ci(release): reconcile and qualify lockstep rc.2

.github/workflows/ci.yml

@@ -3,9 +3,9 @@ name: check
 on:
   pull_request:
   push:
-    branches: [main, "release/**"]
-    tags: ["v*"]
+    branches: [main]
   workflow_dispatch:
+  workflow_call:
 
 permissions:
   contents: read
@@ -52,11 +52,8 @@ jobs:
           if-no-files-found: warn
 
   qualification:
-    name: qualify release (${{ matrix.target }})
-    if: >-
-      github.ref == 'refs/heads/main' ||
-      startsWith(github.ref, 'refs/tags/v') ||
-      startsWith(github.ref, 'refs/heads/release/')
+    name: qualify application (${{ matrix.target }})
+    if: github.event_name != 'pull_request'
     needs: check
     strategy:
       fail-fast: false
@@ -68,22 +65,12 @@ jobs:
             target: macos-arm64
     runs-on: ${{ matrix.runner }}
     env:
-      CARGO_TARGET_DIR: /tmp/vthread-release-build
+      CARGO_TARGET_DIR: /tmp/vthread-application-build
       CARGO_HOME: ${{ github.workspace }}/target/cargo-home
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Rust
         run: rustup toolchain install 1.96.1 --profile minimal
-      - name: Verify release ref
-        run: |
-          version="$(awk -F '"' '/^version = "/ { print $2; exit }' Cargo.toml)"
-          case "$GITHUB_REF" in
-            refs/heads/main) test "$GITHUB_REF_NAME" = main ;;
-            refs/tags/v*) test "$GITHUB_REF_NAME" = "v$version" ;;
-            refs/heads/release/*) test "$GITHUB_REF_NAME" = "release/$version" ;;
-            *) exit 1 ;;
-          esac
-          grep --fixed-strings "## $version - " CHANGELOG.md
       - name: Cache locked dependencies
         run: cargo fetch --locked
       - name: Qualify application
@@ -93,20 +80,12 @@ jobs:
           python3 scripts/run-application.py
           --out .qualification/application
           --offered-rates 2000 --offered-count 256
-          --context "GitHub release qualification ${{ matrix.target }}"
-      - name: Verify workspace packages
-        shell: bash
-        run: |
-          set -euo pipefail
-          mkdir -p .qualification/package
-          cargo package --locked --offline --workspace --exclude vthread-lab 2>&1 | tee .qualification/package/verification.log
+          --context "GitHub application qualification ${{ matrix.target }}"
       - name: Upload qualification evidence
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: qualification-${{ github.run_id }}-${{ matrix.target }}
-          path: |
-            .qualification/
-            ${{ env.CARGO_TARGET_DIR }}/package/*.crate
+          path: .qualification/
           include-hidden-files: true
           if-no-files-found: warn

.github/workflows/native-stack.yml

@@ -3,8 +3,9 @@ name: native stack
 on:
   pull_request:
   push:
-    branches: [main, "perf/scheduler-hot-path", "release/**"]
+    branches: [main, "perf/scheduler-hot-path"]
   workflow_dispatch:
+  workflow_call:
 
 permissions:
   contents: read

.github/workflows/rehearse.yml

@@ -0,0 +1,31 @@
+# Generated by zrelease; preserve CI prerequisites, branch rehearsal and consumer smoke inputs.
+name: Rehearse
+run-name: Rehearse @ ${{ github.ref_name }}
+'on':
+  push:
+    branches: ["release/**"]
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  canonical:
+    uses: ./.github/workflows/ci.yml
+  native-stack:
+    uses: ./.github/workflows/native-stack.yml
+  rehearsal:
+    needs: [canonical, native-stack]
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+      deployments: write
+    uses: zsumz/zrelease/.github/workflows/rehearse.yml@1993b45bfae19a00e61a9138565b79e029c2d7f4
+    with:
+      members: '[{"name":"vthread-stack","needs":[]},{"name":"vthread-sync-core","needs":[]},{"name":"vthread","needs":["vthread-stack","vthread-sync-core"]},{"name":"vthreads","needs":["vthread"]}]'
+      workspace: true
+      lockstep: true
+      pipeline-ref: '1993b45bfae19a00e61a9138565b79e029c2d7f4'
+      toolchain: '1.96.1'
+      manifest-path: 'Cargo.toml'
+      base-branch: ${{ github.ref_type == 'branch' && github.ref_name || 'main' }}
+      smoke-sources: '{"vthread":"scripts/fixtures/release/main.rs","vthreads":"scripts/fixtures/release/main.rs"}'

