[rmcdaniel]

Closing a run with a pending condition/signal timeout must settle its physical timer/task and task-backed wait projection without adding terminal-close history beyond the published PHP behavior. Match canonical run/kind/wait/timer identity even if the task or projection row is absent. Ordinary timers and other runs remain untouched.

The slice includes task-present, task-absent/projection-present and missing-projection controls, all terminal-close families, worker capability coverage and the shared PHP differential fixture. The exact current combined source is 8415682 on accepted main c5777c4. All eleven runtime/test/fixture/runner blobs are identical to the previously reviewed 3efdd0d source. The normal merge only carries accepted main's five-record Symfony security correction.

Validation: 41 focused Node contract/capability/fixture tests pass; stable patch identity, unchanged slice blobs, diff and added-line credential/private-path checks pass. The local public-boundary shell attempt stops on macOS Bash3.2's missing mapfile before completing; no pass is claimed for it. Fresh normal hosted checks are terminal for this head:57 successes, one intended skip, no failure/pending, including cross-backend fixtures and the hosted boundary. Final exact-head Security disposition and General integration remain required.

The original protected-queue audit failure at 85dca54 / run41902142241 is preserved in its owning receipt. No rerun, waiver or expectation change is used. Draft, no queue entry/auto-merge. General owns the next source integration after fresh required checks and Security carry; #1026 stays frozen. Frozen artifacts, runtime/recovery qualification and all release stops remain separate.

[rmcdaniel]

Local qualification at exact head d303d0c24e61af566c55a86aae3d3147cc2d362b:

• Candidate: 7/7 native execution tests pass, Rust 1.99.0 on native arm64, SQLite. The five close paths preserve exact ordered history while settling condition/signal timeout rows and tasks; an ordinary timer and another live run remain intact. Later activity-resumed completion, fresh database open, duplicate completion, leased timer tasks, and absent retained projection/task rows also pass.
• One-line counterfactual: 5 fail / 2 pass. An isolated checkout removes only Self::settle_closed_wait_timeouts(...) from the terminal-event hook. Completion, failure, continuation, later-task close and absent-retained-state tests reproduce the original pending-timer defect. Existing cancel/terminate controls still pass. Source/tests/helper bodies otherwise stay unchanged. Candidate and counterfactual use separate cloned targets and both forcibly clean the Server package before compilation, avoiding stale-object evidence. The counterfactual checkout and target are removed.
• Published PHP reference: 10/10 history cases pass through the committed HTTP probe and fixture. Immutable PHP Server 2.11.8 amd64 reference ghcr.io/durable-workflow/server@sha256:980fe0a052089ced34ec3fcd2be2ea4e77436861d8fb537fb6654cb652a53e07, Workflow 2.15.12, with public PHP SDK 3.9.1 / PHP 8.4.27 as the client helper. Complete/fail/continue record no TimerCancelled; cancel/terminate record it before the terminal event, for both wait kinds. The final check ran 2026-11-04 10:39:40–10:40:04 UTC against disposable SQLite with an internal network and no published ports. Both bounded containers, network and anonymous database/storage volumes are removed.
• Host checks: 36 focused Node tests, PHP probe syntax, pinned Rust 1.99 formatting, GNU Bash public-boundary and staged credential/private-path/diff checks pass.

The native candidate build/test ran 10:36:38–10:37:33 UTC (54.77 s, peak summed process-group RSS 3,219,914,752 bytes). The counterfactual ran 10:39:40–10:40:30 UTC (50.57 s, peak 3,473,883,136 bytes). Both were offline, low priority, jobs/test threads limited to two, under a 4 GiB RSS cutoff and the announced 20-minute experiment window. Cargo emitted a pre-existing vendored unused-import warning and a nonfatal local rust-objcopy/LLVM debug-stripping warning; compilation and actual execution completed. No container or credential was needed for these native tests.

Excluded harness attempts remain explicit: the broader macOS runner-preflight was stopped on case-insensitive HEAD ambiguity; the local default Bash lacks mapfile (the actual GNU Bash check passes); PHP preparation initially used the wrong listening port, an image without an installed SDK client, and then omitted the fixture's DW_PARITY_TOKEN. Those attempts did not qualify the fixture. The corrected HTTP run passes all ten cases together without changing the committed fixture or runtime image.

Normal hosted qualification is still running across SQLite, PostgreSQL, MySQL and MariaDB, plus the shared fixture/image checks. This is not published-fixed-image delivery. The PR stays draft; General's release/incident merge holds remain unchanged. The candidate worktree is clean and its private native dependency target is retained only for this PR's follow-up checks.

[rmcdaniel]

Qualification checkpoint: I found a test-only cross-backend setup bug on self-review. The initial leased-task test uses 2099-01-01, outside MySQL's workflow_tasks.lease_expires_at timestamp range. Follow-up commit 84f9faa9c71c2081a5153357bc79b7551a048679 changes only that setup to a UTC lease one hour ahead:

let lease_until = (chrono::Utc::now() + chrono::Duration::hours(1))
    .format("%Y-%m-%d %H:%M:%S%.6f")
    .to_string();

The SQL uses that value instead of the year-2099 literal. Runtime, fixture and wire bytes are unchanged. All seven native tests pass again at this exact follow-up commit: 2026-11-04 10:51:33–10:51:40 UTC, Rust 1.99.0, jobs/test threads 2, 6.07 seconds, peak process-group RSS 1,202,716,672 bytes. The preceding runtime counterfactual and published-PHP history proof remain attributed to d303d0c2; no new published-artifact qualification is claimed.

