

In the future, I will keep releasing new features, and some will be marked as experimental just as I’ve done so far. If these features stand the test of time and prove useful, they will become part of the stable core.

Here’s the changelog:

## v0.6.0 - 2026-07-11
This release is aimed at making the system more resilient: a pluggable registry backend (ETS stays the default, with on-disk and hybrid options today and room for further storage integrations), safe migration — processes can defer their own migration and a node can be drained before shutdown — and experimental recovery mechanisms. It also includes a few bug fixes.

### Added
- Pluggable registry storage backend: new `:registry_backend` field on `%ProcessHub{}` (default `:ets`). Accepts `:ets`, `{:dets, opts}`, `{:durable_ets, opts}`, or `{Module, opts}` for a custom backend implementing `ProcessHub.Service.Storage.Behaviour`.
  - `:ets` — default in-memory backend (unchanged behaviour).
  - `{:dets, opts}` — on-disk persistence: sync-after-write durability, `repair: true` on open, and corruption rotation.
  - `{:durable_ets, opts}` — hybrid: in-memory reads with synchronous DETS mirroring for restart survival. Shares the DETS on-disk format, so a hub can switch between `:dets` and `:durable_ets` against the same `:path` and keep its rows.
- Opt-in migration consent: `:consent_settings` on `HotSwap`/`ColdSwap` (default `nil` — disabled, no overhead). A process that does `use ProcessHub.Strategy.Migration.MigrationConsent` is asked before it is migrated; `:defer` (or no reply within `:consent_timeout`) parks it in a deferred list, retried every `:retry_interval` and force-migrated after `:max_defer_time`. `ProcessHub.Service.Migration.migration_ready/2` signals readiness early. Primary instances only; processes started through wrapper modules are not detected.
- `ProcessHub.Service.Migration.drain/2` — blocking graceful node drain before shutdown. Removes the node from the distribution cluster-wide, migrates all local children away through the consent gate, and force-migrates whatever is still deferred at the `:timeout` deadline (default `60_000` ms). Returns `{:ok, %{migrated: n, forced: m}}`, or an error without touching children when no other node exists or the hub is partitioned/locked. Not reversible — restart the hub to rejoin.
- New hooks: `migration_deferred` (child ids parked) and `drain_completed` (drain summary).
- New guide `guides/Persistence.md` covering the persistence backends and the recovery lifecycle / operator runbook.
- **Experimental:** opt-in, marker-gated boot recovery via the single `:auto_recovery` field on `%ProcessHub{}` (default `false`). Accepts `false`, `true`, or a keyword list of `:marker_path` (operator override for the marker file location) and `:recovery_timeout_ms` (safety ceiling on the `:recovering` state, default `30_000`). A successful boot writes the marker file; on next boot the node skips replay if the marker is present, or rebuilds from disk if it is absent (state is `:recovering` → `:normal`). Disk replay restores only child specs — stale pids and metadata are dropped (fixes a restarted node pushing stale registry data into a healthy cluster).
  - API on `ProcessHub.Service.Recovery`: `recovery_state/1`, `await_normal/2`, `prepare_recovery/1`, and `prepare_recovery_cluster/1` (all safe to call on non-opted-in hubs).
  - New hooks: `recovery_state_changed`, `pre_recovery_replay` (**synchronous** — the coordinator awaits each handler), and `post_recovery_replay`.
- **Experimental:** `:nodeup_reconcile_interval` field on `%ProcessHub{}` (default `3000` ms; `0` disables) — fail-safe that merges a peer if the `pg` cluster-join notification is missed on a reconnection, closing a split-brain gap.

### Fixed
- Fast-restart stale bindings are now reaped on every backend (including default `:ets`). A node that restarts within `:net_ticktime` (no `:nodedown`) left peers pointing at its dead pids, since the rejoin sync only appends. Each node now broadcasts a per-boot token; peers purge a node's bindings only when its token changes (distinguishing a restart from a network flap). This replaces the previous purge signal that was gated behind `:auto_recovery`.
- Registry sync (`Synchronizer.append_data/2`) no longer overwrites a known child's local child-spec and metadata with a peer's copy on a pid change — it only updates the pid map. A node replaying stale durable state could otherwise clobber a peer's current spec, leaving a degraded process after redistribution.
- `mix docs` now builds with zero warnings: dropped the auto-generated `:supervisor` delegate docs, corrected doc references to the `init_opts`/`stop_opts` types and the `ProcessHub.Service.Storage.Behaviour` module, and removed a reference to a non-existent DETS compaction function.
- Janitor TTL cleanup no longer wipes a re-registered process. `purge_pending_registry/1` scanned the registry with a dirty `:ets.match` read and then deleted unconditionally; an incoming registration that re-populated a TTL tombstone between the scan and the delete could be erased. Cleanup now goes through `ProcessRegistry.delete_if_expired/2`, which re-validates expiry inside the registry process and skips the delete if the entry was re-populated or re-leased.
- Registry no longer keeps dead pids after quorum recovery. On quorum failure the distributed supervisor is terminated and its children are killed, but their registry entries are retained as the restart manifest. On recovery (`State.toggle_quorum_success/1`) the supervisor restarts the children with fresh pids that were only tracked internally, leaving the registry pointing at the dead pids — which were then propagated to the rest of the cluster on the next sync. Recovery now refreshes the local node's pids in the registry to the actually-running ones.