.github/workflows/release.yml

@@ -0,0 +1,119 @@
+# Generated by zrelease; preserve CI prerequisites, publish guards and consumer smoke when regenerating.
+name: Release
+run-name: ${{ inputs.publish && 'Publish' || 'Rehearse' }} @ ${{ github.ref_name }}
+'on':
+  workflow_dispatch:
+    inputs:
+      publish:
+        description: Publish this release? Requires a release tag and one approval.
+        type: boolean
+        default: false
+        required: true
+permissions:
+  contents: read
+concurrency:
+  group: zrelease-${{ github.repository }}
+  cancel-in-progress: false
+jobs:
+  canonical:
+    uses: ./.github/workflows/ci.yml
+  native-stack:
+    uses: ./.github/workflows/native-stack.yml
+  plan:
+    needs: [canonical, native-stack]
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+    uses: zsumz/zrelease/.github/workflows/plan.yml@1993b45bfae19a00e61a9138565b79e029c2d7f4
+    with:
+      members: '[{"name":"vthread-stack","needs":[]},{"name":"vthread-sync-core","needs":[]},{"name":"vthread","needs":["vthread-stack","vthread-sync-core"]},{"name":"vthreads","needs":["vthread"]}]'
+      workspace: true
+      lockstep: true
+      pipeline-ref: '1993b45bfae19a00e61a9138565b79e029c2d7f4'
+      toolchain: '1.96.1'
+      manifest-path: 'Cargo.toml'
+      publish: ${{ github.event_name == 'workflow_dispatch' && inputs.publish }}
+      base-branch: ${{ !inputs.publish && github.ref_type == 'branch' && github.ref_name || 'main' }}
+  crate_0:
+    name: vthread-stack
+    needs: [plan]
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+      deployments: write
+    uses: zsumz/zrelease/.github/workflows/release.yml@1993b45bfae19a00e61a9138565b79e029c2d7f4
+    with:
+      package: 'vthread-stack'
+      pipeline-ref: '1993b45bfae19a00e61a9138565b79e029c2d7f4'
+      toolchain: '1.96.1'
+      manifest-path: 'Cargo.toml'
+      publish: ${{ github.event_name == 'workflow_dispatch' && inputs.publish }}
+      base-branch: ${{ !inputs.publish && github.ref_type == 'branch' && github.ref_name || 'main' }}
+      plan-artifact-id: ${{ needs.plan.outputs.artifact-id }}
+      plan-sha256: ${{ needs.plan.outputs.plan-sha256 }}
+      approval-artifact-id: ${{ needs.plan.outputs.approval-artifact-id }}
+  crate_1:
+    name: vthread-sync-core
+    needs: [plan, crate_0]
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+      deployments: write
+    uses: zsumz/zrelease/.github/workflows/release.yml@1993b45bfae19a00e61a9138565b79e029c2d7f4
+    with:
+      package: 'vthread-sync-core'
+      pipeline-ref: '1993b45bfae19a00e61a9138565b79e029c2d7f4'
+      toolchain: '1.96.1'
+      manifest-path: 'Cargo.toml'
+      publish: ${{ github.event_name == 'workflow_dispatch' && inputs.publish }}
+      base-branch: ${{ !inputs.publish && github.ref_type == 'branch' && github.ref_name || 'main' }}
+      plan-artifact-id: ${{ needs.plan.outputs.artifact-id }}
+      plan-sha256: ${{ needs.plan.outputs.plan-sha256 }}
+      approval-artifact-id: ${{ needs.plan.outputs.approval-artifact-id }}
+  crate_2:
+    name: vthread
+    needs: [plan, crate_0, crate_1]
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+      deployments: write
+    uses: zsumz/zrelease/.github/workflows/release.yml@1993b45bfae19a00e61a9138565b79e029c2d7f4
+    with:
+      package: 'vthread'
+      smoke-source: 'scripts/fixtures/release/main.rs'
+      pipeline-ref: '1993b45bfae19a00e61a9138565b79e029c2d7f4'
+      toolchain: '1.96.1'
+      manifest-path: 'Cargo.toml'
+      publish: ${{ github.event_name == 'workflow_dispatch' && inputs.publish }}
+      base-branch: ${{ !inputs.publish && github.ref_type == 'branch' && github.ref_name || 'main' }}
+      plan-artifact-id: ${{ needs.plan.outputs.artifact-id }}
+      plan-sha256: ${{ needs.plan.outputs.plan-sha256 }}
+      approval-artifact-id: ${{ needs.plan.outputs.approval-artifact-id }}
+      dependency-artifact-ids: '${{ needs.crate_0.outputs.candidate-artifact-id }},${{ needs.crate_1.outputs.candidate-artifact-id }}'
+      dependency-shas: '["${{ needs.crate_0.outputs.candidate-sha256 }}","${{ needs.crate_1.outputs.candidate-sha256 }}"]'
+  crate_3:
+    name: vthreads
+    needs: [plan, crate_0, crate_1, crate_2]
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+      deployments: write
+    uses: zsumz/zrelease/.github/workflows/release.yml@1993b45bfae19a00e61a9138565b79e029c2d7f4
+    with:
+      package: 'vthreads'
+      smoke-source: 'scripts/fixtures/release/main.rs'
+      pipeline-ref: '1993b45bfae19a00e61a9138565b79e029c2d7f4'
+      toolchain: '1.96.1'
+      manifest-path: 'Cargo.toml'
+      publish: ${{ github.event_name == 'workflow_dispatch' && inputs.publish }}
+      base-branch: ${{ !inputs.publish && github.ref_type == 'branch' && github.ref_name || 'main' }}
+      plan-artifact-id: ${{ needs.plan.outputs.artifact-id }}
+      plan-sha256: ${{ needs.plan.outputs.plan-sha256 }}
+      approval-artifact-id: ${{ needs.plan.outputs.approval-artifact-id }}
+      dependency-artifact-ids: '${{ needs.crate_0.outputs.candidate-artifact-id }},${{ needs.crate_1.outputs.candidate-artifact-id }},${{ needs.crate_2.outputs.candidate-artifact-id }}'
+      dependency-shas: '["${{ needs.crate_0.outputs.candidate-sha256 }}","${{ needs.crate_1.outputs.candidate-sha256 }}","${{ needs.crate_2.outputs.candidate-sha256 }}"]'

