[rmcdaniel]

dw doctor is recognized but unavailable in the Rust CLI. This implements its connection and compatibility report so operators can diagnose a server even when normal compatibility preflight would refuse it.

The command preserves the ordinary 2.3.5 human, JSON and JSONL reports, redacted token discovery, flag/environment/profile provenance, protocol and fixture summaries, recommendations, and transport/HTTP exit categories. It uses the published SDK's cluster-info call without session preflight. Provenance is captured during connection resolution.

The Security correction rejects credential-bearing or malformed runtime base URLs before any request, without echoing them. Every untrusted human-report scalar is control-filtered and formatter-escaped. JSON retains structurally encoded Server values. The planned release notes explain these hardening differences.

Validation at exact head 3e2d3b283ec99473c87af50e7442bac17ee8cc26:

• All five new security regressions fail against the held parent and pass after correction: flag/environment/profile URL credentials, failure paths, no request before refusal, malicious cluster-info/HTTP errors, ANSI/plain human output, and exact JSON data.
• Hosted Rust 1.86 format, Clippy, locked build, 104 unit tests plus PHP vectors and all 10 integration tests pass, including required Bash/Zsh/Fish.
• Published CLI 2.3.5 comparison: 334/338 match, four prior intentional differences, zero unexpected. Same-head five-platform release dry run, release-binary parity and assembly pass.
• Fresh final qualification: 26/26 checks successful, including PHP 8.2–8.5, PHAR smoke/reproducibility, CodeQL, Sonar and public boundary. Build attempt 2 fetched reviewed central rollback 9fbacc51 and passed policy/aggregate; attempt 1's upstream-policy failure remains preserved. No CLI workaround was made.
• Security's independent final source PASS accepts this exact source integration.

The initial inherited completion fixture collision remains recorded, with its main-line follow-up separate. Qualification and independent Security source review are complete. General retains the normal merge checkpoint; auto-merge is off. No release change.

Refs #72.

[rmcdaniel]

Normal refresh pushed to feat/72-doctor: 5ca63f2c18308138066b76d559feb0ce60844ebc. The merge preserves original doctor 2e32e1ca1700bef133f47d90ad14d2ddcdee2ae5 and main a94189045cda232dd09698b918333bdc2a891016 as parents.

Only the additive command registrations and parity-list insertion needed conflict resolution. Six doctor implementation/harness files and thirteen completion/build/security files compare byte-for-byte with their respective parents. All baseline cases, all 52 completion fixture records and all 26 doctor additions are retained unchanged.

Fresh local format, diff, credential-pattern and private-path checks pass. Hosted Rust 1.86 unit/compatibility/parity, Bash/Zsh/Fish controls, public-boundary and five-platform dry-run qualification remain pending. No local build or parity rerun is claimed for the combined head; local Bash 3 cannot run the canonical boundary script's mapfile call.

Two normal pushes initially returned GitHub internal errors; the third succeeded, and an independent branch-ref readback confirms 5ca63f2. GitHub is investigating an incident affecting Git Operations, Pull Requests, Issues and Actions. The PR snapshot still reports its old head and no fresh runs are visible yet. This is pending event/CI processing, not qualification success. No duplicate workflow dispatch was started.

The head stays frozen for fresh checks and independent review. #95/#96, dependency pins and release gates are unchanged.

[rmcdaniel]

Local combined-head qualification for 5ca63f2c18308138066b76d559feb0ce60844ebc, with the source head unchanged.

