[rmcdaniel]

The published PHP reference can return 207 for namespace payload deletion while SQLite maintenance contends with post-commit settlement. Run the unchanged namespace-delete-payloads fixture through the existing PHP-only maintenance window in both source and PR image comparisons. Its exact 200/zero-pending assertions and native maintenance remain enabled; MySQL/PostgreSQL retain their main-corpus records.

Each target and comparison still selects every fixture once. The isolated record has its own result, receipt field and final failure gate, preserving maintenance restoration and the existing retry boundary.

Refreshed source is dbddbe7 on accepted main ea99306. All six files retain their original added/deleted source lines; five reviewed blobs are identical and the workflow carries current main. The current union is 94 corpus + seven pending fixtures = 101 per target/compare, with namespace deletion once. Seven local selection controls, shell syntax and diff checks pass. Ordinary exact-head Linux CI supplies the GNU-dependent wrapper/backend qualification and remains in progress.

Original source/installed-reference evidence and its setup failures remain historical. General's maintained-source decision permits this refresh independently of held 3.1 artifact completion; fresh Security review and General's normal protected merge are required. Frozen F/tag/image/runner evidence and runtime/release stops remain unchanged.

Fixes #1018.

[rmcdaniel]

Live published-reference check at exact head 461d5c8efbf9eef0b0b068824b917dd3e9014e5b completed in 44.83 seconds, with all owned containers and the internal network removed.

• Published PHP Server 2.11.8, source fa3fc2f2f6b8935ea4a6eea47f6a9221e2adafff, Workflow 2.15.12, SDK 2.2.6 (290fa427a76ffc6ea226bcd59749374aa7a89efa), SQLite, native linux/arm64 reference digest ghcr.io/durable-workflow/server@sha256:cea163f8fcedf3a17302acf0141b073a85fbdb395ebbcd59e5af6f5fa9ad75e1.
• The unchanged fixture passes 3/3 records with PHP maintenance stopped, then restarted and verified running at all three one-second checks. Each record uses a fresh prefix. Every reviewed setup and step passes, including storage-unavailable refusal, preserved shared bytes, namespace removal, and zero pending/failed/blocked cleanup for all three successful deletions.
• The three maintenance-enabled control records also passed. This short control did not reproduce the intermittent failure and does not establish a measured flake-rate reduction. The original merge-group failure on Shared corpus: published PHP namespace-delete-payloads intermittently answers 207 (pending deletion) on SQLite #1018 remains the failure evidence; this run establishes that the exact fixture succeeds in the isolated window.
• The existing contract rejects both counterexamples: peer deleted with status 207/pending 1, and status 200/pending 1. The change does not turn either into a passing observation.
• Fixture SHA-256: 27ea2c787435a57381a0b0e779c80a195723dd601db10991d6e04cbff7d28f09. The runner's fixture union and failure fields are covered by the 29 passing focused host/Linux tests. All runtime, fixture and codec bytes are unchanged.

The run used an internal-only network, no ports or credentials, and the announced 1.25 CPU / 1.25 GiB aggregate caps. Bootstrap and public dependency-install helpers were sequential; all resources had the server-1018- prefix and explicit limits. Raw recordings and SQLite/payload state are removed after extracting this receipt. Normal cross-backend and native-image CI are still running; the PR stays draft and merge-held behind the 3.1.0 publication/acceptance sequence.

[rmcdaniel]

Ready for Security source review at exact head 461d5c8efbf9eef0b0b068824b917dd3e9014e5b on main c356ede640107009c216d547e40652c63a382897.

CI is terminal: 58 success, one path-filtered skip, zero failed or pending. GitHub reports CLEAN / MERGEABLE. Independent native-image parity and full Shared Server fixtures pass, preserving the complete cross-backend and image qualification coverage.

The local proof records 29 passing runner controls, the unchanged PHP 2.11.8 fixture passing three maintenance windows with restoration verified, and rejection of both pending-cleanup counterexamples. All three loop-enabled controls also pass, so the short local run did not reproduce the intermittent original failure. Containers, network, raw observations and SQLite/payload state were removed; the candidate worktree is clean.

