keiro-ops-0.12.0.0: CHANGELOG.md

# Changelog

All notable changes to `keiro-ops` are recorded here. The format follows
[Keep a Changelog](https://keepachangelog.com/), and the package follows the
[Haskell Package Versioning Policy](https://pvp.haskell.org/).

## Unreleased

## 0.12.0.0 — 2026-08-14

### Breaking Changes

- Requires `kiroku-store >=0.7 && <0.8` for explicit checkpoint lifecycle, the
  public transaction-composable reset API, and the visible-head query used by
  the operator position commands, plus the renewable retention evidence required by
  schema-versioned rebuilds.

### New Features

- Embedded `rebuild reproject-stream GROUP PROJECTION STREAM` previews exact serving
  revision, target, dedup, stream-history, and work-admission facts and executes only
  with `--force`. The positive `--max-events` limit defaults to 1000 and is rechecked
  against locked stream metadata before the group fence. Human and v2 JSON outcomes
  report the admitted limit, cleared rows, replay/application counts, dedup
  inserted/existing counts, and verification; typed refusals have stable operator codes.

- Embedded read-only `rebuild external-read CONTRACT VERSION` inspection and
  preview/`--force` `rebuild retire-external-read CONTRACT VERSION`. Both render the
  supported catalog report with contract state, surface generation, PostgreSQL
  dependents, and execute grants; forced retirement uses the library lifecycle API.
- Embedded `rebuild versioned start|status|resume|abandon`, database-backed
  `rebuild retired`, and preview/`--force` `rebuild drop-retired`. Commands render the
  supported catalog operations reports, derive the physical fleet from the mounted
  validated catalog, and expose stable versioned JSON for runs and retirement blockers.

- `Keiro.Ops.Parse.nonNegativeReader`, a message-parameterized bounded reader
  now shared by global-position, stream-version, and generation options without
  changing their accepted values or domain-specific errors.
- A standalone, schema-checked operations console for Keiro- and Kiroku-owned
  database operations, with human tables and stable JSON generated from the
  same result values.
- Preview-before-`--force` mutations, schema-drift refusal, and typed stream-name
  confirmation for permanent stream operations.
- `AppHooks`, `opsCommandTree`, `runOpsInvocation`, and `mainWithHooks` for
  mounting application-owned workflow resume, timer dispatch, candidate-code
  replay audit, and validated projection-catalog rebuild commands.
- Read-only `stream subscriptions` and
  `projection position --subscription NAME` commands backed by the public
  Kiroku 0.4 durable checkpoint inventory. Both preserve member rows and report
  `global_position_distance`; neither queries Kiroku's private schema or claims
  a relevant-event lag.
- Projection catalog inventory and rebuild JSON expose each subscription's
  stable `checkpointOnMissing` value from the same validated catalog used by
  runtime registration and rebuild planning.
- Embedded catalog operations add `rebuild adopt GROUP...`. Without `--force`
  it classifies every catalog group, shows stored/current slice fingerprints
  and removed groups, and prints the exact force invocation. With `--force` it
  calls the supported transactional adoption API and reports the adopted rows.
  Existing rebuild list and preview tables also expose slice identity.
- Rebuild run tables now include `group_slice`, so status and mutation previews
  expose `$pre-canonical` directly during migration recovery.
- Embedded `wf resume-once` results expose `advanced` and `paced` counts plus
  `sleep_due` and the sorted set of `unregistered_names` in JSON (and the
  corresponding human columns), so an operator can terminate a bounded drain on
  durable progress, identify missing workflow definitions, and distinguish due
  sleeps that require the timer worker rather than another resume pass.

### Bug Fixes

- The non-forced `rebuild adopt` preview now distinguishes the named groups it will adopt
  from out-of-scope catalog drift and warns when skipped groups will still refuse startup
  registration.
- `rebuild status` and the non-forced `rebuild abandon` preview now work for
  pre-canonical runs, enabling the documented abandon, adopt, and fresh-start
  recovery sequence without direct SQL.

### Other Changes

- First public release. Requires `keiro ^>=0.12.0.0`,
  `keiro-migrations ^>=0.12.0.0`, and `keiro-pgmq ^>=0.12.0.0`.
- The source distribution now includes the BSD-3-Clause license file.
- `rebuild adopt` now renders scope-annotated group, registration, and old-name rows and
  reports the forced transaction through `keiro/catalog-adoption-preview/v2` and
  `keiro/catalog-adoption-outcome/v2` JSON envelopes. Preview refuses a requested group
  absent from the catalog with `AdoptGroupNotInCatalog`, matching forced execution.