• Platform/toolchain: native macOS arm64, Rust 1.86.0 (05f9846f8), CARGO_BUILD_JOBS=2, RUST_TEST_THREADS=2. This is source/debug qualification, not a published Rust release or installed-Server conformance run. The SDK remains pinned to published 4.11.0.
• Fresh cargo fmt --check and cargo clippy --locked --all-targets -- -D warnings pass. Unit tests: 102 passed, one expected compatibility-vector test ignored. PHP-vector execution remains a hosted check.
• Paired parity: 334/338 match, four existing intentional differences, zero unexpected. All 26 added doctor cases match; with the generated doctor help case, all 27 doctor comparisons match. The harness uses its existing loopback fixtures and unchanged comparisons/normalizations.
• The exact checksum-verified reference is published CLI 2.3.5 dw-macos-aarch64, SHA-256 97cb962e31a3e18e692df644f9aa595ad857ef72a77905e0d16fc8ba7eb513ee. Candidate SHA-256 is df3e459b0640cf08a8eb4c30cbc10c6c2d4b1b634800214e6ea8cc458926fd6c. The exact-source archive used for compilation is SHA-256 b7a145bd9d168f9b6fc766d836ea8a414e63f5f9f261f25732fed48226add6e5.

Integration result remains qualified by an initial fixture failure. The first full Cargo test command exited 101: completion tests were 3/4 because debug_log_refuses_symlinks_hard_links_and_nonregular_entries failed at rust/tests/completion_security.rs:20 in Scratch::new, with AlreadyExists while creating the temporary directory, before its product assertions. That test file is byte-identical to main and merged #93 (Git blob e265a6184fd5cecab30e597fb52a4b3498ab8686). Five bounded repeats of the unchanged completion executable then passed 4/4 each; the separate upgrade integration test passed 1/1. The initial failure is unreproduced, not cleared. Bash and Zsh ran; Fish is absent and was skipped locally. Security has the finding for the inherited fixture. No fixture or product source was changed.

Runner corrections are excluded from product failures: an initial archive-extraction API mismatch was corrected before tests ran. The first parity attempt used a temporary target-directory symlink, causing 24 invocation-path normalization differences. Restoring the repository's standard target-directory layout produced the passing 334/338 result above with the same candidate SHA-256 and no source or comparison-rule changes.

Checks ran between 2026-11-04 10:33:44 and 10:42:07 UTC. The compiler/test process group stayed below its 3 GiB cutoff, with about 788 MiB observed at one-second sampling. The executable-only follow-up stayed below 512 MiB. Both used bounded deadlines. No real Server, credentials or containers were used. Disposable remote source, target, reference and logs are removed; no CLI qualification processes remain.

Still pending: the initial temporary-directory fixture failure, required Fish/hosted checks, five-platform dry run and independent review. Fresh API readback still reports the old PR snapshot and zero checks for 5ca63f2 during the unresolved GitHub service incident. No overall suite/merge/release GO is claimed. #95/#96 and dependency/release gates remain unchanged.

[rmcdaniel]

Security finding review — CLI #94 pushed source 5ca63f2c18308138066b76d559feb0ce60844ebc

Finding classification: inherited test-fixture collision, not a product security failure. The first local suite remains a failed run and is not converted into a pass, but its AlreadyExists occurred before any product assertion. This review does not provide an overall source, merge, or release GO.

• Git Data readback binds refs/heads/feat/72-doctor to 5ca63f2c18308138066b76d559feb0ce60844ebc. GitHub's PR REST snapshot is still stale at 2e32e1ca; there are zero hosted check runs for 5ca63f2. No hosted qualification is inferred.
• rust/tests/completion_security.rs is byte-identical between the pushed source and merged main a94189045cda232dd09698b918333bdc2a891016 (Git blob e265a6184fd5cecab30e597fb52a4b3498ab8686). Therefore the failure is not introduced by Rust CLI: port doctor connection and compatibility diagnostics #94's doctor/completion merge.
• Scratch::new names a directory from process ID plus SystemTime::now().as_nanos() and performs one create with no collision retry. Rust tests execute concurrently in one process; a platform clock can return the same value to two calls. A pre-existing abandoned path produces the same fail-closed AlreadyExists. In either case line 20 fails before the CLI is launched or the symlink/hard-link/FIFO/permission assertions execute.
• This predictable test-only path is not used by the shipped CLI. Creation refuses an existing entry rather than following it, and successful directories are mode 0700. The observed behavior is denial of one test invocation, not candidate code execution, credential exposure, debug-log overwrite, or evidence that the product boundary accepted an unsafe entry.
• The unchanged executable passed all four completion-security tests in each of five bounded reruns, so the exact product assertions have independent successful coverage. That evidence is useful but does not erase the initial failed suite. Fish was absent locally; PHP vectors, required hosted checks and the five-platform dry run remain mandatory.

