[argiad]

Why

The public one-liner (curl …/install.sh | sudo bash) reads main, and main is still at v0.10.0. None of the self-host fixes (#151, #153, #154, #157) or the install guides (#155) reach a new admin until a release lands there. This PR is the release commit. Tagging and moving main come after it merges, one step at a time.

Why 0.11.0, not 0.10.1

Since v0.10.0: 102 feat commits, migrations V040–V056, and a breaking library change (BroadcastBilling.broadcaster_is_paying and FleetObservation.transcoder_cost_minor removed). Before 1.0, features or breaking changes mean a minor bump.

What changes

File	Change
Cargo.toml, Cargo.lock	workspace 0.10.0 → 0.11.0 (13 crates; mm-fakestripe keeps its own 0.2.1)
web/packages/mm-{dashboard,viewer}/package.json, web/package-lock.json	→ 0.11.0. Private apps only; client, react and widget version through changesets
contracts/api/generated/mm_api_gen.yaml	info.version
deploy/versions.env	MM_VERSION, MM_SWITCH_VERSION, MM_WEB_IMAGE, MM_FAKESTRIPE_IMAGE → 0.11.0, the tags the v0.11.0 build publishes. deploy/lib/build.sh and the compose fallbacks follow
deploy/lib/lifecycle.sh	the mmctl upgrade --to usage example names v0.11.0 (there will be no v0.10.1)
CHANGELOG.md	[Unreleased] → [0.11.0] - 2026-11-08, plus a new empty [Unreleased] and compare links

CHANGELOG

• 54 entries added that merged PRs lacked (Added 18, Changed 9, Fixed 22, Security 5). All 119 PRs since v0.10.0 were checked; the rest were already described, internal (CI, tests, refactors), or dev-server template mirrors.
• Corrected: five entries said "Nothing changes in production today: the runner is not wired." The planner runs now (under the default fleet.mode = frozen it rents nothing and only releases the machines of ended broadcasts). One named DesiredStore::teardown; the method is order_teardown. One said /_mm/fleet has no public router; it is routed now.
• Release-time notes: relay (cascade) servers and manual relay leases are marked experimental. The ad-worker entry says matrixmedia-mm-media-worker is not public on ghcr yet, so pulling it needs docker login ghcr.io.
• Operators upgrading: the Changed section carries the Postgres 16 → 18 major upgrade (pg_upgrade or dump/restore before re-running the installer) and the new @mm-core Synapse service account.

Verification

• Rebuilt on development 903f2e3 (now includes fix(deploy): register accounts without leaving a session behind #159, docs(landing): fix broken doc links and rewrite the guides in plain language #156 and fix(docker): keep Synapse's admin API off the all-in-one image's port #161), still one commit, so the tag can sit on the release commit itself. Only CHANGELOG.md overlapped; it was regenerated with the same script, so the only differences from the first version are fix(deploy): register accounts without leaving a session behind #159's entry (Fixed) and fix(docker): keep Synapse's admin API off the all-in-one image's port #161's (Security), both under [0.11.0]. docs(landing): fix broken doc links and rewrite the guides in plain language #156 (landing pages on the demo site, plus CI) needs no entry. fix(deploy): keep Synapse's admin API off the internet #160 is not in yet: if it merges first, this commit is rebuilt again the same way.
• The first two cargo-test failures were CI infrastructure, not this change: the two self-hosted runners shared ~/.cargo, and the other runner's rust-cache cleanup deleted rustup mid-job (cargo: command not found, exit 127). docs(landing): fix broken doc links and rewrite the guides in plain language #156 gives each runner its own CARGO_HOME, and this push is the first run of this PR with that fix.
• deploy/ bats: 352 ok, 0 failed (1 environment skip: needs root). shellcheck clean with the CI flags.
• versions.bats checks that the first-party pins equal the Cargo version: passes.
• cargo metadata --locked: Cargo.lock is in sync. The npm lock and package.json versions match.
• The OpenAPI info.version follows version.workspace; CI's spec-gen re-checks it.
• fix(deploy): close five self-host installer gaps; mmctl upgrade --to; mm-core's own Synapse account #157 (merged just before this) was tested on a fresh Hetzner cx23 server: domain mode with Let's Encrypt, check before and after a backup, a re-run over a live install, upgrade --to, and the ea2edd6 → d24b7b0 upgrade path.

After merge (not done here; each needs the owner's OK)

Merging this PR publishes nothing: no tag, no images, and main stays where it is.

1. Annotated tag v0.11.0 on this commit and push it. build-images.yml builds and pushes the 0.11.0 images.
2. Check that the ghcr manifests exist for mm-core, mm-switch, mm-web and mm-fakestripe 0.11.0.
3. Move main to the tag, but only once the images exist, so the one-liner never pins missing images. main has required_linear_history, and development has had merge commits since 2026-10-20 (feat(fleet): RunPod create/destroy Provider adapter #113 through docs(landing): fix broken doc links and rewrite the guides in plain language #156), so a plain fast-forward will be refused. The owner decides how: an admin bypass, relaxing the rule, or a rebase-merge that leaves the tag off main.
4. Optional: GitHub Release notes from the [0.11.0] section.
5. Run the public one-liner (no MM_DEPLOY_REF) on a fresh server.

🤖 Generated with Claude Code