CHANGELOG.md

@@ -2,15 +2,35 @@
 
 ## Unreleased
 
-## 0.1.0 - 2026-09-07
-
-- Prepare an early public-feedback release with compatible public API updates in
-  `0.1.x`; breaking API or contract changes move to `0.2`.
-- Retain the existing runtime without promoting held performance experiments.
+## 0.1.0-rc.2 - 2026-09-11
+
+- Keep the signed-off RC runtime and reconcile its history with public main.
+- Enforce matching RC tags, shared workspace versions and exact internal pins.
+- Preflight all release crate names before approval or upload, with explicit
+  first-publication bootstrap instructions. Update artifact actions to Node 24.
+- Replace custom release packaging and closeout instructions with pinned zrelease
+  workspace automation, gated by both-target CI, with registry rehearsals and
+  fresh README-example consumers. The automatic rehearsal uses a compact
+  workspace graph with per-crate logs and receipts.
+- Keep cross-crate synchronization model tests in workspace CI and omit them
+  from the standalone sync-core archive so its packaged tests are self-contained.
+
+## 0.1.0-rc.1 - 2026-09-09
+
+- Prepare a production release candidate for the supported platforms. The eventual
+  `0.1.0` release and subsequent `0.1.x` releases will keep compatible public API
+  updates within `0.1`; breaking API or contract changes move to `0.2`.
+- Retain the established runtime architecture without promoting held performance
+  experiments.
+- Harden inbox progress for active and parked carriers: published depth is
+  authoritative while driving, later publishers wake a registered carrier when
+  the first notifier is delayed, and wait registration rechecks the queue under
+  its mutex.
+- Reject suspension boundaries while a carrier is handling a panic, before
+  publishing wait or resource state, preserving panic isolation between tasks.
 - Require the full fixed-arrival application matrix and offline package builds in
   release qualification on Linux x86_64 and macOS ARM64.
-- Update installation examples to `0.1` and use `52` throughout the examples.
-- Keep the historical refill stall unresolved and visible in [release notes](RELEASE.md).
+- Pin installation examples to `=0.1.0-rc.1` and use `52` throughout the examples.
 