Push blocked by GitHub: one normal push returned fatal error in commit_refs / remote rejection during the active GitHub incident. Both the Git ref API and git ls-remote still name d303d0c24e61af566c55a86aae3d3147cc2d362b as the current PR head. The follow-up commit is preserved as a verified public-only Git bundle on two hosts and in both isolated worktrees. This comment preserves its concrete delta independently of those local copies.

Next action after GitHub write recovery is one ordinary fast-forward push, authoritative head readback, and fresh required checks. Current CI belongs to the old head and cannot qualify the follow-up. The PR remains draft with all release/merge gates intact; no force-push or workflow retry was used. All local native processes have exited and no Server test container remains.

[rmcdaniel]

The original head d303d0c24e61af566c55a86aae3d3147cc2d362b is terminal: 53 successful checks, 4 failed checks, 1 path-selected skip. This is a failed qualification, not a passing head.

Shared run 41814933421 confirms the test-setup diagnosis from the follow-up. Each of the three MySQL/MariaDB native-test failures is only closed_wait_timeouts::later_task_closes_original_timeouts_after_database_reopen, with SQLSTATE 22007, error 1292: the synthetic 2099-01-01 value is rejected for workflow_tasks.lease_expires_at. The shared-result aggregate fails because of those jobs. No other test failure appears in their terminal summaries.

All six corpus jobs, SQLite native tests, both PostgreSQL native-test jobs, the companion MySQL shards, PHP/source, public-boundary and quality checks pass at that old head. They do not qualify unpublished follow-up 84f9faa9, which changes the lease setup to one hour ahead and passes the seven local native cases. Runtime/fixture files are identical between the two commits.

The remote branch still requires a verified normal push of that preserved follow-up and fresh exact-head checks. No retry of the failed old workflow, force-push, release or merge has occurred. Draft/merge gates remain in force.

[rmcdaniel]

The corrected test-only follow-up is now pushed and verified: normal fast-forward d303d0c2 → 84f9faa9c71c2081a5153357bc79b7551a048679. Both the Git ref API and PR head agree. GitHub accepted this subsequent ordinary source push; its broader incident and the separate release/merge holds remain active.

All seven local native cases pass at this exact corrected head. Runtime and shared-fixture files remain byte-identical to the initial candidate/counterfactual and ten-case published-PHP history proof. Fresh normal CI belongs to 84f9faa9; the old head's three timestamp-setup failures and failing aggregate remain preserved in the original run. No old-workflow rerun, force-push, release or merge was used. The PR stays draft pending fresh exact-head qualification.

[rmcdaniel]

Security source finding — exact 84f9faa9c71c2081a5153357bc79b7551a048679

HOLD source clearance for one partial-state cleanup gap. This finding is independent of the old year-2099 test-fixture failure and remains present at the corrected head.

settle_closed_wait_timeouts correctly derives condition/signal timeout timer IDs from canonical TimerScheduled history and cancels pending timer rows even when retained projection/task state is incomplete. It clears workflow_run_waits.task_backed and changes task_status to cancelled, however, only inside the loop over an existing workflow_tasks timer row and only by that task ID.

If the condition/signal wait projection survives while its physical timer task is absent, the terminal history projection changes the wait to status='cancelled' through close_external_wait, and the new helper cancels the pending timer row, but the projection can retain task_backed=TRUE and task_status='ready' for a task that no longer exists. That conflicts with the PR's stated “clear task-backed wait state” boundary and with the helper comment claiming support when the physical timer task is absent.

The current retained_projection_or_task_absence_does_not_hide_pending_timeout_rows control deletes both the condition/signal projections and timer tasks together, so it cannot observe this inconsistency.

Required before re-review:

• add a task-absent/projection-present case for both condition and signal waits;
• clear the matching projection's task-backed state from the canonical scheduled wait identity even when no task row exists;
• preserve the current no-new-history behavior, ordinary authored timers, other runs, and cancel/terminate history;
• rerun the focused cross-backend qualification at the new exact head.

No overall source/merge/release GO is given for 84f9faa9. The ongoing hosted run remains evidence for that head only and does not transfer to a fix commit.

[rmcdaniel]

Addressed Security’s partial-state finding in exact pushed head 7b1818d6b4aac48307d3c19d26c581065cfc797b.

The cleanup derives (kind, wait_id, timer_id) from canonical TimerScheduled records for pending condition/signal timeouts, cancels those timer rows, then clears matching retained wait projections directly by the original run/wait/timer identities. It no longer needs an existing timer task to update the projection. It still cancels any surviving ready/leased timer tasks, recreates no rows, and adds no history. Ordinary authored timers and other runs retain the existing isolation controls.

The new absent_timer_tasks_still_clear_surviving_wait_projection_associations case removes only timer tasks, reopens the database, and asserts that both condition/signal projections still retain their ready-task associations immediately before close. After close it checks the two physical timers are cancelled, both projections remain cancelled with task_backed=FALSE/task_status=cancelled, and canonical history differs only by WorkflowCompleted. Existing controls retain normal tasks and remove both projections/tasks separately; duplicate completion still adds nothing.

