Preserve cold marker replay and activity deadline authority

[rmcdaniel]

Cold successors must preserve recorded marker bounds, clocks and complete activity policies. Activity workers must lose completion, failure and heartbeat authority at the original authored deadline. This change corrects those native transitions and adds a separately pinned PHP/Rust/embedded cohort for marker replay, selected-original range repair and four wall-clock activity-expiry families. Python clock cases use the agreed fixed workflow-start anchor. Ordinary activity leases remain 300 seconds.

The expiry adapters retain the actual timeout parent delivery without authoring a workflow result. Readers preserve complete prefixes, microseconds, task/run relationships, original deadlines, full retry snapshots and typed int64/null/Unicode values. HTTP and embedded receipts retain their actual formats.

Validation: fresh independent PHP, embedded and native SQLite recordings pass the selected replay and elapsed-deadline cases. Native SQLite passes 85 execution and 35 unit cases with 18 database cases explicitly ignored locally; the focused authored-deadline cases also pass MySQL 8.4. Latest original expanded matrix passes SQLite, PostgreSQL 16/17, MariaDB 10.11 and MySQL 8.4. Its MySQL 8.0 database is OOM-killed during later native pressure under the declared 1 GiB allocation, after corrected portable, clock and expiry comparisons pass; TLS is unexecuted. Original disposition and artifact inspection remain unchanged.

The prospective MySQL 8.0 fixture allocation is 2 GiB, matching MySQL 8.4. Actor/native limits, scenario deadlines and the 75-minute whole-job ceiling remain unchanged. Fresh all-six qualification is running at 5a9ab7d36. Final-head and fresh-main acceptance are required before delivery. Earlier failed originals remain failed.

Successful retries, terminal submission controls and live heartbeat renewal continue separately in #438. No published Rust, migration, performance or cutover qualification is claimed. Completed local archives and test resources are deleted.

Refs #325.

[rmcdaniel]

The separate corrected-marker draft now implements normal installed actors and
a strict HTTP reader at 7171bff762a53085eef1773f05a02d24f4a212de.

A fresh recording compiled from that clean pushed tree passes five cases on the
published PHP reference: numeric 7 from repeated [-3,7] calls with one marker;
numeric zero/mixed helpers; deprecation-first 1; a genuine historical Python
author producing two version-1 markers with bounds [0,1]/[1,1]; and the
entire PHP eight-entry retry list in a one-attempt policy. Each retains a real
pending activity, a separate activity process, and a cold Rust successor on the
same original run. Whole original prefixes and microclocks, original durable
deadlines, marker positions/bounds and exact int64/null/Unicode results survive.
The genuine historical author receives actual SIGKILL after its commit. Its
cancelled forwarded polls are explicit no-result observations.

The new machine-owned tuple
pins the published image, separate historical/current SDK roles, normal consumer
locks and loaded PHP sources. Independent raw-record readback and 80 mutation
controls pass. The clean Rust 1.86 consumer build completes in 1m46s with one
CPU, 1536 MiB RAM, no swap, debug=0 and incremental=false. That is a consumer
build observation, not a Server performance comparison.

Two earlier genuine-case originals remain unqualified: the first reader failed
on killed-author poll cancellation; the second exited Waiting after one empty
cold poll. The corrected reader requires explicit forwarding evidence, and the
adapter waits toward actual completion within the unchanged original 30-second
phase budget. Fresh confirming runs do not resume, rewrite or rebudget those
failed originals. A prototype recording naming the docs-only base is likewise
kept separate from this exact implementation recording.

Server's intentional release path-repository Composer reference is retained
separately from its package provenance. All 925 loaded Workflow source/resource
files match the released source. No package defect or republishing is claimed.

Embedded producers/readers, activity and selected-timer repair, differing-policy
refusal, current Python clock consumers, native integration and the six-database
candidate/final/main qualification remain pending. The normal existing source
matrix is running; it does not yet exercise the new profile. Frozen actors,
tuples and earlier failures are unchanged. No native capability, performance,
migration, release or cutover claim follows.

[rmcdaniel]

The separate embedded recipe now has an actual SQLite prototype result. A
normally installed historical producer records version 1 twice with bounds
[0,1]/[1,1], reaches a genuine pending activity, and exits. A separate current
activity process completes once; a cold current helper process finishes the same
original run. The five-event original prefix, both physical marker positions,
stored bounds and exact int64/null/Unicode result survive. Actual public now()
observations after the cold helpers match the first marker clock, then the
second clock and its cached reuse.