The fixture should receive a focused main-line reliability fix using an atomic temporary-directory primitive, or a bounded create-new retry that combines an in-process counter with the existing private mode and retries only AlreadyExists. Do not weaken the product assertions or silently ignore allocation errors. This inherited helper need not expand frozen #94 unless it recurs in required qualification; preserve a durable follow-up after #94 either way.

[rmcdaniel]

Recovery after the GitHub service incident is complete. The draft was closed and reopened once through the normal PR lifecycle. The source branch stayed frozen at 5ca63f2c18308138066b76d559feb0ce60844ebc throughout.

Authoritative readback now agrees:

• PR head: 5ca63f2c18308138066b76d559feb0ce60844ebc.
• PR base: a94189045cda232dd09698b918333bdc2a891016.
• State: open, draft, auto-merge off.
• Fresh Build, Rust release dry run and SonarQube are running for this head. Public Boundary passed.

The repository's existing pull_request workflows run on reopened (GitHub event reference). No source commit, branch rewrite, draft-to-ready transition, parallel manual dispatch, merge or release was used for recovery. The initial local suite failure and all required qualification/review gates remain in force until their own evidence clears them.

[rmcdaniel]

Fresh exact-head hosted qualification is terminal success: 25/25 checks, for 5ca63f2c18308138066b76d559feb0ce60844ebc against main a94189045cda232dd09698b918333bdc2a891016. The PR is open, draft, mergeable/CLEAN, with auto-merge off. The source head has not changed since the normal refresh.

Build 41826280877 passes:

• Rust 1.86 format, clippy with warnings denied, locked tests and build.
• 102 unit tests pass; the one initially ignored compatibility test subsequently passes against the generated PHP vectors.
• All four completion-security integration tests pass with DW_REQUIRE_COMPLETION_SHELLS=1, including Bash, Zsh and hosted Fish 4.2.1. The upgrade integration test passes. The temporary-directory collision did not recur in this required qualification.
• Source parity is 334/338 matches, four previously recorded intentional differences, zero unexpected.
• PHP 8.2–8.5, PHAR smoke/reproducibility, central action policy and target-branch qualification pass.

Rust release dry run 41826281155 passes all five builders (Linux x86_64/aarch64, macOS x86_64/aarch64, Windows x86_64), release-binary parity and complete asset assembly. CodeQL, Sonar quality checks and Public Boundary also pass.

The initial local failed suite remains a failed historical run. Security classified its allocation error as inherited test-fixture collision, and the separate main-line follow-up stays queued. No fixture or product source was changed to obtain this hosted result.

Returning exactly this unchanged head for independent full doctor/source review. The earlier fixture-finding review gave no overall source GO. General retains the ready/merge checkpoint after that review; this qualification publishes no release and leaves #95/#96, SDK adoption and stable-release gates unchanged.

[rmcdaniel]

Security source review — exact 5ca63f2c18308138066b76d559feb0ce60844ebc

HOLD for source merge. The full hosted qualification is terminal 25/25 success and the earlier Scratch::new collision remains an inherited test-fixture failure, not a product failure. I found two blocking diagnostic-output defects not exercised by the parity corpus.

Exact identity: tree 19f0e018fcf138c3c7cbcdbfbec14a183711f0ff; ordered parents original doctor source 2e32e1ca1700bef133f47d90ad14d2ddcdee2ae5 and base a94189045cda232dd09698b918333bdc2a891016. All 25 exact-head checks are completed success, with zero failed or pending.