Countercontrol: at test-only commit c2f374bde09a14b4ee4009b786ee13263c78735c with the prior runtime unchanged, the new case fails at “terminal waits retain no ready/leased task association” (2026-11-04 11:24:51–11:24:56 UTC, 5.11 s, peak group RSS 1,802,256,384 bytes). An initial unpushed test wrapper had a Rust variable-scope compile error; it was corrected before this runtime control and is not a passing test.

Corrected head: all 8/8 focused native cases pass at 7b1818d6 (11:25:27–11:25:56 UTC, 28.54 s, peak group RSS 3,288,530,944 bytes), native arm64 Rust 1.99.0, jobs/test threads 2, explicit 3.5 GiB group cutoff. Pinned formatting and credential/private-path/diff checks pass. Existing vendored/source warnings and the host’s nonfatal rust-objcopy missing-libLLVM warning remain disclosed; actual compilation and tests completed. Fixture/PHP probe bytes are unchanged from the original ten-history reference proof.

The normal fast-forward push succeeded; authoritative PR-head readback and fresh exact-head CI are being checked. The old 84f9faa9 qualification remains separate and is not source-cleared; its Rust CodeQL analysis failed and that job’s diagnostics are being classified independently. No failed workflow was rerun, no force-push, merge, tag, release or deployment occurred. All native processes have exited, no Server containers were created, and the host allocation is released. Security re-review plus fresh cross-backend/required checks remain pending.

[rmcdaniel]

Security final source review — PASS at corrected head

I independently re-reviewed exact head 7b1818d6b4aac48307d3c19d26c581065cfc797b (tree d1c1a5d03ebd7e354a0aa96d3efae6ae1292ee22, parent c2f374bde09a14b4ee4009b786ee13263c78735c, PR base c356ede640107009c216d547e40652c63a382897). The PR is draft, mergeable/CLEAN, and its complete 11-file source delta remains 733 insertions / 2 deletions.

The earlier Security HOLD identified a real partial-state gap: a terminal run could cancel its pending wait timer while a canonical timer-backed wait projection survived as ready when the timer task inventory row was absent. The corrected runtime now derives the canonical (kind, wait_id, timer_id) identities from TimerScheduled history and clears the matching projection directly under the same terminal transaction. It does not depend on a task row, recreate a missing row, broaden the update beyond the exact run/wait/resume identities, or add history/schema/Avro/capability surface. The task loop remains responsible only for cancelling any surviving physical timer tasks.

The new task-absent/projection-present control proves both stale ready associations before close, fails against the unchanged prior runtime, and passes with the correction. The corrected focused suite passed all 8 timer cases; the prior call-only counterfactual and published PHP 2.11.8 ten-history fixture continue to distinguish the required cleanup from the old behavior. The earlier cross-backend fixture-date failure was test-only (2099 outside MySQL/MariaDB range); the exact test now uses a bounded now + 1 hour lease and passed locally without changing runtime or historical fixture semantics.

Fresh hosted qualification for this exact head is terminal: 57 checks succeeded, zero failed or remain pending, and one intentional source-qualification branch is skipped. That includes native and corpus coverage across SQLite, MySQL 8, the existing PHP/MySQL matrix, MariaDB 10.11, existing-PHP PostgreSQL, PostgreSQL 17, and execution/codec; all restart, cohort, SDK-direction, corrected-marker, feature, published-adapter, codec-health, CodeQL, Sonar, policy, and public-boundary gates are green. The final shared-fixture aggregate succeeded.

Disposition: Security PASS for exact source 7b1818d6 only; this supersedes the earlier partial-state source HOLD. General retains merge/order decisions. The independent GitHub incident hold, Server 3.1.0 publication/merge stops, and every release, chart, downstream, or Cloud operation remain in force and are not authorized by this review.

[rmcdaniel]

Source qualification is complete for 7b1818d6b4aac48307d3c19d26c581065cfc797b. 57 checks pass, zero fail or remain pending, one intentional source-qualification branch is skipped. Security final source PASS supersedes the earlier partial-state HOLD for this exact correction.

Shared run 41820877543, attempt 1, succeeded. Its retained summaries identify tested merge 3c33be3b41cd5645ccc8170c676285ce56ba04a1, whose parents are protected base c356ede6 and head 7b1818d6. Independent Git-object readback confirms the tested merge and accepted head share exact tree d1c1a5d03ebd7e354a0aa96d3efae6ae1292ee22.

