@devrouter/cli 0.6.3 → 0.6.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrouter/cli",
-  "version": "0.6.3",
+  "version": "0.6.4",
   "description": "Local dev routing CLI with shared Traefik reverse proxy",
   "author": "Roland Schlaefli",
   "homepage": "https://github.com/rschlaefli/devrouter#readme",

package/upgrade-prompts/0.6.4.md

@@ -0,0 +1,67 @@
+# Upgrade to devrouter 0.6.4
+
+This release adds explicit stopped-primary replacement through
+`ensure <checkout> --replace-app` and preserves newer-writer classification in
+journal enumeration and capacity diagnostics. Replacement discards the primary
+container's writable layer while retaining proved dependencies and named/bind
+storage. It does not apply changed Compose overlays, replace data services,
+reset data or qualify retained maintenance.
+
+## Task
+
+After publication and installation are separately approved, select the exact
+published CLI through the consumer's existing package-manager convention.
+Verify the executable/version, update `devrouter.version` in `.devrouter.yml`
+and refresh existing agent guidance through `devrouter repo agents` within
+consumer adaptation authority. No configuration schema migration is needed.
+Do not start a consumer environment merely to verify the version change.
+
+Before this release writes lifecycle state, coordinate the same qualified
+release across participating agents, harnesses, controllers and source/package
+invocations sharing those journals. Check every PATH-visible executable and
+known wrapper/pin; obtain each participating owner's actual identity rather
+than treating PATH inventory as a complete fleet inventory. Unknown or competing
+writers hold activation. Changing a running controller/worker or global tool
+selection still needs its own authority. No global registry is required.
+
+A real 0.6.4 writer makes released 0.6.3 refuse direct journal reads/updates,
+global enumeration, ensure/exec/stop and controller recovery admission. This is
+expected fail-closed behavior, including after synthetic canonical-stop proof.
+The release qualification uses checksum-verified package bytes and isolated
+state; worker IPC and live consumer recovery remain separately unproved.
+An older CLI is not a supported rollback after newer writes. Preserve all
+journal bytes, writer stamps and replacement receipts. Recovery uses a qualified
+compatible CLI and exact ownership proof under the owner's runtime authority;
+never edit state or clear a receipt to bypass refusal.
+
+For an already-authorized preservation test, follow the full current
+`docs/DEVCONTAINER.md` replacement contract. Initial support is manual managed
+Compose on Devsy 1.24.0, canonical stopped-generation proof, unchanged committed
+managed source, qualified preserving hooks, retained non-primary dependencies
+and named storage. Allocated networks, capacity enrollment, anonymous mounts
+and namespace consumers refuse. Provider setup, builds/pulls and writable-layer
+loss are not inferred approvals.
+
+The durable replacement attempt is consumed before dispatch. Failure,
+cancellation, uncertainty, stop, registration changes, journal rollover and
+new request IDs never rearm it. Repeated replacement in the same checkout is
+unsupported. Use only supported ownership-proven stop/stop --repair for a
+blocked attempt; never retry with raw provider recreation. Keep the original
+application outcome distinct from infrastructure proof.
+
+## Validation
+
+1. Run static consumer checks for the actual version/guidance edits and report
+   every participating executable/harness identity and remaining unknowns.
+2. Under the receiving owner's separate runtime/data authority, perform only
+   its bounded supported preservation journey, proving actual retained data,
+   required application work, dependency/storage identity and readiness.
+3. End with canonical stop and exact stopped/route/worker proof unless the user
+   explicitly retains that environment. Missing proof remains unknown.
+
+## Report
+
+Report source/package integrity, exact selected executable and provider identities,
+participating adoption/downgrade limits, producing verification runs, retained
+receipt/data evidence, unresolved prerequisites and final runtime state. Published
+or installed compatibility alone does not establish consumer recovery.