1. Credential-bearing runtime URLs are copied into support output

Connection::effective_config places self.server verbatim in both server.value and server_url.value. doctor::run also copies context.connection.server into connection.server, the human renderer prints that value, and the unreachable recommendation interpolates it into dw doctor --server=....

The connection resolver accepts flag, environment and profile server strings without rejecting URL userinfo, query credentials or fragments. The published SDK builder checks only the /api suffix at build time; it does not remove or reject URL userinfo before this diagnostic is constructed. Therefore a value such as https://operator:secret@example.test/runtime or a signed query is repeated in JSON, human output and/or the suggested command. Token-value redaction tests do not cover this second credential channel.

Required correction: define one validated runtime-base URL boundary. Reject userinfo and other credential-bearing components before any request, or produce a credential-free canonical diagnostic value and ensure the raw value never reaches output/recommendations. Cover --server, DURABLE_WORKFLOW_SERVER_URL, and profile sources, including connection-failure paths. Assert the username/password/query secret is absent from the entire stdout, stderr and JSON serialization. Do not preserve implicit URL Basic authentication as an undocumented auth source.

2. Server-controlled text reaches the terminal formatter unsanitized

The human doctor path renders Server-provided server_id, version/default namespace/protocol values, compatibility warnings and HTTP error text through line/writeln!, then passes the complete string to formatter::writeln_out. These values are not escaped or control-filtered first. The formatter interprets <error>-style markup and leaves raw terminal control bytes intact. A reachable or selected untrusted Server can therefore inject styling, new lines, misleading diagnostic sections, or terminal escape/OSC sequences into an operator's terminal.

Required correction: keep machine JSON structurally encoded, but route every remote or otherwise untrusted scalar used by the human renderer through one display sanitizer that neutralizes formatter markup, C0/C1 controls (except intentional layout created by trusted code), ESC/CSI/OSC and embedded line breaks. Add focused malicious cluster-info and HTTP-error cases containing markup, newline, ESC/CSI and OSC; assert no raw control sequence survives and no forged section or style is interpreted.

The redacted token provenance, source precedence, exact 2.3.5 behavior corpus, five-platform dry-run and complete hosted shell coverage otherwise support the implementation. The doctor dw.commit value is the existing 12-character display identity and must not be used as exact release provenance; release acceptance still requires the full immutable source/artifact identity.

Return the corrected exact head with fail-before/pass-after controls and fresh normal qualification. General retains merge; no release action is reviewed or authorized here.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

The two Security HOLD findings are corrected on normally pushed head 3e2d3b283ec99473c87af50e7442bac17ee8cc26, parent 5ca63f2c18308138066b76d559feb0ce60844ebc.

• The effective runtime URL is validated once during connection resolution, before client construction or requests. It must be absolute HTTP(S) and cannot contain URL user information, query, fragment, controls or whitespace. Refusals use an established invalid-input error without echoing the value. Authentication remains an explicit token source.
• Every untrusted scalar interpolated into the human doctor report passes through one display sanitizer. It escapes formatter markup and renders C0/C1 controls, ESC/CSI/OSC, embedded line breaks and Unicode line separators visibly as data. Trusted report layout remains separate. JSON/JSONL continue to structurally encode the original Server values.
• The planned 2.5.0 notes record these intentional hardening differences. No dependency or workflow changed.

Fail-before/pass-after: the same five new doctor_security CLI tests fail 0/5 against the held 5ca63f2 implementation and pass 5/5 after the correction. They cover credential URLs from flags, environment and profiles, live and unreachable endpoints, human/JSON/JSONL output, no request before refusal, and malicious cluster-info/HTTP-error markup, line breaks, C0/C1, ESC/CSI/OSC. Human ANSI and plain modes are exercised, while parsed machine diagnostics must retain the exact original Server payload.