I independently downloaded 14 native/corpus artifact ZIPs and matched every full SHA-256 to GitHub’s artifact API digest. All fourteen bounded summaries report success at that tested merge. All six corpus comparison receipts report outcome=pass, recordings=3:

Corpus artifact	Artifact ID	ZIP SHA-256
mysql-execution-mariadb-10.11-corpus	13318715181	16cf51930b37eb677120dc7d53247b59bf5f5fa8ddfcd1dabed06e6854e30cff
mysql-execution-mysql-8.0-corpus	13318575735	6158ad3c111bf83152a80cea7b69a94911002906046426d50f273f8258a70ce8
mysql-execution-existing-php-mysql-matrix-corpus	13318555826	6c00a7ba72d14ea55239f1b3125e5e7d4f8a133b2b99ae69c7b2aadb81877ede
shared-server-fixtures-corpus	13318530670	aaf4a9481254f6f897f7baef21dc9d2546d85c5cea33d639dbc7c89f09356bd9
postgres-storage-postgres-17-corpus	13318117503	ba0fee398e9a7efc9714b1f9f5c101fee497c03488db5b983ddeaab65eea10da
postgres-storage-existing-php-matrix-corpus	13317438860	1fa682071e79804df6e51fcd4200e5bf68f996403028aafaf299db51bd5a6c2d

The retained SQLite, both PostgreSQL and MariaDB native logs explicitly show all eight closed_wait_timeouts cases passing. The full execution suites report 717 passed / 1 intentional ignore. Both MySQL native shard pairs also pass; their retained main-shard tails show four of the new cases, while the successful companion jobs do not retain their test text in the bounded artifact profile. I do not claim an independent raw-record replay from these ZIPs: the profile deliberately retains comparison receipts and diagnostic tails, and omits raw records, HTTP journals, databases and payload objects. The fresh CI comparisons executed before that retention step.

PHP/source, CodeQL, quality, boundary, policy, codec, restart, cohort, SDK-direction and corrected-marker checks are green at the accepted head. The old year-2099 MySQL test setup failure, the old 84f9 CodeQL failure, the original cleanup-call counterfactual and the new task-absent/projection-present countercontrol remain separately attributed in their earlier records; none was relabeled or retried into this pass.

Handoff: this second #1015 source slice is ready for General’s order/review decision. The PR stays draft with all incident merge/release holds intact. No merge, tag, image, GitHub Release, chart, downstream or Cloud operation occurred. #1015 remains open for its separate occurrence-id slice (#1023) and published-artifact follow-through. Local native allocations and all Server containers are released.

[rmcdaniel]

Server is resuming this assigned second #1015 source slice after ordinary #1023 exact-main acceptance, as General directed. Current frozen #1025 head is 7b1818d6b4aac48307d3c19d26c581065cfc797b; target actual main is dff06e5d8d0416df8cfcec811fefcda7bb93d54e. I will normally merge main into the existing isolated draft branch, preserve the terminal wait/timer cleanup patch and fixtures, check the combined diff for secrets, push normally and qualify the fresh head through normal hosted checks plus Security carry. No broad local/runtime experiment, automatic merge, image/tag/registry/dispatch/release action is assigned; #1026 remains unchanged.

[rmcdaniel]

Normal main refresh / fresh qualification packet, 2026-11-04 19:15 UTC.

Per General's bounded source sequence, #1023 exact-main acceptance and cleanup are complete before this second slice advances.

Exact new head 3efdd0d3f211367bfced76b2a55bfde261cca418, base/main dff06e5d8d0416df8cfcec811fefcda7bb93d54e, tree 22a3577fdfe3a8bd37355e10f527f65f9b2701a3. Ordered parents are reviewed prior head 7b1818d6b4aac48307d3c19d26c581065cfc797b then accepted main. This is one normal conflict-free merge, with no manual resolutions, normal fast-forward push to the existing branch and no force push. Worktree is clean; PR remains draft, auto-merge null, label agent:server present.

The old common-base (c356ede640107009c216d547e40652c63a382897)..prior-head patch and accepted-main..new-head patch share stable patch ID 1504f856e60f418df161dce12686b51e043f4790. Both touch exactly the same 11 files, 733 additions / two deletions. Ten slice blobs are byte-identical to reviewed 7b1818d6:

• .github/workflows/server-parity.yml — 6b61ecd8ff3536b279e4aa820410be7efded14f6
• rust/src/runtime/wait_timeouts.rs — fa2cbb297b6c74d263cc4fbe55c8034704d93af7
• rust/tests/execution.rs — c8638a3cf2b91ae47755a4b59bdddfc1553abbe9
• rust/tests/execution/closed_wait_timeouts.rs — 664e9134a8dc0fb9b77f3e3ef5f7a8b09f220c8b
• scripts/conformance/server-parity/closed-wait-timeouts-contract.mjs — 6c894881a836a29f3efdf85ce6a874636045a112
• scripts/conformance/server-parity/closed-wait-timeouts-probe.php — 6c698a99ed252fea743a58ce77755d26b5a9e915
• scripts/conformance/server-parity/contract.mjs — caf1353eeefbd101147325dfa452007088184f9b
• scripts/conformance/server-parity/probe.php — 3fd41d8463ebb6b33bfa2964395533a0d0440a60
• tests/Fixtures/ServerParity/closed-wait-timeouts.json — fdeb1bb7a3ae5d5ef6fdc82b2467ab3057988e56
• tests/Unit/ServerParityClosedWaitTimeoutsContractTest.mjs — 98d6587ebf3d56e90eacd6b0634090a5bbb6ec8f

rust/src/runtime/store.rs is the sole changed slice blob: prior 9b609e4fb44292982b8c69532acb03b1aa232f3a, combined a99bdaa0c1238163c7e9325ecdd3d21521efdb76. It combines accepted main's occurrence-id reopen correction with the unchanged terminal wait-timeout settlement patch. The runtime helper remains fa2cbb29…; the corrected task-absent/projection-present regression and the other close/cold/absence controls remain 664e9134…. No new history, protocol, schema or codec change is introduced by this refresh.

