chore(release): duroxide 0.1.32

[Affan Dar (affandar)]

Summary

Prepares the duroxide 0.1.32 release. 0.1.32 is the first release with the fixes from #67 (queue and signal races) and #65 (shutdown stops every runtime task). This PR changes release metadata only. It has no code changes.

File	Change
Cargo.toml	Version 0.1.31 → 0.1.32. sqlite-stress keeps its own version.
CHANGELOG.md	Moves the Unreleased entries into ## [0.1.32] - 2026-10-11, adds the crates.io release line, and ends each moved entry with its PR number, (#67) or (#65).
CHANGELOG.md	Rewrites one sentence that pointed to a future release PR. It now says 0.1.31 is not published, 0.1.32 is the first release with these fixes, and the execution threshold stays 0.1.31.
README.md	The latest-release notice now points to v0.1.32.

Notes for reviewers:

• 0.1.31 is reserved and is not published (see RELEASE_POLICY.md). The threshold in the code stays 0.1.31. Executions that start on 0.1.32 or later use the new race handling. Older executions keep the old one.
• One public API change, already in the changelog under Changed: TurnResult::ContinueAsNew (in duroxide::runtime::replay_engine) has a new field, unconsumed_queue_arrivals. Code that builds this variant, or matches it without .., must be updated.
• Shutdown behaves differently (Make Runtime::shutdown actually stop the tasks its dispatchers spawn (redux) #65, in the changelog under Changed and in docs/migration-guide.md):
  • shutdown(timeout_ms) returns as soon as all runtime tasks stop. timeout_ms is now a grace period, not a fixed sleep.
  • An activity still running when the grace period ends is aborted, and its work item is delivered again after its lock expires.
  • Providers must handle a dropped fetch future and keep acknowledgement atomic (see docs/provider-implementation-guide.md). Provider crates should check this before upgrading.
• This branch is based on main after Make Runtime::shutdown actually stop the tasks its dispatchers spawn (redux) #65 and validation: retry a retryable abandon in the continue-as-new backoff test #70. validation: retry a retryable abandon in the continue-as-new backoff test #70 fixes the provider validation test that failed this PR's first CI run (see below). It needs no changelog entry, because that test is new in this release.
• Other main commits since v0.1.30 get no changelog entries. They change CI, release docs and the toolchain pin, not the crate code:

PR	Change
#50	Pin GitHub Actions to full commit SHAs
#51	Bump actions/checkout
#52	Document the internal release policy
#63	Pin the repository Rust toolchain to 1.97.1

Checklist

• Tests added/updated (not needed: release metadata only)
• Regular tests pass locally (cargo nt), run through ./run-tests.sh
• Doc tests pass locally (cargo test --doc --all-features)
• Docs updated
  • Existing docs updated where behavior changed (CHANGELOG.md, README release notice)
  • New doc added under docs/ if introducing a new area (not needed)
  • Linked from docs/README.md (not needed)

Validation

Run on the files of this branch (main with #65 and #70, plus the release edits) with Rust 1.97.1, cargo-nextest 0.9.118, macOS 26.7.

Check	Result
cargo fmt --all -- --check	pass
cargo clippy --all-targets --all-features -- -D warnings -A clippy::uninlined_format_args	pass
./run-tests.sh	All features: 1,239 passed, 1 skipped. No features: 1,236 passed, 1 skipped.
cargo test --doc --all-features	46 passed, 74 ignored
cargo package --allow-dirty	pass: 275 files, 5.9 MiB (1.5 MiB compressed), verify build passed
cargo package --list --allow-dirty	275 files, checked by hand

cargo package warns that it skips the queue_race_upgrade test. That is expected: #67 excludes tests/queue_race_upgrade.rs and tests/fixtures/** from the package.

Package contents compared with the published 0.1.30 crate (263 files):

• Added (13): .agents/skills/release-preparation/SKILL.md, .github/dependabot.yml, RELEASE_POLICY.md, design/queue-race-d2-follow-ups.md, src/provider_validation/race_replay.rs, tests/can_abandon_failure.rs, tests/cancellation_corner_cases.rs, tests/common/cancellation_history.rs, tests/common/long_polling.rs, tests/replay_engine/positional_unbound_races.rs, tests/replay_engine/queue_races.rs, tests/runtime_version_warnings.rs, tests/shutdown_tests.rs
• Removed (1): prompts/duroxide-crate-release.md
• No generated files, local build output or secrets.

Extra checks on main + #65 + #70 (before the release edits):

Check	Result
shutdown_tests, 20 repeated rounds	all passed
long_poll_tests ×10, continue_as_new_tests ×5	all passed
SQLite stress: parallel orchestrations, large payloads	100% success, 0 failures
worker_reliability_test, 120 rounds with and without #65	1 and 2 failed rounds: the known race in #69, same rate either way

Test failures seen while preparing this release

Where	Test	Cause	Status
CI on this PR's first push	sqlite_provider_validations::continue_as_new_unregistered_backoff	The test treated a retryable SQLite "database is deadlocked" error on abandon_orchestration_item as fatal. Failed 1 in 100 local runs.	Fixed by #70. 200 of 200 runs pass with the fix.
Local runs	worker_reliability_test crash tests	A race in the tests: they assert the activity has not completed yet, but nothing holds it back. About 1 round in 100. Unchanged since v0.1.30.	Tracked in #69.

Dependency audit

cargo audit (advisory database fetched 2026-10-11, 1,296 advisories) reports one advisory: RUSTSEC-2023-0071 for rsa 0.9.10. This is the same unused lockfile entry noted in the 0.1.30 release PR. cargo tree --all-features --target all -e all --invert rsa prints nothing, so no dependency path reaches it. #65's tokio-util change (minimum 0.7.12, rt feature) adds no crates. No other advisories or warnings.

Links / Design notes

• Fixes in this release: Fix queue and signal race replay, exact continue-as-new carry, input loss between executions, and KV key order #67, Make Runtime::shutdown actually stop the tasks its dispatchers spawn (redux) #65, plus the test fix in validation: retry a retryable abandon in the continue-as-new backoff test #70
• Version rules: RELEASE_POLICY.md
• After this PR merges, the v0.1.32 tag goes on the merge commit. That step needs separate approval.