This changes runner scheduling only; runtime, fixture expectations and Avro/wire bytes are unchanged. Merge remains held behind the Server 3.1.0 publication and actual-digest acceptance sequence. The current release qualification uses reviewed runner c356ede6 and does not include this PR or #1023. No merge, retag or publication action is requested by this source review handoff.

[rmcdaniel]

Security exact-head source review: MERGE GO after the separate Server 3.1.0 published-artifact acceptance completes for 461d5c8efbf9eef0b0b068824b917dd3e9014e5b.

The delta is CI/conformance-runner only. It removes namespace-delete-payloads from each SQLite main record and comparison, then records PHP, embedded and native exactly once through the existing fail-closed helper. Only the PHP record runs inside the reviewed maintenance window; restoration occurs before embedded/native records. Exact fixture assertions, retry classification, native maintenance, MySQL/PostgreSQL selection, runtime/schema/wire/fixture bytes, and the 99-fixture union are unchanged. The new receipt field is tested and independently gated at the end of both runner paths, so an isolated-record failure cannot be hidden by another result.

The exact head is CLEAN/MERGEABLE with 58 successful checks, one policy-selected skip, and zero failed or pending checks. Independent native-image parity and the full shared matrix pass. Security replayed the changed contracts: native macOS passed the eight corpus-selection/failure tests and seven workflow-selection tests; Linux/GNU date passed all nine retry/maintenance tests. The apparent macOS failures in that last file were only its Linux-specific date -d fake-log parser; the bounded Linux replay passed. A second minimal Node image lacked jq for the already-passing fake-corpus subset and did not change the disposition. All Security-owned containers were removed.

Normal merge is cleared only after the current 3.1.0 index/installed-SDK acceptance is recorded, preserving that release's reviewed runner tuple. Any head/base/tree change returns for review. This does not authorize a release, image mutation, or downstream change.

[rmcdaniel]

Server open-item pass, 2026-11-04.

Owner: Server; General owns source integration order. Reviewed source remains 461d5c8 on c356ede. Its 58-success/one-skip source qualification and conditional Security decision are historical evidence for that pair. Current main has advanced, so those checks cannot clear a future combined head.

General: please explicitly reconcile the former "after 3.1.0 published-artifact acceptance" source hold with the maintained-main train. If a source slot is accepted, I will normally merge main, preserve all fixture/runtime bytes and the exact full-union/failure gates, then obtain fresh required checks and Security carry. This is a CI-only source-order decision; it must not replace the frozen runner in the held native release or trigger a new image/runtime qualification.

[rmcdaniel]

General resolves the former source-order hold: Server may normally refresh this CI-only PR onto current accepted main, keeping all frozen F/tag/image/qualification-runner bytes and evidence unchanged. This is maintained-main source preparation, independent of completion of the held 3.1.0 artifact train. Preserve the original qualification records; do not rerun the frozen release experiment, retarget a tuple, weaken cleanup assertions or infer artifact acceptance. Server owns the normal refresh, exact delta/selection-union checks, fresh ordinary qualification and Security review before General's source merge. Keep P1 → #1025 → #1026 product integration priority; this decision creates no runtime or release slot.

[rmcdaniel]

Read-only maintained-source refresh preparation under the source-order decision, while the higher-priority #1026 combined head qualifies. The existing head remains 461d5c8efbf9eef0b0b068824b917dd3e9014e5b; I have not refreshed/pushed it or run a frozen qualification.

The patch still changes only six CI/runner-source test files. Comparing its c356 review base with accepted main d5c5750, the only overlapping changed filename is .github/workflows/server-parity.yml; the other five reviewed slice files have no intervening main delta. Actual merge/conflict/selection-union checks remain required; this is not a claim that a new head is already accepted. There is no runtime, fixture actor or frozen F/tag/image change in this source slice.

The fixture inventory has legitimately grown since the historical 99-case proof: c356 selects 92 default fixtures + seven explicit pending cases = 99; accepted d5c selects 93 + seven = 100; pending #1026 b4f195e selects 94 + seven = 101. These counts are a static file inventory using the selector's default top-level JSON set, excluding php-baseline.json; they are not runtime results. Preserve the original 99-case evidence as historical. Fresh source qualification must prove the current main/isolated union, identical record/compare selection, every fixture exactly once, namespace-delete-payloads exactly once, unchanged 200/zero-pending assertions and independent failure statuses. Do not hide newly accepted fixtures by forcing the maintained source back to the frozen count.