 ## 0.0.2 - 2026-09-07
 

CONTRIBUTING.md

@@ -35,5 +35,6 @@ harness. Set `CARGO_TARGET_DIR` to an absolute local path to use a separate buil
 Use small PGP-signed Conventional Commits: one concise subject, no body and no
 coauthor trailers. Maintainer commits use `zsumz <shawn@zsumz.com>`.
 
-Run `zcheck run check` before submitting changes. Release qualification has
-[additional gates](RELEASE.md); a green local check alone is not a release verdict.
+Run `zcheck run check` before submitting changes. The [rehearsal and release workflows](RELEASE.md) require both-target CI before zrelease
+packages and rehearses the workspace. Push a `release/**` branch to practice;
+actual publication requires an explicit tagged dispatch and release approval.

Cargo.toml

@@ -3,17 +3,17 @@ members = ["crates/vthread", "crates/vthreads", "crates/vthread-stack", "crates/
 resolver = "3"
 
 [workspace.package]
-version = "0.1.0"
+version = "0.1.0-rc.2"
 edition = "2024"
 rust-version = "1.96"
 license = "Apache-2.0"
 repository = "https://github.com/zsumz/vthread"
 authors = ["vthread contributors"]
 
 [workspace.dependencies]
-vthread = { path = "crates/vthread", version = "=0.1.0" }
-vthread-stack = { path = "crates/vthread-stack", version = "=0.1.0" }
-vthread-sync-core = { path = "crates/vthread-sync-core", version = "=0.1.0" }
+vthread = { path = "crates/vthread", version = "=0.1.0-rc.2" }
+vthread-stack = { path = "crates/vthread-stack", version = "=0.1.0-rc.2" }
+vthread-sync-core = { path = "crates/vthread-sync-core", version = "=0.1.0-rc.2" }
 zio = { version = "=0.0.1-dev.1", default-features = false }
 socket2 = { version = "=0.6.5", default-features = false }
 libc = "=0.2.189"

README.md

@@ -31,6 +31,9 @@ so they can keep values such as `Rc` across suspension.
 
 Task admission, queues, stacks, waiters, timers, I/O registrations, and native jobs
 have explicit bounds. Cancellation is cooperative and observed at checkpoints.
+An operation that reaches a suspension boundary returns
+`Error::SuspensionDuringPanic` instead of switching tasks while its carrier is
+handling a panic.
 
 The runtime provides synchronization, bounded channels, networking, DNS,
 filesystem operations, and native blocking delegation. Diagnostics expose task
@@ -42,7 +45,7 @@ Add vthread to your project:
 
 ```toml
 [dependencies]
-vthread = "0.1"
+vthread = "=0.1.0-rc.2"
 ```
 
 ```rust
@@ -73,9 +76,11 @@ for verification coverage and known limitations.
 
 ## Compatibility
 
-vthread is in early development, intended for evaluation and feedback. The `0.1.x`
-series preserves public API compatibility; breaking API or contract changes move
-to `0.2`. Tested configurations and known limitations are in the [release notes](RELEASE.md).
+vthread `0.1.0-rc.2` is a candidate for production use on its supported platforms
+within the documented boundaries. The eventual `0.1.0` release and subsequent
+`0.1.x` releases will keep compatible public API updates within `0.1`; breaking API
+or contract changes move to `0.2`. Tested configurations and known limitations are
+in the [release notes](RELEASE.md).
 
 ## Docs