@fabricorg/platform-host 0.2.0 → 0.3.1

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @fabricorg/platform-host
 
+## 0.3.1 — 2026-07-19
+
+- Make policy, event, and adapter checkpoints deterministic and replay-safe.
+- Resume idempotent interrupted actions without repeating succeeded adapters.
+- Fail stale non-idempotent work terminally for explicit operator reconciliation.
+
+## 0.3.0 — 2026-07-19
+
+- Add tenant-scoped stable command idempotency and terminal replay.
+- Add atomic Postgres claim leases, bounded store-backed workers, and expired-work recovery.
+- Add operator listing and event replay capabilities to recoverable stores.
+- Ensure unexpected lifecycle failures, including unregistered adapters, end terminally.
+- Add direct coverage for the Postgres/Lakebase store contract and worker recovery.
+
 ## 0.2.0 — 2026-07-19
 
 - Add pre-persistence action-parameter redaction so durable audit records cannot retain forbidden secrets.

package/README.md

@@ -18,6 +18,17 @@ Actor → ActionInvocation → PolicyEvaluation → StateMachine → Handler →
 worker entry point. With no dispatcher the host executes inline, which is intended for tests and local
 development only.
 
+Production polling workers can use `createStoreBackedActionDispatcher()` plus
+`runPlatformActionWorker()`. The pending invocation row is the durable queue item; workers claim
+bounded batches with an atomic lease and `FOR UPDATE SKIP LOCKED`, and an expired `running` lease is
+recoverable after interruption. Pass a stable `idempotencyKey` to `submitAction()` so retries resolve
+to the original tenant-scoped invocation instead of creating another mutation.
+
+Lifecycle records use deterministic checkpoint ids. Recovered idempotent actions do not repeat an
+adapter that already reached `succeeded`, and event, policy, and adapter writes are append-safe. A
+stale action that was not declared idempotent fails terminally for manual reconciliation instead of
+silently rerunning unknown side effects.
+
 Sensitive values must not be passed as action parameters. Stage them in tenant-bound encrypted storage
 and pass an opaque identifier instead; action parameters are intentionally durable audit evidence.
 Hosts should additionally configure `redactActionParameters` as a fail-safe allowlist for actions