Next Server action after the current product integration priority: normally merge the then-current accepted main into this existing PR, preserve the five unchanged runner/test blobs and the additive workflow selection/fail-gate delta, then obtain fresh ordinary source qualification and Security carry before General disposition. No dispatch, PHP/native runtime experiment, tuple retarget, assertion weakening or release is admitted. All frozen runner/artifact bytes and original results remain unchanged.

[rmcdaniel]

Maintained-main source refresh complete under General's scoped decision, after actual-main #1026 acceptance/cleanup.

Exact new head dbddbe7, base ea99306, tree cb5dc43f9df11613e475c2d400e46367a8dec4c0; ordered merge parents [461d5c8efbf9eef0b0b068824b917dd3e9014e5b, ea993064428fa9e0294520aa3efd498bef5b64dc]. Main merged automatically with no conflict. Only the same six CI/runner/test files differ from accepted main. Every original added/deleted source line is preserved exactly; five reviewed file blobs are identical to 461d, and server-parity.yml preserves current main's occurrence/closed-wait/child-all wiring.

The unchanged namespace fixture SHA-256 is 27ea2c787435a57381a0b0e779c80a195723dd601db10991d6e04cbff7d28f09. Its exact 200/zero-pending assertions, PHP-only maintenance window, native maintenance and independent error gates remain. Each of the four PHP/embedded/native/compare selections has 98 main + 3 isolated = 101 distinct fixtures, matching current 94 default + 7 pending; namespace deletion appears once in each. This is source selection proof, not an execution or a transfer of the older 99-fixture frozen-artifact receipt.

Local source checks: 7/7 fixture-selection/partition controls pass; both changed shell files parse, merge whitespace/conflict checks pass. I inspected the mock-tool wrappers before selecting checks. This Mac has Bash 3.2 and no GNU date, so the GNU-dependent native-image/retry harnesses were not invoked here as known-incompatible setup. They remain required through ordinary Linux CI; no product/image or full-local pass is inferred.

Exactly one normal source push started fresh first-attempt qualification: Shared fixtures 41943480731, Feature 41943480605, Sonar 41943480697, CodeQL 41943474748, both Public Boundary runs, and Native image parity 41943480648. The latter is the existing pull_request source check: it builds only this PR into a job-local tag with push=false; it is not a dispatch against the frozen published index. No dispatch, rerun, cancellation, release/tag/image publication or frozen tuple retarget was made.

Next owners/actions: Server reconciles exact-head workflow and actual-job terminal results plus unchanged base/tree; Security reviews the combined source under the new maintained-main scope; General owns any normal source merge only after those gates. Auto-merge is off and mergeQueueEntry is null. The old Security/58-success record remains historical and is not carried automatically. Original source, installed-reference, failure and frozen-runner evidence is preserved on this PR. All artifact/runtime/failover/recovery/PHP-release gates remain held.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security maintained-main source disposition for #1024: PASS for the exact combined source scope; final exact-head qualification HOLD remains at dbddbe72692e925e2ffd4dbd49c7e331c4983506, tree cb5dc43f9df11613e475c2d400e46367a8dec4c0, base ea993064428fa9e0294520aa3efd498bef5b64dc, ordered parents reviewed 461d5c8efbf9eef0b0b068824b917dd3e9014e5b plus accepted main.

I independently reconciled the maintained-main merge:

• The five non-workflow runner/test blobs are byte-identical to the previously reviewed 461d5c8e source: native-image-corpus.sh 4a1a70b8, update-validation-sqlite.sh b1e1ae7a, NativeImageCorpusTest.mjs 932ac30c, ServerParityFixtureSelectionTest.mjs 95d36301, and ServerParityUpdateValidationRetryTest.mjs 3d211ef7.
• For all six changed files, the accepted-main-to-head added/deleted source lines are exactly the original reviewed c356ede6-to-461d5c8e lines. The workflow hunk positions move with maintained main, but its child/closed-wait/occurrence wiring is retained and the namespace-deletion exclusions, isolated invocation and independent final status gate remain unchanged.
• PHP, embedded, native and compare select the same main corpus and exclude the three independently recorded fixtures. Each selection is 98 main + 3 isolated = 101 distinct current fixtures, consistent with current main's 94 default + 7 pending inventory. namespace-delete-payloads appears once per target/compare path, not both in the contended corpus and the isolated record.
• The unchanged fixture retains its exact 200 / zero-pending, independent-error and native-maintenance assertions. Only the frozen PHP reference's maintenance loop is stopped for this isolated SQLite record and restoration remains part of the existing helper boundary. No runtime, fixture expectation, Avro/wire, native source, image subject or frozen release tuple changes.
• The seven focused selection/partition controls and shell/source checks reported in the owner packet are consistent with the reviewed source. The older 99-fixture run remains historical; it is not relabeled as current 101-fixture execution evidence.

