diff --git a/.github/workflows/mattermost-doc-alerts.yml b/.github/workflows/mattermost-doc-alerts.yml
index d3543b7b..ac386f7c 100644
--- a/.github/workflows/mattermost-doc-alerts.yml
+++ b/.github/workflows/mattermost-doc-alerts.yml
@@ -1,7 +1,5 @@
 name: mattermost-doc-alerts
 on:
-  issues:
-    types: [opened, closed, reopened]
   issue_comment:
   pull_request_review:
     types: [submitted]
@@ -23,7 +21,7 @@ jobs:
       - name: Strip Vercel HTML from event JSON
         id: preprocess
         run: |
-          CLEANED_JSON=$(jq -c 'if .comment.body then .comment.body |= gsub("\\s*<a\\b[^>]*vercel\\.com[^>]*>.*?</a>"; ""; "ig") else . end' "$GITHUB_EVENT_PATH")
+          CLEANED_JSON=$(jq -c 'if .comment.body then .comment.body |= (gsub("\\s*<a\\b[^>]*vercel\\.com[^>]*>.*?</a>"; ""; "ig") | gsub("\\[vc\\]: #[^\\n]*\\n?"; "")) else . end' "$GITHUB_EVENT_PATH")
           echo "event_json<<DELIM" >> "$GITHUB_OUTPUT"
           echo "$CLEANED_JSON" >> "$GITHUB_OUTPUT"
           echo "DELIM" >> "$GITHUB_OUTPUT"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9c47715f..8d16d47f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # CHANGELOG
 
+## v2.0.4
+
+FIX: The agent no longer deletes reserved shares from the controller during graceful shutdown or after an abnormal subordinate process exit. Previously, a `SIGTERM`/`SIGINT` (e.g., on system reboot) caused the agent to issue an unconditional `DeleteShare` against the controller for every active share, destroying the reservation for private shares created with `--share-token` and for public shares with reserved names. The reservation is now preserved unless the user explicitly released the share via `zrok2 agent release`, allowing the agent to reattach on the next start. (https://github.com/openziti/zrok/issues/1251)
+
 ## v2.0.3
 
 FIX: The Python SDK `ProxyShare` now rejects absolute proxy request paths before forwarding. This prevents a viewer from using an absolute URL path to make the proxy host request arbitrary internal or loopback services instead of the configured target.
diff --git a/Makefile b/Makefile
new file mode 100644
index 00000000..fe0e684d
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,18 @@
+.DEFAULT_GOAL := build
+TARGETS ?= ./cmd/zrok2
+
+.PHONY: clean build test
+
+clean:
+	rm -rf ui/node_modules ui/dist agent/agentUi/node_modules agent/agentUi/dist
+
+build:
+	npm --prefix ui install
+	npm --prefix ui run build
+	npm --prefix agent/agentUi install
+	npm --prefix agent/agentUi run build
+	go install $(TARGETS)
+
+test:
+	go test ./... -count=1
+	#go vet ./...
\ No newline at end of file
diff --git a/agent/agent.go b/agent/agent.go
index cf3646d1..e8b83cc6 100644
--- a/agent/agent.go
+++ b/agent/agent.go
@@ -385,8 +385,26 @@ func (a *Agent) manager() {
 				if err := proctree.WaitChild(shr.process); err != nil {
 					dl.Errorf("error joining share '%v': %v", shr.token, err)
 				}
-				if err := a.deleteShare(shr.token); err != nil {
-					dl.Errorf("error deleting share '%v': %v", shr.token, err)
+				// only delete from controller if the user explicitly released the share,
+				// or if it's an ephemeral (non-reserved) share. reserved shares must
+				// survive shutdown/crash so the agent can reattach on next start.
+				shouldDelete := outShare.releaseRequested
+				if !shouldDelete {
+					switch req := outShare.request.(type) {
+					case *SharePublicRequest:
+						shouldDelete = !req.hasReservedName()
+					case *SharePrivateRequest:
+						shouldDelete = !req.hasReservedToken()
+					default:
+						shouldDelete = true
+					}
+				}
+				if shouldDelete {
+					if err := a.deleteShare(shr.token); err != nil {
+						dl.Errorf("error deleting share '%v': %v", shr.token, err)
+					}
+				} else {
+					dl.Infof("preserving reserved share '%v' on controller for reattach", shr.token)
 				}
 				delete(a.shares, shr.token)