Exact local Rust 1.86 macOS arm64 evidence at the corrected head:

• fmt, clippy with warnings denied and locked build pass;
• 104 unit tests pass, one expected PHP-vector test ignored locally;
• 10 integration tests pass (four completion, five doctor-security, one upgrade); Bash/Zsh ran and unavailable Fish was skipped locally;
• 334/338 parity cases match, four prior intentional differences, zero unexpected, against checksum-verified published CLI 2.3.5 macOS arm64 (97cb962e31a3e18e692df644f9aa595ad857ef72a77905e0d16fc8ba7eb513ee).

Held control binary SHA-256: d7d84bc4e2e9efa5b09880a75337ce84faf291b65295e2d8ca727fc61a5c6ce4. Corrected binary: 0a2e05419f6fd26c0fac7164dd0c39d9e73475392789e845cbe8e3076c826cac. Both runs used the same host/toolchain/locked graph, two build/test jobs, a 3 GiB process-group RSS cutoff and bounded deadlines. Control ran 12:34:36–12:35:00 UTC; corrected checks/parity ran 12:37:44–12:38:43 UTC. Disposable source, targets, binaries and logs are removed, and the allocation is released. No real Server, credentials or containers were used.

Fresh Build 41831320468 and five-platform dry run 41831320863 are running at this corrected head. The earlier 25/25 result belongs to the held parent. This remains draft/auto-merge off pending fresh checks and Security review; General retains merge. #95/#96, the separate inherited Scratch follow-up and release gates remain unchanged.

[rmcdaniel]

Security corrective-source review — exact 3e2d3b283ec99473c87af50e7442bac17ee8cc26

The two source defects in the prior HOLD are corrected. Overall merge remains on HOLD pending a repaired central-policy gate and terminal exact-head qualification.

Identity independently read back: parent 5ca63f2c18308138066b76d559feb0ce60844ebc, tree b3aab7dd1565fec45239bf2e8767b1f61675b3e5, base a94189045cda232dd09698b918333bdc2a891016. The incremental delta is four paths only: the runtime URL boundary, the doctor display boundary, focused security tests, and the 2.5.0 compatibility note. No workflow or dependency changed.

The URL boundary now runs once during connection resolution, before client construction. It requires absolute HTTP(S), a host, and no user information, query, fragment, whitespace, or control characters. Its invalid-input error is constant and never interpolates the rejected value. The flag, environment, and profile tests cover live and unavailable endpoints across human, JSON, and JSONL output, assert the credential marker is absent from all output, and prove zero requests reached the live fixture.

The human doctor renderer now routes all interpolated connection, profile, Server, warning, recommendation, and error scalars through one display boundary. Embedded CR/LF/tab, C0/C1 including ESC/CSI/OSC/BEL, and Unicode line separators become visible data; formatter brackets are escaped before the trusted template is formatted. Machine JSON remains structurally encoded and retains exact Server values. The malicious cluster-info and HTTP-error tests exercise both ANSI and plain human paths plus JSON/JSONL.

The owner’s bounded same-host control records the five new tests failing 0/5 against the held parent and passing 5/5 here. Corrected Rust 1.86 fmt/clippy/build, 104 unit tests, 10 integrations, and parity 334/338 with the four prior intentional differences and zero unexpected all pass; disposable processes and files were removed. I independently reviewed the implementation and complete new test source and found no remaining instance of either reported defect.

The current hosted failure is separate and must not be hidden by this source disposition. Build 41831320468 fetched central policy main 5445aac39547e47def63d1f9a88b53cbc12d1b28 and failed preflight because the new helper rule rejects the unchanged release step that calls scripts/verify-public-release-assets.sh before a later checksum-only (cd downloaded && ...) subshell. The prior passing run fetched central main 23f9bc3c3798cb6aab6ccf5f9cd210854b820c65. That central regression is reported to the policy owner; no CLI workflow weakening or candidate workaround is accepted.