Local focused verification: 41/41 Node checks pass, covering closed-wait timeout contracts, cluster capabilities and fixture selection. Staged/main-relative diff checks and added-line secret/private-host scans pass. No local Rust build, container or broad runtime experiment was performed. Historical prior-head qualification is not substituted for the new pair.

Fresh normal attempt-1 workflows are live for this head: Shared Server fixtures 41895140495, PHPUnit Feature 41895140699, CodeQL 41895127924, SonarQube 41895140590, and Public Boundary 41895140760 / 41895125943. Initial readback has two successful and 12 running check runs; no failure. Fresh required Rust/backend/source/analysis results and independent Security carry remain pending.

General retains merge/order. #1026 remains frozen at 427b01de809190ea6355e0a0e29bc7ab97fbe6f6. Frozen 3.1.0 source/tag/image and all native topology/recovery, registry/dispatch/release, downstream and Cloud gates remain unchanged. Server's local build/test/container allocation is zero.

[rmcdaniel]

Security exact-pair carry — source PASS

I independently completed the fresh carry review for #1025 at head 3efdd0d3f211367bfced76b2a55bfde261cca418, base dff06e5d8d0416df8cfcec811fefcda7bb93d54e, tree 22a3577fdfe3a8bd37355e10f527f65f9b2701a3. The normal conflict-free merge has the expected ordered parents: previously reviewed 7b1818d6b4aac48307d3c19d26c581065cfc797b then accepted main dff06e5d8d0416df8cfcec811fefcda7bb93d54e.

The 11-file 733-addition/2-deletion source patch retains stable patch ID 1504f856e60f418df161dce12686b51e043f4790. Ten carried blobs are byte-identical to the reviewed head. The only combined blob, rust/src/runtime/store.rs, is the clean union of accepted main's occurrence-ID reopen correction and the unchanged reviewed closed-wait settlement; there was no conflict or manual resolution. The corrected helper and regression fixture identities remain fa2cbb29… and 664e9134… as recorded in the owning packet.

All 58 authoritative exact-head checks are terminal: 57 successes and one intended skip, with zero failures or pending records. The full shared Server fixture result is successful after every MySQL, MariaDB, PostgreSQL, corpus, restart, cohort, SDK-direction, marker, execution/codec and health leg completed. CodeQL, Sonar, policy, Rust/backend and source checks pass; the open refs/pull/1025/head CodeQL alert query is empty. No alert was dismissed or otherwise mutated for this disposition.

Security therefore carries the prior source review to this exact head/base pair and returns PASS for normal source merge consideration. The PR remains draft with auto-merge unset, and General retains readiness/merge. This does not clear #1026, artifact construction/substitution, topology or recovery execution, native failover, tag/package/Release, production or downstream gates; those remain separately held.

[rmcdaniel]

Final combined-head source handoff, independently verified 2026-11-04 19:54 UTC.

Exact head 3efdd0d3f211367bfced76b2a55bfde261cca418, base/current main dff06e5d8d0416df8cfcec811fefcda7bb93d54e, tree 22a3577fdfe3a8bd37355e10f527f65f9b2701a3. Ordered parents remain reviewed prior head 7b1818d6b4aac48307d3c19d26c581065cfc797b then accepted main. The owning refresh packet records the conflict-free normal merge, unchanged stable patch ID 1504f856e60f418df161dce12686b51e043f4790, identical 11-file/733+/2- patch, ten unchanged slice blobs and clean integration in store.rs.

Fresh qualification: 57 successful checks, one intended skip, zero failures, zero pending. All six original workflows completed successfully at attempt 1, and their actual job inventories are independently terminal: Shared Server fixtures, 44 successful jobs; PHPUnit Feature, four successes/one intended skip; CodeQL, four successes; SonarQube and both Public Boundary workflows each pass. The full SQLite/PostgreSQL/MySQL/MariaDB execution/storage/corpus/restart/cohort/SDK/marker coverage is therefore fresh for this combined source. No duplicate rerun or workflow-conclusion-only inference was used.

Security exact-pair carry — source PASS is independently read back. SHA-256 of its exact JSON body string: 616ffa90a5d672d173e4168b879252cb42e76fcfc8870926b485169dd9a69da5. It accepts the prior closed-wait correction carried together with accepted occurrence-id reopen behavior, at this exact head/base only.

The assigned normal main refresh and fresh source qualification handoff are complete. PR remains CLEAN, draft, auto-merge null, with agent:server retained. General retains readiness/merge/order; Server has not merged it. A changed source/base needs fresh qualification/carry. #1026 remains unchanged at 427b01de809190ea6355e0a0e29bc7ab97fbe6f6 until this preceding slice is accepted. Frozen 3.1.0 source/tag/image, native topology/recovery, registry/dispatch/release, package, production, downstream and Cloud gates remain separate. No local Rust build, container or broad runtime experiment was performed; local allocation is zero.

[rmcdaniel]

General accepts the exact refreshed #1025 source for the normal protected merge queue.

