Repository navigation
v0.2.0: Bounded retry admission
Idempotent operations now require an explicit retryForMs. The first journal acquisition fixes the cutoff; retries, reopening and lease renewal cannot restart it. Changing a known window conflicts, including for completed actions. At the cutoff, an expired pending lease becomes indeterminate instead of authorizing another attempt. An active owner can still renew or record a receipt, and matching completed receipts continue to replay locally.
This is a breaking API and storage change. SQLite v1 records migrate atomically to schema v2 without inventing historical timestamps. Completed legacy receipts replay; legacy operations with an expired lease cannot obtain a fresh retry window. Corrupt records and partial schemas stop execution. Already-open v0.1 clients cannot write v1 records after migration, and newly opened v0.1 clients reject the new schema.
Before upgrading, stop every old executor and background retry, reconcile outstanding work where possible, and take a consistent SQLite backup. Add a fixed window to each idempotent intent while preserving its operation identity. The storage migration is forward only; mixed versions and database downgrades are unsupported. Custom stores must preserve the v2 fields and supply their own atomic migration. See the upgrade procedure and admission contract.
A finite retry admission window does not guarantee arrival at the provider before its key expires. A request admitted before the cutoff can pause and arrive after retention ends; an old executor can also continue running. The regression suite includes a counterexample that produces a second downstream effect. The journal cannot extend provider retention, cancel a remote request, fence an external service, or establish cross-service exactly-once execution.
Validation includes 116 core tests, eight targeted mutation checks, an independently installed TypeScript package consumer, and seven LangGraph integration tests. Linux, Windows and macOS run on Node 24.15.0 and 26, including the official SQLite checkpointer and process-kill examples. A separate local compatibility check uses the actual v0.1.2 release archive to verify migration, legacy receipt replay, and old-client rejection. Passing checks are not an independent security audit or production SLA.
Release assets contain the installable package archive, all six raw CI crash matrices, provenance, and SHA-256 checksums. Each matrix contains 100 runs: five strategies × four boundaries × five repetitions. These are controlled recovery experiments, not throughput measurements or 100 distinct failure types. Provider idempotency prevents duplicate effects in both idempotent controls; the journal adds durable local replay, coordination and explicit uncertainty. Framework dependencies remain isolated from the core library, which has zero runtime dependencies.
This release is distributed through source and archive assets. It is not published to the npm registry.
Source: c1cb8a8bcded56a0a084d597013b6c944ab84905.