The original and replacement roles have separate normal Composer locks. Their
dependency graphs differ only in Workflow, and all 916 historical / 925 current
source/resource files match the declared released sources. Three distinct PHP
processes execute fixed 30-second phases within an original 90-second scenario.
No history row, producer timestamp or result is constructed or repaired.

This is an uncommitted actor prototype, separate from the clean 7171bff
five-case PHP-reference recording. Shared recorder/package-contract integration,
all embedded cases, repair/refusal/current-Python-clock cases, native execution
and expanded six-database acceptance are still pending. Normal source CI passes;
the existing baseline matrix is still running and does not qualify the new
profile. Frozen tuples and failed originals stay unchanged.

[rmcdaniel]

The clean pushed e659dddf51a4e72b9ec60d6bd25debfdc8aa5a3a shared recorder now
passes all five embedded marker cases on SQLite. Each uses normal published
Composer role locks, a real pending activity, an independent activity process
and a cold workflow process. The genuine differing-bound case uses the declared
historical producer; the other originals and every reader use the current
package. Whole prefixes, microclocks, stored bounds, original task/run links and
exact typed int64/null/Unicode results pass strict readback.

Independent package/raw-record audit and 110 actual-record mutation controls
pass, including missing clocks, changed cached-helper clocks, changed package
bytes/locks and altered task relationships. Application installs, SQLite and
the parent SDK dependency tree are retired after retaining their useful raw
evidence. The earlier prototype and both killed-author reader failures remain
separate and unchanged.

All six existing 7171bff baseline regression jobs in
38389814762
completed successfully; their original artifact inventory is recorded. That
matrix does not execute the new marker profile. The new four-phase full-policy
refusal/repair fixture is source-pushed at 8de16757c with its own original
120-second overall budget and unchanged 30-second phases; execution is pending.
Activity/timer range repair, current Python clock consumers, native and expanded
six-database/final/main qualification remain ahead. No release, migration or
performance claim.

[rmcdaniel]

The agreed explicit authored-policy contract now has a separate source correction in durable-workflow/workflow#776, head 169440fae4bd65df5a67bb24364de7a134f66191. Direct, grouped and selection replay block before consuming an incompatible activity result; exact restoration and selected-run repair preserve the original task, full list and deadlines. Twenty-two focused controls / 110 assertions pass, including six separate-process cold reads. The reproducing corpus fails the prior implementation and passes the corrected development tree.

Normal PR qualification 38403840028 and full candidate 38403830269 are still running. The latter's corpus, quality, MariaDB and all five Laravel/PHP source upgrade profiles pass; MySQL/PostgreSQL/coverage remain pending. Additive canonical refusal-schema support is delivered separately in durable-workflow/.github#184.

This is source progress, not a published correction or shared/native adoption. The failed f729966a embedded original and earlier reader failures stay immutable. General retains stable versioning/integration/publication, #772 and SDK follow-through. The frozen cohorts and #435's remaining native/range/clock/new-profile qualification gates remain unchanged.

[rmcdaniel]

The coordinated embedded replay source correction is merged and fresh-main qualified in #776.

Exact source: f3f9b93a3d98d7da2f9df623907d69cbf2880439, tree 1c0d6478a67f3b332544cce567165f0e7d834fe7, identical to reviewed 169440fa and synthetic 9e7ac96d. Normal PR 38403840028, full candidate 38403830269 and fresh main 38407229700 pass every applicable gate. Fresh main includes all MySQL/PostgreSQL shards, MariaDB, five Laravel/PHP source upgrade profiles, quality, official corpus counterfactual and unit/coverage. The latter reports 3,916 tests / 50,152 assertions, 15 notices and five skips; the 93.50% line ratchet passes. New focused controls pass without skips.

Explicit per-call policy mismatch now blocks embedded execution, query replay and PHP fiber replay before consuming an old result or committing new commands. The complete retry list remains part of identity, including unused final entries. Execution and repair retain the original snapshot and deadline; class-derived budgets and missing legacy fields are not rebuilt. Direct/all/selection runtime checks and six separate PHP process reads preserve the original history and canonical IDs, and exact restoration plus selected-run repair completes the original task at attempt two / repair one.

