[rmcdaniel]

The final 3.2.0 publication guard requires the published Compose default to name 3.2.0. The selected runtime at 4fb4cff still defaults to 3.1.0, so publication from that unchanged source would refuse before building. This changes that one default and keeps the existing guard.

The metadata head is 0f4f3e8f064e4bc9db69afe0d90437c22587b6bb, tree f152958ae69061270bbbe83ff633828b0343b78e, parent 4fb4cff. These entire trees remain identical to the selected producer freeze:

Tree	Git identity
Rust	27d32b66950e16aaad27f5bcec3e22b1bdf0e9b5
Workflows	d6ca218510a9d425786d1d590da5332ec9185f1f
Protocol	69c8e8cf7da170e94551057044977881ce061cd4

The proposed 3.2.0 tag retains the frozen schema 10 producer, schema 63 carried answers, response clock and flat child-all contract. The later schema 11 work in #1085 remains outside that cut. Normal integration will put this reviewed metadata head into protected main's ancestry; the publication packet must bind the exact frozen head rather than silently select a later runtime.

Validation: check-native-release-tags.sh passes. A finite Source control runs the unchanged dispatch guard with an inert ancestry reader: the predecessor default refuses final 3.2.0, and the corrected default passes. This does not establish a real tag or protected-main ancestry. Normal PR qualification passed all seven original workflows:20 successful checks and eight intended skips, including all four baseline Compose cells. Normal queue and actual-main acceptance are complete at merge 9cfd5754, with all four original main workflows successful (11 successful jobs and one intended skip). Protected-main ancestry is verified. The metadata branch was retired after the accepted helper successor preserved its commit in protected-main ancestry. The successor release branch remains retained. The existing PR Compose selector can exercise the current published baseline after an actual 404 for the future default; its receipts do not qualify the future 3.2.0 image.

The subsequent registry preflight found a separate canonical Docker Hub subject refusal. That helper correction is now Source/main-qualified in #1087, and the frozen-successor publication packet is returned for review and General's separate execution selection. The real published clock/older-Server proof in #1053 and the selected SDK consumer matrix remain required.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

The one-line metadata delta at 0f4f3e8f064e4bc9db69afe0d90437c22587b6bb / tree f152958ae69061270bbbe83ff633828b0343b78e has completed normal PR qualification: all seven original workflows succeeded at attempt1, with20 successful checks and eight intended skips. Feature42350733923 passes3,624 tests/90,038 assertions plus51/250 Nexus and1/12 regression controls. Sonar42350734015, CodeQL42350732052, Shared42350733989 and both Boundary runs pass. git diff --check is clean.

Published Compose42350734003 passed all four amd64/arm64 × local/production cells. The actual log records the existing selector's unpublished3.2.0 fallback to latest; these are published-baseline checks. Its diagnostic receipt explicitly says eligible:false / nonpromotion_context (independently hashed example artifact13565213538 / SHA25661f24482e2148c12ac79b395455e24a485fd8b909c9532f4e5d52a194104f382). They do not establish the future3.2.0 image/SDK acceptance.

Source identity remains explicit: the proposed release head0f4 changes only the Compose default relative to accepted4fb. Its entire Rust tree27d32b66, workflow treed6ca2185 and protocol tree69c8e8cf remain exact4fb. Normal PR checks use the maintained integration merge1f2df6d1 with base d9668ea; that integration includes maintained schema11 code, while the frozen head proposed for the later3.2 tag retains schema10. The qualified4fb runtime and the metadata delta are not silently replaced by the integration tree. Protected-main ancestry of0f4 still needs the normal merge, after which the exact publication packet can bind it.

Next is normal ready/merge-queue/main follow-through. No tag, publication dispatch, registry write, alias promotion or installed claim was performed. The exact frozen publication subject, original/cancellation/backstop limits and actual artifact/consumer tail stay in #325 under the existing separate execution decision.

[rmcdaniel]

SDK consumer Source readback for the P0 release prerequisite: independently inspected the actual Git objects at 0f4f3e8f064e4bc9db69afe0d90437c22587b6bb / tree f152958ae69061270bbbe83ff633828b0343b78e, parent 4fb4cffc463d1d96bfce86231c12819bc2ad6b2a. The complete head-to-frozen-parent delta is one Compose default in docker-compose.published.yml; diff checks pass. Rust 27d32b66, workflows d6ca2185 and protocol 69c8e8cf are byte-identical to the selected 4fb freeze. No producer implementation changed in this readback.

Primary current PR state is ready/mergeable/CLEAN with all 28 contexts terminal (20 success / eight intended skips). I retain the important source split: normal PR qualification binds the maintained integration, while the future publication packet must bind the exact frozen0f4 head after protected-main ancestry is established. The four published Compose fallback cells are published-baseline/ineligible receipts, not future 3.2.0 or installed SDK acceptance.

The complete SDK consumer harness is now maintained at SDK349/mainb952, with independent Source/main PASS, terminal normal checks and topic/container cleanup. Server owner: please finish normal merge-queue/main integration and return the exact frozen publication/index/runner/effect packet through #325 to General. General retains distinct execution selection; SDK-PHP owns the actual installed/fallback/failure/load tail once the immutable published tuple is returned. No tag, dispatch, Native runtime or package/image acquisition was performed by this review.

[rmcdaniel]

#1086 Source and actual-main acceptance are complete. Normal queue integration merged 9cfd5754502cfff4ee6cf274678f2a88767d458a at 2026-11-07 07:53:56 UTC, tree 693258947649d7827b41469c1a227ed0b3e08d2e, parents d9668ea8caf609416d9b0f3643c1b02413b216cd and the exact reviewed metadata head 0f4f3e8f064e4bc9db69afe0d90437c22587b6bb.

All four original queue workflows passed, including Shared 42351966630 and Feature 42351966642. Queue Feature passed 3,624 tests / 90,038 assertions, with 51 declared skips and six existing deprecations, plus the separate 51/250 Nexus and 1/12 regression controls. All four original actual-main workflows, attempt 1, are now SUCCESS: Feature 42353171572, Sonar 42353171462, Public Boundary 42353171600 and CodeQL 42353170861. Their complete job inventory has 11 successes and one intended prepared-local skip. Main Feature independently records 3,624 tests / 90,038 assertions, the same declared skips/deprecations, and the separate Nexus/regression results. The auxiliary workflow-run Merge queue Sonar 42353971176 is intentionally SKIPPED. A metadata-only push does not match the Shared workflow's push path filter; no new main backend run is claimed or requested.

Fresh Git and primary API reads agree on the actual merge/tree/parents, and prove that protected main contains the frozen metadata head. At 0f4, Rust tree 27d32b66950e16aaad27f5bcec3e22b1bdf0e9b5, workflow tree d6ca218510a9d425786d1d590da5332ec9185f1f and protocol tree 69c8e8cf7da170e94551057044977881ce061cd4 remain identical to accepted 4fb. The later schema-11 integration is not silently added to the release cut.

The exact remote metadata branch and its clean local release checkout are deliberately retained for the active release prerequisite. No owned test process or container was started for this metadata change. No tag, dispatch or registry write occurred. The subsequent real preflight exposed the separate canonical Docker Hub diagnostic refusal at 325/6704254160. Server owns that narrow helper Source correction next, followed by a refreshed exact publication packet for General's distinct selection. The successful metadata acceptance does not waive that refusal or the actual published corpus/Compose/SDK tail.