@forgezero/runtime 0.1.21 → 0.1.22

package/README.md

@@ -972,6 +972,19 @@ scheduler.pause();            // stop scheduling, let in-flight finish
 await scheduler.runNow('rotate-provider-credentials');
 ```
 
+## Deployment handoff is typed state, not copied RAM
+
+The portable lifecycle for native and containerd services is deliberately smaller than a process snapshot. First report not-ready and close new HTTP and job intake. Existing requests, streams and queue handlers drain within one deadline. Durable jobs stay in the application store with an idempotency key, expiring lease and monotonic fence, so the candidate may reclaim unfinished work without allowing the old generation to commit. An optional handoff value may carry a bounded, versioned cursor or connection coordinate after schema validation. Closures, arbitrary heap objects, sockets and Vault plaintext never cross generations; the candidate resolves the same named Vault references through its own authorized runtime boundary. This is the lifecycle ForgeZero itself must use before it is offered to tenants.
+
+```text
+old: ready=false -> close intake -> drain HTTP/streams -> drain or release fenced jobs
+new: private health -> validate handoff -> resolve named Vault refs -> accept claims
+switch: route new HTTP -> observe old deadline -> stop old or roll back
+
+durable job = payload + idempotencyKey + leaseUntil + fence
+handoff value = versioned + schema-validated + size-bounded + non-secret
+```
+
 ## Status somebody can read during an incident
 
 Last run, duration, result, error and consecutive failures per job. Without it a job that has been failing for a week looks exactly like a job that has been succeeding.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/runtime",
-  "version": "0.1.21",
+  "version": "0.1.22",
   "type": "module",
   "publishConfig": {
     "access": "public",