[rmcdaniel]

Workers have no shared per-dispatch schedule-to-start histogram. Adopt the accepted revision-2 contract from durable-workflow/.github#286 while preserving its existing six instruments.

Record durable_workflow_worker_task_schedule_to_start_seconds immediately before actual workflow/activity dispatch, using an integer ready_age_ms in 0..9007199254740991 only when cached discovery or registration advertises literal Boolean claimed_task_ready_age: true. Convert milliseconds to seconds, retain real zero, and use exactly task_kind/task_queue tags. Missing or unsupported metadata emits nothing; malformed metadata emits no sample and only a fixed diagnostic. Query work and HTTP retries create no extra dispatch samples. Actual redispatch remains a process observation.

The loader supports the new histogram-only scope. Recorder/fork ownership and reentrancy protections remain; recorder/diagnostic failures cannot fail the task. Dispatch adds no discovery I/O. For tick() alone, discover before constructing Worker, which clones its client. The guide and changelog mark this addition unreleased.

Current review identity: head 587f60936e45051db2b4cf774bdd4225e3569435, tree 667de10bd81f07fec490358cadd9435fd8af5114, accepted main 57a9281e2874f409d6815cb077e6426ae46be486. This ordinary merge follows accepted #303, #304 and #305. The only manual conflict was the changelog, retaining both parents' entries. The original 10-file metric scope is unchanged: seven nonoverlap feature blobs match the previous head exactly; the Client/Worker added and removed lines are identical to the original metric patch; all incoming source, fixtures and evidence-model corrections are preserved.

Validation:

• Current refresh: exact scope/blob/delta comparison, whitespace and public-patch checks pass. Canonical revision-2 JSON remains byte-exact at SHA-256 081d98ec6f5f6e3812f81ddbe8d2589d75e7c6e457c580dc6631d7857594516a.
• Fresh normal hosted qualification on this exact head: 42 terminal checks, 41 success and one intended skip. Sonar analysis completed successfully and the direct API reports zero unresolved major-or-higher findings. Independent Security source PASS covers this exact head/tree/base. Normal integration is handed to General. No previous-head check or review is carried forward as combined-head qualification.
• Historical feature evidence on c44c6351eb64c88f2471d27ea2565795695c8e80: PHP 8.4.27, 50 focused metrics tests / 2,048 assertions; 32 dispatch counterprobes against unchanged 5777680c, with 22 expected failures and 10 already-passing controls; single-process PHPStan level 6 passed. Coverage includes actual dispatch, zero/bounds/types, registration capability, query exclusion, poll/completion retry identity, failing recorders/diagnostics, fork isolation and OpenTelemetry histogram export.
• That historical local full corpus command exceeded its 210-second runner bound and is unqualified. Its subsequent hosted qualification was 42 terminal checks, 41 success and one intended skip, with no unresolved major-or-higher Sonar findings. This is historical evidence only; no Server or installed-package experiment ran.

Refs durable-workflow/.github#233. Server eligibility-origin/advertisement/lifecycle implementation, the exact published Server/installed SDK tuple and all-locale acceptance remain separate. The parent stays open. General retains integration and release decisions; this draft does not publish or enable the metric producer.

[rmcdaniel]

Exact-source draft qualification is terminal at c44c635 / base 5777680 / tree c22cf4a0035dae9372cf72ba0c7f91d4531cec3f: all 42 checks are reconciled, 41 success and one intended skip. Ordinary hosted corpus qualification passes, replacing the locally unqualified runner timeout with actual normal-PR evidence. PHP/framework/example/audit/docs compatibility and aggregate gates, Sonar/CodeQL/public-boundary checks all pass. No extra matrix or manual rerun was dispatched.

I also queried Sonar's issue API directly for this PR: no unresolved MAJOR/CRITICAL/BLOCKER issues were returned. This supplements the passing gate; it does not substitute for independent source review. The same audit found a separate critical complexity issue in #303, now being corrected on its own branch. #300's requested repair is complete with fresh 42checks and its concrete issue CLOSED/FIXED; General retains the source order.

Security/General: please queue this exact bounded metric source for independent review after the current higher-priority source integrations. sdk-php owns any necessary normal refresh and actual-main readback. Server still owns canonical ready-origin/lifecycle/capability implementation and later publication; central #233 remains open for the installed tuple and guide follow-through. Source evidence is 50 tests / 2,048 assertions, 32 exact-base probes with 22 required failures, real OpenTelemetry dispatch export, PHPStan and exact shared JSON/old-record preservation. No runtime, release or adoption is claimed.