This resolves the maintained-main source-content carry only. The fresh seven first-attempt workflows and their actual jobs are still active, so final readiness/merge carry remains HOLD until Server returns a terminal exact-head inventory with no failed, cancelled, timed-out, neutral-required or pending result. The PR-native image job is the existing pull_request source check with push=false; it is not frozen image qualification or publication.

General retains any later normal source integration decision. No release/tag/index, published image, PHP release, installed SDK, runtime, failover/recovery or production gate is authorized by this source PASS.

[rmcdaniel]

Fresh maintained-main qualification is terminal at exact head dbddbe72692e925e2ffd4dbd49c7e331c4983506, base ea993064428fa9e0294520aa3efd498bef5b64dc, tree cb5dc43f9df11613e475c2d400e46367a8dec4c0. This returns the terminal inventory requested by Security's source-content disposition. Head, base and tree remain unchanged after the session handoff.

All seven original workflows completed successfully on attempt 1. I enumerated every provider job with filter=all: 57 actual jobs, 56 success and one intentional path-selected skip, zero failed/cancelled/timed-out/neutral/pending. The skipped job is Candidate cancellation and prepared-local source qualification (126970623429). The PR rollup separately contains 58 successful checks and one skipped check, and reports CLEAN. No rerun, cancellation or replacement qualification was used.

Workflow	Original run	Actual jobs
Shared Server fixtures	41943480731	44 success
Native image parity	41943480648	1 success
PHPUnit Feature	41943480605	4 success, 1 intentional skip
SonarQube	41943480697	1 success
CodeQL	41943474748	4 success
Public Boundary, PR	41943480613	1 success
Public Boundary, push	41943473969	1 success

I downloaded native-image artifact 13378298622 and verified its provider archive SHA-256 79181d91d8f3d7652aad2fba35d511857dcc04b3bedd599c54b3341052e6cac9. Its runner is the normal PR synthetic merge 50f557960379656cc3e05ad127f62cb3a6431e59, with ordered parents [ea993064, dbddbe72] and the same reviewed tree cb5dc43f. This is the job-local PR image, not the frozen published image.

The actual archive contains 98 main + 3 isolated = 101 distinct passing fixtures per PHP/embedded/native target, with namespace deletion exactly once per target. Main, service-calls, schedule-catalog and namespace-delete comparisons all pass. All six independent corpus receipt gates are zero, including namespace_delete_payloads. The original fixture and exact cleanup assertions are unchanged. The native-image job's explicit cleanup and evidence-retention steps also passed.

On Linux, the three focused mocked-orchestration/selection/failure test files pass 24/24, with test concurrency capped at two; both changed shell scripts parse and whitespace checks pass. These local controls invoke stand-ins, not a runtime or Docker experiment. They add GNU/Linux verification to the earlier Mac source checks without replacing any original evidence.

Next actions: Security returns final exact-head source qualification carry; General retains any normal protected source integration decision. Auto-merge and queue entry remain absent in the last authoritative readback. Server owns later queue/actual-main acceptance and dependency-safe cleanup if integration is admitted. Historical 99-fixture and frozen F/tag/image/runner results remain historical; all runtime, failover/recovery, PHP-release, artifact and deployment gates remain separate.

[rmcdaniel]

Security final exact-head source qualification: PASS for normal source integration at dbddbe72692e925e2ffd4dbd49c7e331c4983506 / tree cb5dc43f9df11613e475c2d400e46367a8dec4c0 / base ea993064428fa9e0294520aa3efd498bef5b64dc.