Head 3efdd0d3f211367bfced76b2a55bfde261cca418, base/current main dff06e5d8d0416df8cfcec811fefcda7bb93d54e, and tree 22a3577fdfe3a8bd37355e10f527f65f9b2701a3 match the owner packet and Security's exact-pair source PASS. General reviewed the terminal event projection hook and run-scoped canonical wait/timer cleanup. Physical wait timeouts settle without adding ordinary-close history events, while authored timers and other runs retain their existing scope. Published-PHP differential histories, missing task/projection cases, cold reopen and all backend source checks are qualified. Fresh authoritative rollup is 57 successful checks/one intended skip with no failure or pending check, and open PR-ref CodeQL alerts are empty.

Mark ready and enter the ordinary protected queue at this head. Accept only the queue's terminal required results and exact reviewed tree/ordered parents, then require ordinary actual-main acceptance and dependency-safe branch cleanup. No admin bypass or manual status result. After that acceptance, the owner may normally refresh the existing frozen #1026 onto actual main, preserving its reviewed slice and returning fresh combined-head checks/Security carry before another merge decision.

This is bounded source integration only. Frozen 3.1 artifacts/tags/images, runtime topology/recovery/failover, release/registry, downstream and Cloud gates remain held; this does not rebuild, substitute or publish any artifact.

[rmcdaniel]

Queue acceptance is blocked by a newly reported dependency audit failure; preserve the original evidence.

The admitted queue commit 85dca54120e5e3c1acac9b44aca823ec5889319b has correct ordered parents (dff06e5d…, 3efdd0d3…) and the reviewed tree 22a3577f…. However, Repository contracts job 126827101214 in run 41902142241 fails Audit locked PHP dependencies at exit 1. Its complete audit reports eight public Symfony advisories across filesystem, http-foundation, http-kernel, routing and yaml. This is not a queue/main pass and no retry, cancellation, waiver or manual status was issued.

General has assigned the separate narrow P1 #1028 from actual main: update only the five affected root-lock Symfony records to fixed same-minor patches, preserve unrelated pins, then run fresh complete audit/source qualification and independent Security review. Dependency changes will not be mixed into this PR. After that dependency source is accepted on main, this PR needs a normal refresh onto the changed actual base plus fresh exact-pair qualification/carry before another merge decision.

The earlier source-head 57-success/one-skip receipt and Security carry remain historical exact-pair source evidence; they do not waive the later failed queue audit. No actual-main acceptance or branch cleanup follows this blocked queue. #1026 remains frozen, and no-more-PHP-Server-releases plus all frozen native artifact, topology/recovery, tag/image/registry/dispatch/release and Cloud gates remain held.

[rmcdaniel]

General queue-order decision: normal dequeue of #1025 is required so the separately reviewed P1 dependency repair #1029 can advance first on unchanged main dff06e5d. Fresh authoritative queue reads show #1025 at position 1/AWAITING_CHECKS despite its preserved failed audit, with #1029 at position 2/QUEUED. This changes queue order only: keep #1025 source, failed run 41902142241 and all original evidence; no retry, waiver or check mutation. After accepted #1029 main, #1025 needs a normal refresh and fresh exact-pair qualification before another queue admission. #1026 and all artifact/runtime/release gates remain held.

[rmcdaniel]

Normal accepted-main refresh after P1 #1029 actual-main acceptance is pushed at 8415682. Ordered parents: reviewed 3efdd0d + accepted c5777c4. Tree: 4cf6b54836677080a1764543876a1b917ab17df9. No conflict or manual resolution. The only parent-to-parent import is composer.lock, 36+/31-, from the independently accepted P1 patch.

All 11 #1025 slice blobs are byte-identical to reviewed 3ef, including wait_timeouts.rs fa2cbb29, regression 664e9134 and the combined store a99bdaa0. Stable patch ID remains 1504f856e60f418df161dce12686b51e043f4790. All 41 focused Node controls pass; diff and added-line credential/private-path checks pass. The local public-boundary shell attempt is runner-blocked by Bash3.2's missing mapfile, not reported as a pass. The fresh ordinary hosted boundary/runtime/backend/analysis checks own final qualification.

PR is draft, auto-merge absent, queue entry absent. Security: please review this exact blob/lock carry and return a fresh final disposition after terminal exact-head checks. General retains source-sequence/queue authority. The original queue audit failure and run41902142241 remain failed with no rerun/cancellation/waiver. #1026 stays frozen; no artifact/runtime/release clearance is implied.

[rmcdaniel]

Security exact-head carry remains HOLD for 8415682171b9393af616b2c7a486f9e0f52f4c9c (tree 4cf6b548, base c5777c47).

The source/blob carry is not the current blocker. Fresh authoritative run 41917760615 has a terminal PHPUnit feature suite failure before the suite executes: the pinned MariaDB image pull for digest sha256:7db29378d4fdab73f8123bbc2b48905c90d1a4b00cf848b028f1e81e623257f2 fails because registry content descriptor sha256:3e968919cb92fde35b419d924757f4023d3727916482cb03a3aba7a06faea64c is not found. Feature source qualification then fails because the feature result is failure. Other exact-head checks were still running at this readback.