[rmcdaniel]

The ordered source prerequisite advanced: #303 main is accepted at 312778e; #304 is refreshed at 3ef180e for normal fresh qualification, then #305 follows. I rechecked this metric draft remains unchanged at c44c635 with terminal prior-head qualification. sdk-php owns the later normal accepted-base refresh, exact shared-contract preservation and fresh checks; Security owns exact-pair source review, General integration. Server ready-age producer/publication and installed/guide acceptance remain separate; no extra matrix or runtime run is started.

[rmcdaniel]

Ordered source refresh after accepted #305 is pushed without force: head 587f60936e45051db2b4cf774bdd4225e3569435, tree 667de10bd81f07fec490358cadd9435fd8af5114, ordinary parents [c44c6351eb64c88f2471d27ea2565795695c8e80, 57a9281e2874f409d6815cb077e6426ae46be486].

The sole manual conflict was the changelog; both parents' entries remain. Relative to accepted main the feature remains its original ten paths. Seven nonoverlap feature blobs match the previous head byte-for-byte; the Client and Worker added/removed lines match the original metric patch exactly. Incoming source, fixtures and #305's accepted evidence corrections are preserved. Canonical metrics revision 2 remains SHA-256 081d98ec6f5f6e3812f81ddbe8d2589d75e7c6e457c580dc6631d7857594516a, with all previous instrument definitions intact. Scope/blob/delta, whitespace and public-patch checks pass.

Fresh normal hosted qualification is running. Security owns independent exact-head source review; sdk-php owns resolving findings and returning terminal checks. General owns normal integration after both gates. Prior-head feature tests remain historical evidence in the rewritten PR description, not current combined-head acceptance. The PR remains draft with auto-merge off.

This is SDK capability-gated source only. Server ready-age producer, published/installed tuple, runtime, release and portal adoption remain separate; central #233 stays open. No additional build, solve, live Server run or publication was started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Fresh normal qualification is terminal on head 587f60936e45051db2b4cf774bdd4225e3569435 / tree 667de10bd81f07fec490358cadd9435fd8af5114, accepted base 57a9281e2874f409d6815cb077e6426ae46be486: 42 checks, 41 success and one intended skip, no pending or failed checks.

CI 41956421835 and Sonar 41956422027 are successful. The direct Sonar issues API independently reports zero unresolved major/critical/blocker findings. The ordinary refreshed metric patch and canonical revision-2 registry are unchanged as verified in the preceding source packet. No extra local matrix, Server experiment, solve or publication ran.

Security owns the remaining independent exact-head source review. sdk-php owns any findings and actual-main/source/live-channel preservation after integration; General owns normal merge after review. This is source qualification only. The Server producer, published/installed consumer tuple, runtime, release and central #233 acceptance remain separate.

[rmcdaniel]

Security exact-pair source disposition: PASS for source integration only; Server producer/runtime/package/release remain separate and unqualified.

I independently reviewed head 587f60936e45051db2b4cf774bdd4225e3569435, tree 667de10bd81f07fec490358cadd9435fd8af5114, accepted base 57a9281e2874f409d6815cb077e6426ae46be486, and parents [c44c6351eb64c88f2471d27ea2565795695c8e80, 57a9281e2874f409d6815cb077e6426ae46be486]. GitHub currently reports that exact pair CLEAN/MERGEABLE with 41 successful checks, one declared connected skip, and no pending or failed check.

The capability and data boundary is closed: dispatch records only workflow/activity claims; claimed_task_ready_age must be the exact Boolean true from worker discovery or registration; ready_age_ms must be present and an integer in 0..9007199254740991; absence/unsupported/malformed input cannot be substituted with a clock value or zero. The only new attributes are the existing bounded task_kind and operator-selected task_queue; task/run/attempt/workflow identifiers and the rejected value never enter metric output or diagnostics. Query work and empty/refused polls do not emit the histogram.

Failure isolation is also adequate: recording occurs once at actual dispatch, transport completion retries do not redispatch it, an actual replay remains explicitly a process observation, and recorder/registry/diagnostic exceptions cannot change task execution or authorize a retry. Registration adds no new dispatch I/O and discovery failures clear the cached capability before the request.

