Release 0.15.1 — task lifecycle hardening #666

Outcome

Shipped 0.15.1 with the task-lifecycle hardening, Windows CLI installation fix, and related operator documentation. All release work below is complete.

Included in 0.15.1

• Skip paths archive sibling messages but never terminalize sibling step_tasks rows, leaving status='started' tasks on completed runs #638 — terminalize active task rows under skipped steps, fixed by Skip paths archive sibling messages but never terminalize sibling step_tasks rows, leaving status='started' tasks on completed runs #649.
• Failed runs leave unfinished sibling tasks queued or started instead of cancelled #645 — cancel unfinished tasks when runs fail, fixed by fix(core): terminalize unfinished tasks when runs fail #663.
• requeue_stalled_tasks() uses flow timeout instead of effective step timeout #621 — use the effective step timeout during stalled recovery, fixed by fix(core): use effective step timeout for stalled tasks #664.

All three changes landed after 0.15.0 and shipped through #659.

Critical path

• Make start_tasks() apply task visibility before handlers run #656 — make start_tasks() apply visibility before handlers run. Fixed by fix(core): guarantee task visibility extension in start_tasks() #667.
• Consolidate the four unreleased Core migrations into one task_lifecycle_hardening migration against the 0.15.0 baseline. Done: pkgs/core/supabase/migrations/20260904095427_pgflow_task_lifecycle_hardening.sql.
• Preserve and test every migration-only repair and ordering requirement listed below. Both DATA REPAIR blocks present in the required order; core-pgtap green on Version Packages #659.
• Require every Version Packages #659 check to pass. Done: every check green on merged head f912cccc (ci(windows): fix smoke install on release branches + 0.15.1 news article #671 fixed windows-package-smoke by packing the full dsl+core+cli closure and installing the tarballs in one npm install).
• Merge Version Packages #659, which publishes 0.15.1 through Changesets. Merged as 5118509d; Release workflow published pgflow, @pgflow/core, @pgflow/dsl, @pgflow/client, @pgflow/edge-worker at 0.15.1 on npm.

Parallel release work

• Bug: postinstall script fails on Windows #610 — remove the Windows-breaking CLI postinstall and add a packed-tarball Windows smoke job. Fixed by fix(cli): remove Windows-breaking postinstall chmod #669; job lives in .github/workflows/windows-smoke.yml.
• Document the worker-function enable fence for production deployments #654 — document the worker-function enable fence for production deployments. Fixed by docs: fence worker_functions row before deprecating workers in update guide #670.
• Docs: update “Delete Flow and its Data” — pgflow.delete_flow_and_data available since v0.10.0 #608 — correct the delete_flow_and_data() documentation. Fixed by docs(website): drop manual-install instructions for delete_flow_and_data #668.
• Publish pkgs/website/src/content/docs/news/pgflow-0-15-1-task-lifecycle-hardening.mdx. Landed on main via ci(windows): fix smoke install on release branches + 0.15.1 news article #671.

Consolidated migration result

Atlas generated the structural diff, while #667 and #659 preserved the migration-only data repairs that Atlas cannot infer. The final migration contains:

1. The final step_tasks.valid_status constraint, including skipped and cancelled.
2. The final definitions and attributes of every changed function.
3. The Skip paths archive sibling messages but never terminalize sibling step_tasks rows, leaving status='started' tasks on completed runs #638 repair that marks active tasks under skipped steps as skipped.
4. The Failed runs leave unfinished sibling tasks queued or started instead of cancelled #645 repair that marks remaining active tasks under failed runs as cancelled.
5. Repair order: skipped-task repair before failed-run cancellation.

The review checked function signatures, return types, SECURITY DEFINER, SET search_path, grants, statement order, and atlas.sum. Only disposable databases consumed the replaced unreleased migrations. The release fixture started from 0.15.0 and checked both historical repairs and final runtime behavior.

Windows package check

#669 and #671 added one windows-latest packed-tarball smoke job rather than a full Windows matrix. It installs the tarballs with lifecycle scripts enabled and runs the npm-created pgflow.cmd --version shim.

News article

The release published pgflow 0.15.1: Reliable Task Finalization and Recovery, covering #638, #645, #621, #656, #610, automatic historical repair, and normal update instructions.

Release boundary

#647 remains outside 0.15.1. The current queue sequence optimizes development simplicity: remove the legacy compiler in #647, implement #650 queue identity, implement #651 private per-step queues, validate the combined stack, then publish one stable release. #653 is authoritative for the current plan.