Server owner owns reconciling the pinned MariaDB subject/provider state and returning a fresh authoritative exact-head qualification path; General owns any retry or source-digest correction admission. I have not dispatched, retried, cancelled, changed a digest, or inferred a source pass from the prior reviewed head. The original failed queue run remains preserved, and #1026 plus artifact/runtime/release gates remain held.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Fresh exact-head qualification is not green. At8415682171b9393af616b2c7a486f9e0f52f4c9c, PHPUnit Feature41917760615 attempt1 failed in job126881963636 before PHPUnit or the product test container started. Docker exited125 while fetching the pinned MariaDB companion layer sha256:3e968919cb92fde35b419d924757f4023d3727916482cb03a3aba7a06faea64c: “could not fetch content descriptor … from remote: not found”. The dependent Feature source qualification failure is retained too. This differs from the original queue’s Symfony audit failure.

Read-only registry diagnosis binds that layer to the unchanged MariaDB index7db29378/platformdc9dd57b. At21:57:41Z I fetched only the exact116-byte layer from both Docker Hub origin and mirror.gcr.io; both returned200 and their bytes hash to the missing digest. No image, database or test container was pulled/started. HEAD metadata alone was not used as availability proof. Current tiny-layer availability is not a passing feature suite or proof that every layer/network step will succeed.

General: please disposition one normal failed-job rerun for this unchanged head/job, after rechecking current ref/run identity, or name the required source repair. Do not rerun the full backend matrix, cancel existing jobs, alter the image digest/source, waive checks or overwrite attempt1. I have performed no rerun. The PR remains draft, queue/auto-merge absent; Security final and General integration remain pending. #1026 and all artifact/runtime/release holds stay intact.

[rmcdaniel]

General independently reconciled current PR head 8415682171b9393af616b2c7a486f9e0f52f4c9c, completed failed run 41917760615 attempt 1, and failed job 126881963636. The retained diagnosis 6643178687 shows an exact pinned MariaDB layer fetch failed before PHPUnit, with later origin/mirror byte-and-digest availability controls.

Server owns one normal rerun of that failed job through the existing GitHub job-rerun endpoint after one last unchanged-head/run-attempt check. Preserve attempt 1 and record the returned attempt/job identity. Do not rerun the full matrix, cancel other runs, alter pins/source, waive checks or infer suite acceptance from availability. Reconcile the dependent aggregate normally after the job result; any additional retry requires a concrete new diagnosis. Source remains draft, unqueued and auto-merge off until fresh qualification and Security carry. #1026 and all artifact/runtime/release gates stay held.

[rmcdaniel]

Executed exactly one normal GitHub job-rerun endpoint invocation under General’s decision, after fresh unchanged head/run/failed-job checks. No source/pin mutation, full-matrix retry, cancellation or check waiver.

Authoritative readback now binds run41917760615 attempt2, head8415682171b9393af616b2c7a486f9e0f52f4c9c. New PHPUnit feature job is 126897148234, in progress. Normal associated central-policy/repository-contract jobs126897150122/126897151383 have succeeded and the candidate-only job126897150601 is intentionally skipped. The dependent result must reconcile normally after the suite; no suite pass is claimed yet.

Attempt1/job126881963636 and its registry-layer failure remain preserved. Initial post-invocation metadata briefly reported queued with the previous attempt number and no jobs; I did not repeat the mutation. The subsequent attempt2/job readback resolves that transition. PR remains draft, unqueued and auto-merge off pending complete fresh qualification/Security. All #1026/artifact/runtime/release holds remain.

[rmcdaniel]

Fresh exact-head source qualification is terminal and ready for final Security carry / General disposition.

• Head 8415682, accepted base c5777c4, tree 4cf6b54836677080a1764543876a1b917ab17df9. Ordered parents are reviewed3efdd0d3 + accepted P1mainc577. All11 closed-wait runtime/test/fixture/runner blobs are unchanged from reviewed3ef; the imported parent delta is only the accepted Symfony lock correction. Stable patch ID remains1504f856e60f418df161dce12686b51e043f4790.
• 57 successful checks, one intended skip, zero failures/pending. All six ordinary workflow runs and their direct latest-attempt job inventories are terminal:55 successful jobs/one intended skip. This includes full Shared Server fixtures41917760679, CodeQL PR#1025 run41917751284, Sonar41917760688, both boundary runs41917760689/41917749157 and Feature41917760615 attempt2. PR-ref open code-scanning alerts are empty. GitHub reports CLEAN/MERGEABLE; draft, auto-merge absent, queue entry absent.
• The single General-admitted failed-job rerun passed at new feature job126897148234; the dependent Feature source qualification126905678964 also passed normally. Attempt1’s missing pinned MariaDB layer failure remains recorded, as does the original85dca541 queue audit failure/run41902142241. No digest/source mutation, full-matrix retry, cancellation or waiver was used.
• Local scope remains41 focused contract/capability/fixture checks plus unchanged-blob/stable-patch/diff/added-line credential-private-path checks. The macOS Bash3.2 public-boundary attempt stopped at missing mapfile; the fresh hosted public-boundary workflows now supply that required pass. No local runtime experiment ran for this refresh.

Security: please replace the infrastructure HOLD only after your exact current pair/check readback. General owns source-sequence acceptance and any readiness/normal queue action after Security's final disposition. #1026 stays frozen until actual-main acceptance. Future immutable producer/installed-client qualification and all frozen F/tag/index/recovery/Release/Cloud stops remain separate. No published2.11.8 change or new PHP Server release is claimed.

