Prepare 0.2.0 experimental delivery candidate

CHANGELOG.md

@@ -6,6 +6,10 @@ changes.
 
 ## [Unreleased]
 
+No unreleased changes.
+
+## [0.2.0] - 2026-10-09
+
 ### Added
 
 - ACP v1 subprocess Provider through the official SDK, with correlated human permissions,
@@ -33,6 +37,8 @@ changes.
   cleanup errors and timeouts included in the report.
 - Updated Hono to 4.13.7 to clear four production dependency advisories, including
   [GHSA-hxh3-vqpv-xpqv](https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv).
+- Subprocess integration tests run serially with bounded startup allowances instead of assuming
+  idle-machine latency. Synthetic ACP traces use atomic replacement to avoid partial JSON reads.
 
 ### Documentation
 
@@ -44,6 +50,18 @@ changes.
 - Added focused guides for one complete execution, provider ownership, and production deployment.
 - Reorganized the documentation map around evaluation, integration, provider development, and
   operations paths.
+- Corrected both lifecycle diagrams to include failure while awaiting input or approval, with a
+  deterministic generator and release-version consistency tests.
+
+### Migration From 0.1.0
+
+- DSH launch options must be set by the trusted Provider constructor; per-execution launch
+  overrides are rejected. Install exactly `@deepseek-ai/dsh-sdk-client@0.1.0-rc.7` and explicitly
+  declare only extensions verified in your deployment.
+- Catch `HarnessRuntimeStreamInterruptedError` when an SSE stream ends before the execution is
+  terminal. Reconnect using the event cursor or query execution state before retrying work.
+- The portable protocol remains `2026-09-02`. Reference storage remains in-memory; ACP is
+  experimental, and workspace packages are not published to npm.
 
 ## [0.1.0] - 2026-09-02
 

README.md

@@ -8,7 +8,7 @@
   <strong>English</strong> | <a href="README.zh-CN.md">简体中文</a>
 </p>
 
-> **Experimental:** runtime `0.1.0`, protocol `2026-09-02`. The reference implementation is
+> **Experimental:** runtime `0.2.0`, protocol `2026-09-02`. The reference implementation is
 > in-memory, unauthenticated, and intended for development or one-process embedding.
 
 ![Harness Runtime API architecture: one application contract connects through capability-aware provider adapters to multiple peer harnesses.](assets/harness-runtime-architecture-en.png)

README.zh-CN.md

@@ -8,7 +8,7 @@
   <a href="README.md">English</a> | <strong>简体中文</strong>
 </p>
 
-> **实验阶段：** Runtime `0.1.0`，协议 `2026-09-02`。当前参考实现使用内存状态、没有身份认证，
+> **实验阶段：** Runtime `0.2.0`，协议 `2026-09-02`。当前参考实现使用内存状态、没有身份认证，
 > 适合本地开发、测试或单进程嵌入，不是可直接暴露到公网的多租户平台。
 
 ![Harness Runtime API 架构：应用通过统一契约连接 Runtime，Provider SPI 基于能力预检适配多个并列 Harness，并统一回流事件。](assets/harness-runtime-architecture.png)

RELEASING.md

@@ -29,6 +29,17 @@ pnpm audit --prod --audit-level high
 
 ## GitHub Release
 
+The first experimental release uses a source-only archive; it does not bundle dependencies,
+credentials, local logs, or prebuilt binaries. From a clean reviewed commit, run:
+
+```bash
+node scripts/package-release.mjs /tmp/harness-runtime-release
+```
+
+The output contains a Git archive, `release-manifest.json` bound to the exact commit, and
+`SHA256SUMS`. Verify the archive in an isolated checkout using the frozen lockfile and documented
+checks. Publish as a prerelease while the adapters and reference implementation are experimental.
+
 After the exact tag and commit SHA are approved:
 
 1. create an annotated `vX.Y.Z` tag at the reviewed commit;

assets/README.md

@@ -23,3 +23,9 @@ image and normative text disagree, schemas and specification documents win.
 | `capability-preflight-zh.svg` | Chinese | T0 deterministic | Exact capability decision flow |
 
 AnyCap-generated PNGs retain a neighboring `.prompt.md` production and validation record.
+
+The lifecycle SVGs are generated by `node scripts/generate-lifecycle.mjs`. Use `--check` to verify
+reproducibility without writing files. On 2026-10-09, both languages were inspected in Chrome at
+1600 x 900 and 1024 x 576: nine states, twelve transitions, readable labels, and no visible overlap.
+Failure paths cover running and both human-wait states; the normative runtime model remains the
+source of truth. Regression tests check these paths and generator synchronization.