Promote v0.0.2 to production

[mrubens]

Promote v0.0.2

develop is ahead of main and product version 0.0.2 is not tagged yet.

• Merge this PR with a merge commit (do not squash or rebase).
• Merging publishes a GitHub Release for v0.0.2 and triggers the existing GHCR v* image publish (latest channel).

Changelog

0.0.2 (2026-07-10)

Patch changes

• Seed the product version lineage so the first automated release becomes 0.0.2 above the existing v0.0.1 tag.

[roomote-roomote]

Re-reviewed the one new commit since the last review (#147 — "Address review findings on the diagnostic rail and death certificate"). The death-certificate false-positive is fixed: deliberate reconnect/restart/teardown kills route through terminateSubprocess, which now calls markExpectedSubprocessExitIfAlive before SIGTERM (apps/worker/src/run-task/reconnectable-harness.ts:455), and certifyExit skips certification for a marked, still-alive process (.../opencode-server/start.ts:280); a process that already exited on its own (a genuine crash) is left unmarked and keeps its certificate. The markExpectedSubprocessExitIfAlive guard (exitCode !== null || killed) and the WeakSet keyed on the exact ResultPromise that start.ts holds are correct, so the crash-first-disconnect ordering the earlier review cited is preserved. Supporting changes are sound: the recorder now applies kind last so caller details can't override the classification, hash-shaped values keep an 8-char prefix instead of full redaction to preserve git SHAs/digests, memory→memoryAfterExit is renamed consistently end-to-end (no stale references), persistent stdout/stderr tail readers now capture the process's last lines for its whole lifetime rather than only during the startup URL wait, and run-events fetches newest-first-under-limit then reverses so a busy task can't push diagnostics out of the 500-event window. No new issues. Death-certificate item marked resolved; the baseline-migration item is still open on this release PR. 1 issue outstanding. See task

• Baseline migration rename can break upgrades from v0.0.1 — packages/db/drizzle/meta/_journal.json (idx 0) renames the baseline 0000_stiff_lorna_dane → 0000_dapper_smasher and bumps its when from 1783526937997 to 1783649825042. v0.0.1 (the current main) shipped only 0000_stiff_lorna_dane, so any database that already applied it has __drizzle_migrations.created_at = 1783526937997. packages/db/src/run-migrations.ts:30 runs drizzle-orm's migrate(), which re-executes any journal entry whose when exceeds the last recorded created_at. Because the new baseline's when is larger, the migrator will re-run 0000_dapper_smasher, and its first statement is a non-idempotent CREATE TABLE "auth_accounts" (packages/db/drizzle/0000_dapper_smasher.sql:1), which fails with "relation already exists" on a populated v0.0.1 database. This is safe for fresh installs and is fine if no persistent v0.0.1 database exists yet (the changeset name seed-release-workflow suggests a deliberate baseline reset); please confirm no self-hosted or production v0.0.1 database will run this upgrade path, otherwise the migration should keep the original baseline tag/when.
• Death certificate fires on intentional reconnect/restart, not just genuine crashes — apps/worker/src/sandbox-server/lib/harnesses/opencode-server/start.ts:263 only suppressed the exit certificate when cancelSignal.aborted, so deliberate SIGTERM teardown during reconnect/restart was mis-certified as an unexpected exit and paged Sentry on every routine restart. Resolved in [Fix] Address review findings on the diagnostic rail and death certificate #147: terminateSubprocess now calls markExpectedSubprocessExitIfAlive(subprocess) before subprocess.kill('SIGTERM') (apps/worker/src/run-task/reconnectable-harness.ts:455), and certifyExit skips certification when isExpectedSubprocessExit(spawnedSubprocess) is true (apps/worker/src/sandbox-server/lib/harnesses/opencode-server/start.ts:280). Both cited paths — disconnect recovery (reconnectable-harness.ts:336) and restart (reconnectable-harness.ts:439) — route through terminateSubprocess, and the exitCode !== null || killed guard ensures an already-dead crash is left unmarked so its certificate still fires (covered by expected-exit.test.ts).

[roomote-roomote]

Closing: this promote PR has head develop, so it isn't frozen — #145 (merged after the 0.0.2 version bump) would ship inside v0.0.2 without appearing in its changelog. Once #150 merges, the Release workflow will cut a frozen release/v0.0.2 branch pinned at eaee303 (the #143 version commit) and open a new promote PR from it; #145 then rolls into 0.0.3 as normal. Note: if anything else merges to develop before #150, the old workflow will re-open a develop→main promote PR — just close it again or hold merges until #150 lands.