General owns the subsequent stable integration/publication and PHP/Python SDK follow-through, separately from #772's reserved 2.5.15 correction. This delivery is source qualification. No new published retry-policy correction, shared/native tuple adoption or completed #325 goal is claimed. The published f729966a failed embedded original, earlier reader failures and frozen actors remain unchanged. Completed branch/worktree and all local runtime/compiler/dependency resources are retired; the merged remote head is verified absent.

[rmcdaniel]

The first new Rust range recording at 4b870c0 is runner-blocked, not product-qualified. Original run 01m4tttgwe0y9wyyvahffm9wv9 from the normally installed PHP 2.2.7 author retains four events and its pending activity. The recorder incorrectly expected an activity retry snapshot in that legacy event. The actual history omits activity.retry_policy; read-only SQLite confirms the original activity's stored policy is null. No Rust successor, repair or new activity completion ran in this failed original.

The separate dfc1995 revision preserves that genuine absence with an unconfigured Rust ActivityOptions policy. Present snapshots still use the full explicit known fields and list. It also checks the actual two-event StartAccepted/WorkflowStarted prefix of neighboring admissions. No frozen definition, stored history, old snapshot or scenario budget changes. Actual fresh runtime qualification remains pending.

[rmcdaniel]

The additional published Rust range directions now pass against the actual pinned PHP Server 2.6.2 reference at 4e68ffd. Normal PHP 2.2.7 authors the unchanged original recipes; PHP 2.3.9 performs the explicit repair; independent normal Rust 3.5.4 processes execute the activity, incompatible range and restored successor. Each case keeps the original 35-second total budget.

• Completed activity: original 01m4tvahj2v143jdkgf6n26c60 preserves its four/six/eight-event prefixes. Rust range 2..2 refuses recorded version 1 without automatic readmission. One explicit original-run repair restores 1..1; the same logical task completes at attempt 2 / repair count 1.
• Timer winner with pending activity: original 01m4tvaq9872znp9b3qphn64r0 retains its three-second timer winner, seven-event blocked prefix and genuinely unstarted activity through repair/cold replay. A separate activity process completes once; a later workflow task completes at attempt 1 / repair count 0, without another repair.

Both retain exact int64/null/Unicode values, marker bounds/microclocks, original run/execution deadlines, whole cold public deliveries and surviving neighboring histories/tasks. The genuine old producer omits its retry snapshot; event absence and read-only stored null remain exact, with no current class defaults invented. The already separate full eight-entry policy reader/refusal case remains strict and unchanged.

Independent read-only SQL and package/wire checks pass. 56 actual-record mutation controls (25 completed, 31 pending) reject missing cold deliveries, false completion, rounded values, changed bounds/clocks/deadlines, wrong original repair/task/lease relationships, altered neighbors and pending/timer identity violations. Earlier 4b missing-policy, dfc neighbor age-diagnostic and 321 pending original-worker-ID reader failures remain failed originals; later reads do not relabel them.

All local runtime/compiler/cache/dependency/image/network/state resources are retired. Embedded/current-clock/native integration, the corrected cohort's six-database qualification, promotion and fresh main remain pending. The previous 87b baseline matrix passed but does not exercise these new cases. This is no Rust release, cutover or complete #325 claim.

[rmcdaniel]

The two range families also pass through actual cold embedded execution at 86336ee6ac8088beb8698e77e9b10247f294ed0c, using the unchanged original PHP definitions and normal published Workflow 2.5.14 / 563675723522b2d453f950f593ab91473e91c831. Exact normal Composer lock and loaded VersionResolver/WorkflowExecutor/TaskRepair hashes match the declared role. Embedded execution explicitly marks the additional Rust author direction inapplicable.

Original 01m4tw3apw3ath2sk8yqpq234w preserves the completed activity and four/six/eight-event prefixes across incompatible refusal, cold exact-definition restoration and one original-task repair. Original 01m4tw3dkx6hgk2c1t8wpcmb1v preserves its timer winner, seven-event blocked prefix, genuinely pending activity and retained handle before the one activity completion and later terminal task. Each recipe retains its original 35-second total deadline, durable run/execution bounds, typed int64/null/Unicode values and two separately admitted neighboring histories/tasks.