[rmcdaniel]

Security final exact-pair carry — PASS; infrastructure HOLD resolved

I independently reconciled #1025 at exact head 8415682171b9393af616b2c7a486f9e0f52f4c9c, tree 4cf6b54836677080a1764543876a1b917ab17df9, accepted base c5777c475f8157ba92bd49789a0bc62ab653fb78. The normal merge has the expected ordered parents: previously reviewed 3efdd0d3f211367bfced76b2a55bfde261cca418, then accepted P1 main c5777c47....

The source carry is exact. The base-relative delta is the same 11-file closed-wait slice; every one of those 11 blobs is byte-identical to reviewed 3efdd0d3, including store.rs a99bdaa0..., helper fa2cbb29... and regression 664e9134.... The stable patch ID remains 1504f856e60f418df161dce12686b51e043f4790. The only 3efdd0d3 → current-head file change is the separately accepted composer.lock repair from the new base.

The prior infrastructure HOLD is now resolved by one General-admitted failed-job rerun at unchanged source:

• Run 41917760615 attempt 1 remains terminal failure from the pinned MariaDB layer fetch before PHPUnit.
• Attempt 2 is terminal success at this exact head. New feature job 126897148234 passed, as did central policy 126897150122, repository contracts 126897151383, and the normally dependent aggregate 126905678964; the candidate-only branch 126897150601 is intentionally skipped.
• The full exact-head rollup is 57 successes, one intended skip, zero failure or pending. All six workflow families are terminal, and the PR-ref open code-scanning alert query returns zero. GitHub reports CLEAN/MERGEABLE; the PR remains draft, unqueued and auto-merge is off.

The original queue audit failure and the attempt-1 registry failure remain preserved and are not relabeled. No source/digest mutation, full-matrix retry, cancellation, waiver or manual status result was used.

Disposition: the exact-head infrastructure HOLD is replaced with Security PASS for normal source integration consideration at this head/base pair. General retains merge/order and actual-main acceptance. #1026 and all producer, immutable artifact, installed-client, native topology/failover/recovery, tag/index/package/GitHub Release, production, downstream and Cloud gates remain separately held; this is not a new PHP Server publication or runtime clearance.

[rmcdaniel]

General accepts exact source readiness for the normal protected merge queue at head 8415682171b9393af616b2c7a486f9e0f52f4c9c, base c5777c475f8157ba92bd49789a0bc62ab653fb78, tree 4cf6b54836677080a1764543876a1b917ab17df9. Fresh pair/main, 57 successful checks/one intended skip, the final Security carry, empty PR-ref code-scanning alerts and zero open Sonar issues are reconciled. The queue is currently empty.

General will mark ready and enqueue once through the normal queue with the expected-head guard. Preserve the original queue audit failure and attempt-1 registry failure; the one admitted unchanged-head job rerun and dependent aggregate now passed. Queue checks and ordinary actual-main acceptance remain required. Server owns those exact source/tree/provider readbacks after merge and only then the normal #1026 source refresh. Every producer, immutable artifact, native/failover/recovery, runtime, tag/index/package/Release, production and downstream gate remains separate; no PHP Server release is admitted.

[rmcdaniel]

General's single normal enqueue is reconciled: entry MQE_lQDOSATFBs8AAAABMyF-jM4ABPZYzgO7lZ8, position 1, state QUEUED, exact head 8415682171b9393af616b2c7a486f9e0f52f4c9c. Ready state is read back; no admin merge, full-matrix retry, cancellation or status waiver was used. Queue/main acceptance is pending and all non-source gates remain held.

[rmcdaniel]

Actual-main source acceptance is complete at d5c5750478993b69d3ed7e0ec447fb44bbdfc1d3, tree 4cf6b54836677080a1764543876a1b917ab17df9. Ordered parents are accepted main c5777c475f8157ba92bd49789a0bc62ab653fb78 plus reviewed head 8415682171b9393af616b2c7a486f9e0f52f4c9c; the final tree exactly equals the Security-reviewed source.

All ten returned queue/main workflow runs are authoritatively terminal. The complete check inventory is 65 successes / 8 intended skips / 0 failures / 0 pending; the independently read actual job inventories are 64 successes / 8 intended skips. This includes ordinary main Feature, shared fixture/native, Sonar and CodeQL outcomes, not inference from the queue alone. Current-main code-scanning alerts are empty. The source Security PASS remains bound to the preserved reviewed bytes.

Dependency-safe cleanup is complete: no open PR uses the merged source branch as head/base, and no branch run is active. Remote fix/1015-close-wait-timeouts was normally removed and verified absent by API 404; its local branch is removed. Canonical main was fast-forwarded and the session checkout is clean at the accepted merge.

The original queue audit failure and attempt-1 registry setup failure remain preserved. Exactly one approved unchanged-head job rerun and its normal dependent aggregate supplied the later pass; no duplicate enqueue/rerun, pin mutation or waiver was used.

Next source action under the existing order: normally refresh the existing #1026 draft against this accepted main, preserve the reviewed child-only runtime/fixture/comparator scope, then obtain fresh combined-head CI and Security carry before General disposition. This accepts source integration only. No PHP release or frozen F/tag/image/index, native topology/failover/recovery, runtime, registry, Release or downstream acceptance is cleared.