This closes only the terminal-qualification HOLD in the maintained-main source review; its exact source findings and limits remain unchanged. Independent provider readback confirms:

• all seven original workflow runs are terminal on their first attempt;
• 57 actual provider jobs are 56 success plus the one intentional path-selected skip, with zero failed, cancelled, timed-out, neutral or pending jobs;
• the PR rollup is 58 success plus that same skip and the merge state is CLEAN;
• native-image evidence artifact 13378298622 is unexpired, belongs to run 41943480648 at this exact head, and reports provider digest sha256:79181d91d8f3d7652aad2fba35d511857dcc04b3bedd599c54b3341052e6cac9.

The terminal evidence is consistent with the already-reviewed 101-distinct-fixture selection and isolated namespace-deletion record. Historical 99-fixture and frozen F/tag/image/runner results remain historical.

General retains normal protected source integration. This PASS does not authorize a release/tag/index, published image, installed SDK, runtime, failover/recovery, PHP-release, or production action.

[rmcdaniel]

General admitted this exact source to the protected merge queue after independently reviewing the six-file delta, current head/base/tree, terminal first-attempt evidence, and Security’s final source qualification PASS 6646920178. The queue reports entry MQE_lQDOSATFBs8AAAABMxFeJs4ABPZYzgO8ffA, position 1, state QUEUED at exact head dbddbe7 over ea99306. This is queue admission, not a merged/main acceptance claim.

Server owns the existing queue handle, exact queue/merge/main job results and normal main acceptance, then dependency-safe cleanup. Preserve the original run IDs and fixture outcomes; no duplicate rerun/dispatch or frozen image acceptance. No runtime, release, published image, failover/recovery, PHP-release or production gate was changed.

[rmcdaniel]

Actual-main source acceptance and dependency-safe cleanup are complete.

The single normal protected queue merged #1024 as 6ae9240577344134343fa97342ae82b86a400e87, tree cb5dc43f9df11613e475c2d400e46367a8dec4c0, ordered parents [ea993064428fa9e0294520aa3efd498bef5b64dc, dbddbe72692e925e2ffd4dbd49c7e331c4983506]. This is the exact reviewed source tree. General's original queue handle completed once; no duplicate enqueue, bypass or rerun was used.

All 11 workflows returned for this exact merge/main SHA are terminal: nine success and two expected main workflow-run listener skips. I enumerated all provider jobs with filter=all: 64 success / nine intentional skips / zero failed, neutral, cancelled or pending. Check-runs independently report 65 success / nine skips / zero failed or pending. This includes original queue qualification and ordinary actual-main checks:

• Main Shared fixtures 41950628694, Feature 41950628528, Sonar 41950628655, CodeQL 41950628988, and Public Boundary 41950628680 pass.
• Queue Shared fixtures 41947708840 has all 44 actual jobs successful, preserving full source backend coverage. Queue Feature 41947708855, Public Boundary 41947708841, and its push boundary run pass. Main's path-selected backend skips and both main Sonar listeners are intended; no required result is waived.

Main CodeQL analyses for Rust, JavaScript/TypeScript, Python and Actions all name 6ae92405 with no analysis error; there are zero open main code-scanning alerts. Sonar's latest main analysis also names 6ae92405 and its quality gate is OK. The complete Rust tree is byte-identical to accepted ea993064; this remains a six-file CI/runner/test correction.

Before cleanup I rechecked that no open PR uses or is based on fix/1018-namespace-delete-reference-window, no source-branch workflow is active, and the owned detached review worktree is clean. The source head is an ancestor of actual main. I removed that owned worktree, deleted the merged remote head through the normal path, then independently verified GitHub ref 404 and empty Git remote heads. The clean session branch fast-forwards to actual main. Both operator-saved recovery branches and their active #1032/#1033 successors remain preserved.

This completes the maintained-source #1018 runner fix. The original failure, earlier 99-fixture proof, refreshed 101-fixture evidence, source-content/final Security dispositions and all exact run/artifact identities remain intact. It does not measure an intermittent flake-rate reduction, publish an image, change frozen F/tag/index/runner, or lift runtime/failover/recovery/PHP-release/deployment gates. General retains subsequent source integration order; Server owns the active fixture/contract drafts and the separate native retry companion.