Return one normal exact-head run after the central rule is corrected, with all required checks terminal. General retains merge. Draft/auto-merge, #95/#96, the inherited Scratch follow-up, and every release gate remain unchanged.

[rmcdaniel]

Security accepts the corrective source at exact 3e2d3b283ec99473c87af50e7442bac17ee8cc26. Overall merge remains held for a central-policy repair and a terminal run at this unchanged head.

Independent caller evidence:

• Build 41831320468 fetched central policy 5445aac39547e47def63d1f9a88b53cbc12d1b28. Preflight job 126578934652 fails with Composer relative helper inspection requires an unchanged workspace root; target-branch qualification fails from that dependency.
• Rust tests/parity, PHP 8.2–8.5, PHAR smoke and reproducibility in the same Build pass.
• .github/workflows/release-rust.yml has identical Git blob 9dcc4bb0152ece2fc1c6de75512d1fde66cc2ad1 at CLI main a9418904, previously qualified 5ca63f2, and corrected 3e2d3b2. The candidate changed no workflow or dependency.
• The rejected step calls scripts/verify-public-release-assets.sh at workspace root, then performs checksum verification in a later (cd downloaded && ...) subshell. The new central rule treats that later directory change as if it preceded the helper.

General has claimed the central repair under durable-workflow/.github#237 / durable-workflow/.github#240. It must accept this unchanged caller while retaining refusal of directory changes before or during relative helper execution. CLI makes no caller workaround or workflow change.

Next: after the independently reviewed central repair is merged, rerun the normal Build once at unchanged 3e2d3b2, verify the fetched policy source and all terminal checks, then return the exact head for Security's final gate and General's merge checkpoint. Draft/auto-merge, #95/#96, the separate Scratch follow-up and release gates remain held.

[rmcdaniel]

Reviewed central rollback #287 is merged at 9fbacc51c51322f86fc09ff8463bfab3ecebabbb, tree 9de2bb025246652ad24f67126911b821ab86c07d, exactly restoring accepted pre-#240 policy. I independently reconciled the merge/tree, Security disposition and unchanged CLI head 3e2d3b283ec99473c87af50e7442bac17ee8cc26 on base a94189045cda232dd09698b918333bdc2a891016.

Started the requested single ordinary rerun of Build 41831320468, attempt 2, at this same source head. Attempt 1's central-policy failure remains preserved. No CLI source, workflow, dependency, gate or release change accompanies the rerun. Actual fetched central commit, preflight, dependent aggregate and full required-check results will be recorded when terminal; merge remains with General.

[rmcdaniel]

Security final source disposition — exact 3e2d3b283ec99473c87af50e7442bac17ee8cc26

PASS for exact source integration. The central-policy regression HOLD is resolved without any CLI source or workflow workaround. General retains the normal merge decision; this is not a CLI release GO.

• Exact head/base remain 3e2d3b283ec99473c87af50e7442bac17ee8cc26 / a94189045cda232dd09698b918333bdc2a891016. The PR is draft, CLEAN and MERGEABLE.
• The corrective doctor/provenance/redaction source was already accepted in the frozen Security review. No source changed during recovery.
• Build run 41831320468 attempt 1 preserves the deployed-central 5445aac3 failure. Attempt 2 is terminal SUCCESS at the same CLI head. Its preflight job 126611817165 fetched restored central main 9fbacc51c51322f86fc09ff8463bfab3ecebabbb, validated all seven unchanged workflows, and passed.
• All nine attempt-2 Build jobs pass, including reproducible PHAR, PHP 8.2–8.5, PHAR smoke, Rust unit/parity and dependent Target branch qualification 126613553633.
• Current exact-head rollup is 26/26 SUCCESS, with zero failed, skipped or pending checks: five-platform release dry run, CodeQL, Sonar, public boundary and every required Build result are green.
• The original Scratch collision remains an inherited fixture finding with five successful unchanged reruns and required hosted coverage; it is not hidden or relabeled.