Independent SQLite readback and 44 embedded actual-record negative controls pass. Alongside the earlier separate PHP-reference directions, this gives 100 negative reader controls; it is not a matched native/database cohort. The initial independent read attempt against a read-only WAL database directory failed to create SQLite sidecar state; a disposable file copy with query_only enabled succeeded without altering retained bytes. No database/service defect is inferred.

All owned installs, runtimes, state, dependencies, image and scratch are retired before the resource boundary. Current clean pushed head 13280651e includes a documentation-only update after the recorded execution. Native/current Python clock integration, new all-six, final/promotion/main remain pending. Workflow #776's later stable backport/publication stays with General; the earlier embedded full-policy refusal remains failed until a separate published corrected cohort proves it.

[rmcdaniel]

The combined candidate is pushed at edfa4e09b5e99f65e8de7ca87b2ca85a1a8fecab, including PHP consumer #437 without changing the Rust subtree or any published artifact manifest. Fresh shared run38462894334, PHP38462894421 and boundary gates are running; the push boundary already passes. The original a96 expanded run is terminal FAILED in all six configurations.

Actual published Server2.6.2 SQLite control at e229c8a36 passes all six PHP marker cases and 99 reader controls. The genuine Python2.5.0 producer is killed at its real pending checkpoint, then its public registration is retired before the independent Rust3.5.4 activity runs. Its same-original cold successor finishes in5.218 seconds, preserving the exact eight-event prefix/outcome without a repair event; the actual retirement response recovers zero workflow tasks. Existing bounds and tuple are unchanged. This is a prospective lifecycle correction, not unfenced process-loss qualification or a native correction. The reader verifies retirement and rejects its removal, wrong Worker identity and missing request. Local syntax/Docker isolation checks pass; 71 policy controls pass with one explicit skip.

Both completed artifact inspections and the fresh local control are cleaned: no retained ZIPs, full recordings, DB dumps, SDK graph, application, task container/network or newly pulled image remains. Only concise GitHub outcomes and existing code/fixtures remain. No expanded all-six/promotion/main/release claim yet. Next: inspect this exact combined matrix, fix any actual disagreement and qualify the final tree before promotion.

[rmcdaniel]

The reusable activity-expiry adapter at local commit 54c0a3e90289e7b2473b5dad23851a831378290b passes fresh matched PHP/embedded SQLite observations with the unchanged published reference/role manifest: Server2.6.2 / installed SDK2.3.9 / embedded Workflow2.5.16. Four independent originals per target cross their authored one-second boundary in actual wall time within the original35-second observer.

HTTP uses installed SDK worker-protocol calls; embedded authors through a real queue:work job, then uses public worker bridges. Each retains its original timeout parent delivery without authoring a workflow result. The strict semantic comparison and157 actual-record mutation controls pass. Independent query-only SQL verifies19 events per target, exact original execution/attempt identities and full policies, zero task repairs and unchanged database bytes. Adapter provenance and embedded receipt formats remain explicit; no HTTP status is fabricated for a library response.

Local head e1baef3dd prepares the same deadline family in all six shared jobs. These local commits are not yet pushed: the live edfa matrix38462894334 remains an independent marker/range/clock qualification and does not execute this added expiry family. Its PHP feature and both boundaries pass; runtime jobs remain live. Native expiry-family/all-six and final/main confirmation are pending. Retry, committed-duplicate and live-renewal follow-through remain separate, explicit gates.

Completed local raw records, DBs, installed applications/SDKs, transport ZIPs, task containers/network and the newly pulled image are deleted after the audit. The former private prototype is removed now that its reusable adapter is in code. No native runtime bytes, default dependency, frozen tuple or scenario/resource limit changed.

Further reader review at 360963908 binds each non-renewing status to the original task/attempt/owner, plus the run/execution identities exposed by the embedded bridge. HTTP retains its actual narrower identity format. Fresh published PHP/embedded comparison passes with181 corruption controls, including wrong-task/attempt/owner/run data and fabricated HTTP library receipts. Initial unexecuted reader assumptions about extra HTTP fields were corrected from the actual implementations before this qualification; no response format or runtime behavior changed. Local head c4f2fbb95 remains prepared and unpushed while the independent edfa matrix finishes. The repeat's complete local records and resources are also deleted.

[rmcdaniel]

The original edfa4e09b shared run 38462894334 is terminal failed on all six databases. Those outcomes remain failed.

