@devrouter/cli 0.0.66 → 0.0.68

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrouter/cli",
-  "version": "0.0.66",
+  "version": "0.0.68",
   "description": "Local dev routing CLI with shared Traefik reverse proxy",
   "author": "Roland Schlaefli",
   "homepage": "https://github.com/rschlaefli/devrouter#readme",
@@ -48,6 +48,7 @@
     "test": "vitest run && pnpm test:process",
     "test:package": "./scripts/package-smoke.sh",
     "qualify:lifecycle": "node --import tsx scripts/qualify-lifecycle.ts",
+    "qualify:capacity": "node --import tsx scripts/qualify-capacity.ts",
     "qualify:controller": "node --import tsx scripts/qualify-controller.ts",
     "qualify:stop-drift": "node --import tsx scripts/qualify-config-drift-stop.ts",
     "test:process": "bash scripts/test-devrouter-process.sh",

package/upgrade-prompts/0.0.67.md

@@ -0,0 +1,41 @@
+# Upgrade to devrouter 0.0.67
+
+This patch release makes the reliability journal incapable of deadlocking
+lifecycle commands and completes managed stop when a registration was deleted
+rather than replaced. It restores workspaces that every canonical command
+previously refused with "Lifecycle admission is blocked." after a saturated
+journal held a drained `INTERRUPTED` ensure.
+
+## Task
+
+Install the published release and update `.devrouter.yml` devrouter.version to
+0.0.67. No schema migration or configuration change is required. Do not change
+the committed configuration, delete registrations, containers, or source files,
+and do not reset lifecycle state manually. Recovery runs inside the existing
+canonical commands under their normal locks, ownership proofs, and journal
+accounting. If a command reports a live worker, wait for it or re-run later;
+`workspace journal settle` refuses while a worker outcome is still observable.
+
+## Validation
+
+On a workspace whose commands were refused with "Lifecycle admission is
+blocked." (saturated journal with a drained interrupted ensure), run
+`devrouter stop <path>` and confirm it completes — including the case where the
+Devsy registration was already deleted and every workload is positively absent
+— then run `devrouter ensure <path> --json` and confirm admission succeeds with
+routes published. On a record whose worker is provably gone and that still
+refuses progress, run `devrouter workspace journal settle <path> --json` and
+confirm it reports the settled operation, then retry `ensure`. Confirm refusal
+messages now name the blocking field and remediation. For workspaces that never
+hit the deadlock, confirm existing stop, ensure, exec, and `devrouter doctor`
+behavior is unchanged, and confirm a downgrade attempt (record written by a
+newer CLI than the installed one) fails with an explicit upgrade instruction
+instead of a mid-flight refusal.
+
+## Report
+
+Report the tested CLI version, the exact workspace path or synthetic fixture,
+each command result (stop, ensure, settle if used) with route state after the
+run, any diagnostic failure output verbatim, and whether the
+deleted-registration case, the saturated-journal case, or only the unchanged
+retained path was exercised.

package/upgrade-prompts/0.0.68.md

@@ -0,0 +1,51 @@
+# Upgrade to devrouter 0.0.68
+
+This patch release adds opt-in capacity admission for enrolled managed
+checkouts and makes lock failures actionable. Machines without an enabled
+capacity policy keep the current manual lifecycle unchanged.
+
+## What changed
+
+- **Capacity admission (opt-in).** With an explicitly enabled
+  `capacity-policy.json` under Devrouter home and an enrolled checkout, the
+  controller admits `ensure` and `exec` before dispatch. The CLI follows the
+  decision with bounded reconnecting waits that survive controller restarts
+  while the request stays queued, worker results are journalled atomically, and
+  `stop` bypasses admission. Without an enabled policy, behavior is unchanged
+  (ADR 0008).
+- **Actionable lock diagnostics.** A lock that cannot prove its owner now names
+  the failing inspection stage, the activity, the exact lock path, a portable
+  reproduction command (`LC_ALL=C ps -o lstart= -o command= -p <any-live-pid>`),
+  and the permitted-host-context remediation. Locks stay fail-closed and no
+  identity fallback is attempted. `devrouter controller` commands additionally
+  print the underlying failure cause on stderr while keeping the stable
+  `controller-unavailable` JSON contract on stdout.
+
+This release does not prevent host OOM and does not perform autonomous agent
+recovery. Capacity admission bounds what Devrouter starts when an operator
+enables it; it is not a memory guarantee.
+
+## Task
+
+Install the published release and update `.devrouter.yml` `devrouter.version`
+to 0.0.68. No schema migration or configuration change is required. Do not
+create a capacity policy, enroll a checkout, or change machine policy unless the
+operator asks for it. Do not hand-edit `~/.config/devrouter`.
+
+## Validation
+
+Confirm ordinary behavior is unchanged on a machine without
+`capacity-policy.json`: run `devrouter ensure <path> --json`, then
+`devrouter stop <path>`, and confirm routes publish and release as before.
+Confirm `devrouter doctor --repo <repo>` reports no new failures. If an operator
+has enrolled a checkout, confirm `ensure` and `exec` follow the reported
+admission decision and that `stop` still bypasses admission. If a lock cannot
+prove its owner, confirm the error names the inspection stage, the lock path,
+and the remediation command instead of a bare refusal.
+
+## Report
+
+Report the tested CLI version, the exact workspace path or synthetic fixture,
+each command result (ensure, stop, and doctor) with route state after the run,
+whether a capacity policy was enabled or absent, any diagnostic failure output
+verbatim, and whether admission or only the unchanged manual path was exercised.