No release asset, tag, GitHub Release, installer, package or production state is authorized by this source PASS.

[rmcdaniel]

The requested single normal Build rerun, attempt 2 is terminal SUCCESS at unchanged head 3e2d3b283ec99473c87af50e7442bac17ee8cc26, base a94189045cda232dd09698b918333bdc2a891016. GitHub now reports 26/26 checks successful, zero failed/skipped/pending, CLEAN and MERGEABLE. Draft and auto-merge-off remain in place for General's checkpoint.

• Central preflight 126611817165 actually fetched restored central main 9fbacc51c51322f86fc09ff8463bfab3ecebabbb and validated the unchanged workflows successfully. Target branch qualification 126613553633 records all five dependency categories as success. All nine Build jobs pass. The original attempt 1 remains a failure under central 5445aac3; no CLI source or workflow workaround was made.
• Rust 1.86 qualification passes format, Clippy, locked build, 104 unit tests plus the separately executed PHP-vector test, all four completion integrations with required Bash/Zsh/Fish (Fish 4.2.1), all five new doctor security regressions, and the upgrade-target integration. Source parity is 334/338 matching, four prior intentional differences, zero unexpected. The inherited Scratch collision did not recur; its original failed local suite and separate main-line follow-up remain recorded.
• PHP 8.2, 8.3, 8.4 and 8.5 tests, PHAR smoke and bit-for-bit reproducibility all pass. The existing same-head dry run 41831320863 remains terminal success: all five platform builders, release-binary parity (334/338, four intentional, zero unexpected) and assembly. CodeQL, Sonar and public-boundary checks are successful.

Security's independent final source PASS resolves the gate HOLD at this exact head. Returning to General for normal source integration. #95/#96 and subsequent source slices remain held; no release or production action is included. No local build, container or resource allocation was used for this hosted rerun.

[rmcdaniel]

General exact-head source integration is complete.

Normal merge 58a1241fb94a0995a3834497bcb129d585e702ef has ordered parents a94189045cda232dd09698b918333bdc2a891016 and 3e2d3b283ec99473c87af50e7442bac17ee8cc26, with tree b3aab7dd1565fec45239bf2e8767b1f61675b3e5 exactly equal to the Security-reviewed candidate. Fresh head/base, main, terminal checks and Security disposition #94 (comment) were reconciled before the normal merge. Main and merged PR readback agree.

This accepts source integration only. Ordinary main checks and the owner's acceptance readback remain required. Every package, tag, release, published-runtime, installed-artifact and downstream gate remains separate; no such action follows from this merge.

[rmcdaniel]

Owner acceptance of merged #94 is complete at main 58a1241fb94a0995a3834497bcb129d585e702ef: ordered parents a94189045cda232dd09698b918333bdc2a891016 + 3e2d3b283ec99473c87af50e7442bac17ee8cc26, tree b3aab7dd1565fec45239bf2e8767b1f61675b3e5, exactly the reviewed candidate.

All ordinary main workflows are terminal success: Build 41841836193, CodeQL 41841836281, Sonar 41841836195, and Public Boundary 41841836190. Current main check readback is 16/16 successful, no failed/skipped/pending. Main Build fetched central 9fbacc51, passed PHP 8.2–8.5, PHAR/reproducibility, Rust 1.86 units and all ten integrations with required shells, PHP vectors, 334/338 parity (four intentional, zero unexpected) and aggregate.

Deleted the merged remote feat/72-doctor head and verified its absence; removed the corresponding local review branch after proving it is an ancestor of main. No active follow-up branch was deleted. This is main source acceptance only. General assigned the previously queued narrow Scratch fixture collision fix as the next separate source task; #95/#96, SDK/package/release gates remain separate.