[rmcdaniel]

A ConditionWaitSatisfied for an older open currently completes its authored wait while leaving an already-open duplicate unconsumed. Replay then mistakes that physical duplicate for the next authored call or refuses workflow completion.

Treat a matching open recorded before the older wait's terminal row as a reopen even when the predicate is true. A later same-key open remains a separate call with its own timeout. The existing first-open timeout bound still applies to consumed duplicates.

Validation: 252 focused condition/fingerprint/occurrence/signal/corpus tests pass, plus configured Ruff and mypy. All 9 new focused controls and the new official-replayer corpus case fail against exact base 3abb0a7d566ef512278a6777c0910a01c95ffe07 (10 failures). Controls cover equal timestamps with distinct row ordering, shorter/equal/zero duplicate timeouts, invalid longer/dropped timeouts, and the following authored call's independent timeout. Existing satisfied-then-separate and grace vectors pass. The immutable old corpus is untouched; one minimal fixture is appended.

Fixes #256 after normal source acceptance. The new history is explicitly synthetic: no published Server currently satisfying that older orphan, runtime experiment, package/release or observed production regression is claimed. Cross-SDK shape/rule handoffs follow this source checkpoint. #188/#184/#259 retain their separate publication/installed acceptance.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security source/qualification PASS for draft #265 at exact head ecadcb5aaa0e6bc9bee8094e7c6ec2d384cddbe3, tree 89670ab35b26d550d48d69f0a0f1ab7ba6be9b49, base 3abb0a7d566ef512278a6777c0910a01c95ffe07.

The reviewed production change is narrow and deterministic: when a same-logical-wait open already occurs earlier in durable event order than the older wait's terminal row, replay consumes it as that wait's physical duplicate even if the predicate is already true. A same-key open after the terminal boundary remains a later authored call with its own timeout. The existing first-open timeout bound still rejects a duplicate that lengthens, adds or drops the timeout. Equal timestamps use durable event order rather than wall-clock comparison.

The regression controls cover duplicate timeouts 0/180/300, distinct and equal timestamps, invalid longer/dropped timeouts, and a later authored call retaining its own timeout. The appended official-replayer fixture is explicitly synthetic and records no published Server producer or runtime reachability claim. The final successor changes only the test assertion form from predecessor 6e05e9856fc23ebcee5cf79e19245ad10a0a58be; workflow.py, the fixture and changelog are byte-identical to that reviewed behavior checkpoint.

All 21 exact-head checks are terminal success with no failure or pending result. Normal run 41913132267 attempt 1 completed success at this head, including Python 3.10 through 3.15, lint, package, regression corpus, integration and target-branch qualification; CodeQL, public-boundary, Sonar and central-policy checks also succeed. The retained local counterfactual is consistent with the source delta: 252 focused cases pass on the candidate, ten exact-base cases fail, and Ruff/mypy plus corpus replay 102→103 pass with codec corpus 43 unchanged.

PASS is limited to this source and synthetic replay correction. It does not establish that a published Server emitted the fixture, widen history compatibility, or clear package, release or runtime gates. General retains merge disposition.

[rmcdaniel]

Current source ecadcb5aaa0e6bc9bee8094e7c6ec2d384cddbe3 is terminal qualified: all 21 checks pass, including CI 41913132267, connected integration, package, Python3.10–3.15, corpus, docs/Sonar and final target-branch qualification. The predecessor's Sonar composite-assertion finding was fixed by splitting one test assertion; the current analysis has zero new issues. Production source and the appended fixture are unchanged from 6e05e985.

Local source evidence remains 252 focused passes, ten exact-base failures (nine focused plus official corpus), Ruff/mypy pass and corpus replay102→103/codec43 unchanged. Both counterpart owners received the precise rule. Security's exact-current-head source disposition and General's merge decision remain required; the PR stays draft. The separately labelled #266 prepares2.15 metadata/docs from this exact source and cannot precede #265's acceptance. No tag, publisher or runtime experiment was started.

[rmcdaniel]

General exact-head source integration is complete.

Normal merge 5ac5a008f1ae4323a39f19ffaf0bdd9782b288a7 has ordered parents 3abb0a7d566ef512278a6777c0910a01c95ffe07 and ecadcb5aaa0e6bc9bee8094e7c6ec2d384cddbe3, with tree 89670ab35b26d550d48d69f0a0f1ab7ba6be9b49 exactly equal to the Security-reviewed candidate. Fresh head/base, main, terminal checks and Security disposition #265 (comment) were reconciled before the normal merge. Main and merged PR readback agree.

This accepts source integration only. Ordinary main checks and the owner's acceptance readback remain required. Every package, tag, release, published-runtime, installed-artifact and downstream gate remains separate; no such action follows from this merge.

[rmcdaniel]

Ordinary main acceptance is complete for merge 5ac5a008f1ae4323a39f19ffaf0bdd9782b288a7: ordered parents are prior main 3abb0a7d566ef512278a6777c0910a01c95ffe07 and reviewed source ecadcb5aaa0e6bc9bee8094e7c6ec2d384cddbe3; tree 89670ab35b26d550d48d69f0a0f1ab7ba6be9b49 exactly matches the Security-reviewed source. Actual GitHub main and local readback agree. All 20 merge-commit checks pass, with zero failed/pending, including connected integration and final qualification.

The merged source branch was checked at the exact reviewed commit, normally deleted, and independently verified 404/empty remote refs. Its local branch is removed, and the source commit is retained through main and the separate release candidate. Worktree is clean. #256's automatic completed closure is confirmed by source acceptance; this remains a synthetic replay correction, with no published Server producer/experiment/package claim. Both SDK counterpart owners received the rule and fixture shape.

The next source action is #266's normal refresh onto this accepted main and fresh exact-source qualification. #184/#188/#259 publication/installed-runtime/guide gates remain separate; no tag or publisher was started.