chore: prepare 0.2.4 with PostgreSQL lock-safety fix

.github/copilot-instructions.md

@@ -172,7 +172,7 @@ Activities have no restrictions — they run once, result is cached.
 Release manifests must resolve `duroxide` and `duroxide-pg` from crates.io:
 ```toml
 duroxide = { version = "0.1.32", features = ["sqlite"] }
-duroxide-pg = "0.1.37"
+duroxide-pg = "0.1.38"
 ```
 
 Temporary local `[patch.crates-io]` sections or inline `path =` overrides are

CHANGELOG.md

@@ -7,6 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.4] - 2026-10-27
+
+### Changed
+
+- Require `duroxide-pg` 0.1.38. PostgreSQL connections apply migration `0026`,
+  which replaces the renewal and acknowledge procedures and adds a unique
+  index on `instance_locks(lock_token)`. The index is not built concurrently;
+  it blocks writes to that table while it builds. Check database upgrade and
+  rollback compatibility before deployment. An older native build can reject
+  a database with a migration it does not know.
+
+### Fixed
+
+- Adopt the provider's [lock-safety fix](https://github.com/microsoft/duroxide-pg/pull/44).
+  It fixes deadlocks between renewal and fetch, acknowledge or abandon, prevents
+  renewal from reviving an expired lease or shortening a live one, and rejects
+  acknowledge after another worker has taken over. Renewal retries transient
+  errors. There is no JavaScript API change.
+
 ## [0.2.3] - 2026-10-21
 
 ### Changed

Cargo.toml

@@ -8,7 +8,7 @@ crate-type = ["cdylib"]
 
 [dependencies]
 duroxide = { version = "0.1.32", features = ["sqlite"] }
-duroxide-pg = "0.1.37"
+duroxide-pg = "0.1.38"
 napi = { version = "2", features = ["async", "napi6", "serde-json"] }
 napi-derive = "2"
 async-trait = "0.1"

README.md

@@ -155,6 +155,16 @@ const provider = await PostgresProvider.connectWithSchema(
 );
 ```
 
+#### Upgrading to 0.2.4
+
+This release uses `duroxide-pg` 0.1.38. Connecting applies migration `0026`,
+including a unique index on `instance_locks(lock_token)`. The index is not
+built concurrently and blocks writes to that table while it builds.
+
+Qualify the database upgrade and rollback before deployment. An older native
+build can reject an unknown applied migration. Reinstalling an older npm package
+does not undo a database migration. The JavaScript API is unchanged.
+
 ### PostgreSQL with Microsoft Entra ID (Azure)
 
 For Azure Database for PostgreSQL Flexible Server, use Entra ID token authentication instead of a password:

npm/npm/darwin-arm64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "duroxide-darwin-arm64",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "os": [
     "darwin"
   ],

npm/npm/darwin-x64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "duroxide-darwin-x64",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "os": [
     "darwin"
   ],

npm/npm/linux-arm64-gnu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "duroxide-linux-arm64-gnu",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "os": [
     "linux"
   ],

npm/npm/linux-x64-gnu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "duroxide-linux-x64-gnu",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "os": [
     "linux"
   ],

npm/npm/win32-x64-msvc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "duroxide-windows-x64",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "os": [
     "win32"
   ],

package.json

@@ -1,6 +1,6 @@
 {
   "name": "duroxide",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Durable execution runtime for Node.js, powered by Rust",
   "main": "lib/duroxide.js",
   "types": "lib/duroxide.d.ts",
@@ -44,11 +44,11 @@
     "node": ">= 18"
   },
   "optionalDependencies": {
-    "duroxide-darwin-arm64": "0.2.3",
-    "duroxide-darwin-x64": "0.2.3",
-    "duroxide-linux-arm64-gnu": "0.2.3",
-    "duroxide-linux-x64-gnu": "0.2.3",
-    "duroxide-windows-x64": "0.2.3"
+    "duroxide-darwin-arm64": "0.2.4",
+    "duroxide-darwin-x64": "0.2.4",
+    "duroxide-linux-arm64-gnu": "0.2.4",
+    "duroxide-linux-x64-gnu": "0.2.4",
+    "duroxide-windows-x64": "0.2.4"
   },
   "files": [
     "index.js",