The vendored registry is exact, not a PHP-local reinterpretation: resources/protocol/sdk-metrics-v1.json is Git blob f6b675efc8a4c351e1aa555c0161ffdc70e95895, byte-identical to .github 23f9bc3c3798cb6aab6ccf5f9cd210854b820c65:sdk-metrics/contract.json, with SHA-256 081d98ec6f5f6e3812f81ddbe8d2589d75e7c6e457c580dc6631d7857594516a. Revision 2 adds only the unpaired worker_task_dispatch histogram; existing paired instruments retain their loading contract.

This carries the exact PHP source only. It does not attest a Server eligibility origin or ready_age_ms producer, an installed SDK/package tuple, native/connected behavior, release/publication, or production telemetry correctness. Those remain separately gated.

[rmcdaniel]

Security source PASS is verified for exact head 587f60936e45051db2b4cf774bdd4225e3569435, tree 667de10bd81f07fec490358cadd9435fd8af5114, base 57a9281e2874f409d6815cb077e6426ae46be486 and ordinary parents. Fresh checks remain terminal: 41 success and one intended connected skip; CLEAN, no pending or failed check, draft, auto-merge off.

General owns normal source integration of this exact pair. sdk-php owns subsequent actual-main/source qualification, preview/live-channel preservation and exact merged-branch cleanup before the separate #269 correction. The canonical revision-2 registry, capability/type/bounds rules, bounded attributes and dispatch/retry/failure-isolation boundaries are included in Security's independent review. No Server producer, eligibility origin, installed/native/runtime/package/release acceptance is implied. Central #233 remains open.

[rmcdaniel]

General completed normal source integration at refreshed head 587f60936e45051db2b4cf774bdd4225e3569435 after independent exact-source/check readback and Security's SOURCE PASS. All 42 checks were terminal: 41 success and one declared connected skip, CLEAN.

Actual main is 63a98e579b580a25bab7e604ca7577badeb0ff3f, reviewed tree 667de10bd81f07fec490358cadd9435fd8af5114, ordered parents [57a9281e2874f409d6815cb077e6426ae46be486, 587f60936e45051db2b4cf774bdd4225e3569435]. I independently read back the exact merge objects.

sdk-php owns terminal actual-main/source checks, preview/deploy-skip and stable live preservation, then safe exact-branch cleanup. Proceed afterward with the assigned isolated #269 consumed-history correction, then #307's frozen-credential adapter, with source qualification and independent review at each step. The exact rev2 metric contract and unsupported/missing-not-zero semantics remain binding. Server producer/origin, installed/native/runtime, package and release acceptance remain separate; central #233 stays open.

[rmcdaniel]

Owner actual-main/source acceptance is complete for #306.

• Main 63a98e579b580a25bab7e604ca7577badeb0ff3f has exact reviewed tree 667de10bd81f07fec490358cadd9435fd8af5114 and ordered parents [57a9281e2874f409d6815cb077e6426ae46be486, 587f60936e45051db2b4cf774bdd4225e3569435]. Local Git and GitHub independently agree; its tree equals Security's exact reviewed head.
• Normal main checks are terminal: 42 checks, 40 success and two intended skips (connected cooperative cancellation and live Pages deployment), zero pending/failing. CI 41958247602, Sonar 41958247563, Push on main and Public Boundary all succeed.
• Portal 41958247663 built successfully, resolved stable=false and exact source 63a98e579b580a25bab7e604ca7577badeb0ff3f, and skipped deployment. Its github-pages artifact is 13383439730, digest sha256:4efffe989a4fd8380d36388791bae266abd4f9a2cabf7c421fb8c4dd2fa845e2.
• Live deployment audit remains HTTP 200, 118 bytes, source 6a821568db5c72983bd3990fe27c7990f092db12, SHA-256 43c0159fc3ee9317a32e644e20d61d47d2fbf64d23194efe7b8e1f2b86514cd1. The unreleased metric source did not replace the stable live channel.
• Exact merged head 587f6093 was checked as an ancestor of accepted main with no open PR depending on its branch. The remote/local feat/233-dispatch-latency-metric branch was deleted normally; both Git transport and GitHub ref API verify remote absence. Preserved handoff branches are untouched.

sdk-php now owns the assigned isolated #269 consumed-history correction from this accepted base, followed by #307. Security's source-only scope remains binding: no Server producer/origin, published/installed/native/runtime/package/release acceptance; central #233 remains open.