Prepare Runner v0.25.0 release documentation

docs/releases/v0.25.0.md

@@ -0,0 +1,75 @@
+Runner v0.25.0 puts the Runner's durable state behind a store interface, with the
+SQLite store as the shipped kind, an in-memory kind for tests and a conformance
+suite that both kinds pass. It also carries the development-kit adoption rows,
+the Idempotency-Key boundary tests and the wording change that dropped the
+research-preview label. These changes cover the eleven source commits since
+published `v0.24.0` (#163–#169, #171, #176–#179). Nothing about the SQLite
+store's files, statements, schema or lock changed.
+
+## What an operator must do
+
+- Nothing new. The boot line's `dir` is consumed by the SQLite kind only and
+  still names the Runner's working directory for Runtime files (releases,
+  attempts, runtimes). No other kind can be selected from the boot line.
+- The usual care applies before any upgrade: stop Desk and Runner and back up the
+  Jobs workspace, including SQLite/WAL, as
+  [State and backups](../../README.md#state-and-backups) describes. A store this
+  version opens is the same schema the previous version wrote; there is no
+  migration.
+- Two behaviours are stated rather than changed: a claim of a run, and an end of
+  a run at queue time, now require the run to still be queued (with one
+  dispatcher under the lock this never refuses), and `Close` releases the attempts
+  directory before the store, with the process lock still released last.
+
+## The store behind an interface (#173)
+
+The queue, releases, inputs and run records are reached through one interface in
+the Runner's store package: reads (release, job, requested run, entry sequence,
+run, oldest queued, entry line, chain page) and writes that go through one
+serializable transaction (active runs, create run once per id and per request
+key, put run against its expected state, running runs, last entry, create entry,
+create release, append journal). Faults are typed: absent, taken, conflict,
+durability, unreadable, refused; an error keeps its cause's text. The SQLite kind
+is the previous code moved: the same twenty-three statements, a byte-identical
+pragma and schema block, the same transactions, opening order, WAL mode and
+exclusive process lock. The in-memory kind holds the same semantics for tests.
+The conformance suite runs against both kinds: a release created once; a run
+queued once by id and by request key; queue order; a queued run claimed once with
+a stale claim refused; concurrent producers and claimers retrying on conflict;
+a failed transaction keeping nothing; a failed commit reported as a durability
+fault; one chain entry per run read in order; absent and unreadable typing; and,
+for SQLite only, a reopened store holding what it held and a second process
+refused by the lock. The unit-test step fails unless both kinds passed. See
+[the store interface](../design/store-interface.md). Triggers, occurrences, job
+creation and revision, briefs, workflows, manual admission, metadata, the
+listings and the journal's reads stay on the SQLite handle; the design note lists
+each.
+
+## Development kit and tests (#163–#169, #176–#178)
+
+The repository runs the development kit's vendored checks (`scripts/dev/check.sh`
+at kit v0.9.0 with the changed-path selection); a pull request runs the checks
+its changed paths map to and a push to `main` runs the whole list, which alone is
+release evidence. The Idempotency-Key ASCII and length boundaries are covered by
+tests (#168). The README and the security policy no longer call the Runner a
+research preview (#171).
+
+## Source evidence and pending release gates
+
+- Runner native Linux/macOS CI
+  [40363510184](https://github.com/Judgment-Pack/judgment-pack-runner/actions/runs/40363510184)
+  passed at `387b8b2b93e6b699ceea009323ccd645d166da5d` (the reviewed store-interface change
+  on top of `main`), including the release-contents job. The review record and
+  its disposition table are on
+  [pull request #179](https://github.com/Judgment-Pack/judgment-pack-runner/pull/179): no HIGH or MEDIUM
+  finding; the two stated behaviours above were traced as unobservable today;
+  the twenty-three statements, the schema block and the transaction boundaries
+  were compared on both sides; probes on both kinds (duplicate ids and request
+  keys, stale claims, racing claimers, a real commit failure, a killed holder of
+  a claimed run, chain order) and sixteen mutants all held.
+- The push-triggered whole-list run on `main` at the merge commit is the
+  evidence the release takes.
+
+Tag-time CI, the packaged archives, checksums, attestations, native archive smoke
+and draft/publication verification for `v0.25.0` remain pending under
+[the release procedure](../releasing.md). No Windows archive is released.