[rmcdaniel]

Changes

Refs durable-workflow/workflow#908. Update the embedded runtime from Workflow
2.9.0 to published 2.11.2 in both normal Composer locks and the embedded artifact tuple. This
includes the rolling-deployment fix that lets versioned workers claim an
unpinned activity without weakening pinned-build isolation.

The Server remains 2.10.0 with its separately declared Core 2.9.0 component.
All SDK, Waterline and CLI selections and all other locked packages are
unchanged. No Server image or shared/frozen cohort is retupled.

Validation

Normal Composer 2.10.3 resolution and installation pass on PHP 8.5.12 using
the reviewed trust bundle. Full lock comparison finds exactly one changed
package. The loaded Core is 2.11.2 / a730773a, and the activity bridge hash
matches the published release. Manifest validation, locked audit, installed
artifact graph and installed AI documentation contract pass.

Local application qualification is incomplete: the simple workflow test hits
the existing MySQL-only shared connection in the SQLite-only tool image. A
broader Unit attempt also fails development-image requirements (image-baked
SDK, Git worktree metadata, pip/Node/Docker and runtime inputs). These attempts
are retained as failed runner observations, not reported as passes or package
defects. Normal CI's real MySQL application suites and native image gates must
qualify this exact candidate before merge. No browser or published-image
acceptance is claimed by the local package check.

First hosted candidate f01a92c failed image job 120269025137 in run
39909529715: its unchanged image guard found Core 2.9.0 in the microservice
seed while the embedded tuple required 2.11.2. General missed that second lock.
Corrected 95e3640 updates it through normal Composer resolution; both lock
comparisons find only Core changed and strict validation/audit pass. The guard
and all other packages are unchanged. Fresh whole-tree checks are required.
Six still-live superseded Sample runs were cancelled; their cancelled states
and the original failed image remain explicit, with no transferred passes.
No Server/native original was cancelled.

Exact corrected candidate 95e3640 / whole 14b93ad8 now passes all 32
normal checks, including both real MySQL PHP application matrices, both
architecture workflow smokes, the candidate development-image build, all
published SDK consumer scenarios, CodeQL and Sonar. No prior-head pass is
carried across. The first failed image and cancelled superseded runs remain
explicit. Independent main checks and published-image qualification follow.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Published consumer acceptance is complete for this Sample change.

• Candidate 95e3640c passed all 32 checks. Merge de8a36108dd6ea0b723578b5a128ef2c7149d0df preserves whole tree 14b93ad8edc1c4138443b57f479075cd48194f09; all 30 independent main checks pass.
• Normal image publication 39913495254 passes all six jobs, including credential-free published-image acceptance on native amd64 and arm64 and promotion to both main channels.
• Independent anonymous registry inspection now verifies both ghcr.io/durable-workflow/sample-app-devcontainer:main and durableworkflow/sample-app-devcontainer:main. Both have amd64 child sha256:71e097365c64fadaa01ecd13e72a4db64099079c5b222b50bba118f80c79cb65 and arm64 child sha256:b759104af17ff7aac239fcc3852b9abce55cd2a4cee2e06b849e4e4f22b15701. Both child configurations identify exact merge revision de8a36108dd6ea0b723578b5a128ef2c7149d0df.
• Both embedded application locks use published Core 2.11.2 / a730773a. Every other package and the separate Server/SDK/frozen tuple components remain unchanged.

The first candidate's missed nested-lock seed failure remains failed. Initial manual registry readers also failed before correcting redirect handling; these verifier failures are separate from the final anonymous registry result. This delivers the embedded Sample consumer, not a replacement Server release or a new published Server worker-loss qualification.