The corrections are pushed at 718ea360820c6918be327c7f01150555f72a400c:

• SQLite/PostgreSQL 16: the fixture's global PHP maintenance sweep independently redispatched deliberately idle neighbors during selected-run repair. Maintenance now targets only the four activity-expiry originals. The neighbor guard and original budgets stay strict.
• PostgreSQL 17/MySQL 8.0/MariaDB: the range reader assumed only cold_replay. Published forced_cold_replay is also a full cold delivery. Actual PostgreSQL prefixes of 2/6/7 events pass the corrected reader unchanged; sticky-cache delivery is explicitly rejected.
• MySQL 8.4: PHP passes the portable/clock cases, then the native adapter targets node A after the earlier recovery fixture deliberately killed it. Retained state proves exit 137/no OOM and a running survivor B. The corrected stage now uses B on MySQL/PostgreSQL.
• MariaDB's later pressure failure has actual database OOM/exit 137 at 512 MiB. The new expanded fixture declares 1 GiB, without changing scenario deadlines or frozen identities. This does not diagnose historical failures.

Fresh normally installed PHP SQLite passes eight portable cases, two clock cases and four expiry families. Revised readers pass 279 actual-record corruption controls. Independent query-only SQL confirms four unchanged idle neighbors, 19 expiry events and zero parent repairs, with unchanged database bytes. Core reader tests pass 206 cases; syntax and Docker isolation checks pass. All local test resources and downloaded archives are deleted.

Fresh exact-head shared qualification and PHP checks are running; both boundary checks pass. The new source also wires the already locally qualified embedded activity-expiry adapter into the three-runtime matrix. Native bytes and frozen cohorts are unchanged from edfa4e09b. Native/all-six/final-head/fresh-main acceptance remains pending. No release or cutover claim.

[rmcdaniel]

Source 3a9370f7a is pushed for a fresh original qualification. Native tree f8ca2ece95360786f404ec1f77512149ecd8c9cf, frozen tuples and all scenario/actor limits are unchanged.

Run 38469976743 at 718ea3608 passes PostgreSQL 16 and 17. Their job logs confirm all eight portable cases and four activity-expiry families in PHP/Rust/embedded, and both HTTP clock cases. Full original-file audit is not claimed yet. MySQL 8.4 is still running.

The other originals remain failed:

• SQLite passes PHP portable/clock/expiry, then the new native stage addresses the process deliberately killed earlier. Retained state is exit 137 without OOM; its recovered process is running. The runner now addresses parity-recovered.
• MySQL 8.0 and MariaDB's PHP recorder return 137 and leave truncated JSON after the final PHP case snapshots completed. Their PHP service exits cleanly and databases remain running without OOM; later pressure controls pass. The automatically removed recorder has no retained OOM state, so its kill's cause is not established.

The recorder now serializes one case at a time, avoiding another complete copy of the whole wire recording. New checks preserve 32 MiB of body bytes, int64/null/Unicode and explicit failed/empty dispositions with a 48 MiB child heap. All 1,622 local reader/runner controls, shell syntax and Docker isolation policy pass. New HTTP recorder exit/OOM state is captured before always-run cleanup. These are runner corrections, not PHP/native product fixes or rebudgeted originals.

The separate active-parent retry/terminal-response control passes under the settled receipt boundary. It is not added to #435 or the default corpus. All inspected local ZIPs/extracted records and that reference runtime/dependencies/database/image are removed after immediate audit. Promotion, all-six final-head and fresh-main acceptance remain pending.

[rmcdaniel]

New source 871eec1ecf23b7a981a3f2d38ce17e543db2fac4 is pushed. Shared qualification 38477701278 and PHP checks 38477701363 are live. Native tree f8ca2ece95360786f404ec1f77512149ecd8c9cf, tuples, individual deadlines and actor/DB allocations remain unchanged.

The previous 3a9370f7a shared run is terminal failed on all six originals. Its new serializer tried to write the undefined optional database-resource field, which whole-object JSON serialization previously omitted. The correction preserves that omission and explicit null. Focused actual-record shapes pass; the complete local reader/runner command passes 1,622 checks. A real normally installed embedded invocation passes all four expiry families and produces readable complete JSON with the optional field absent. Previous PHP feature/boundary gates pass, with conditional cancellation skipped; none qualify the failed shared run.

The earlier 718ea3608 expanded run finishes with PostgreSQL 16/17 and MySQL 8.4 passing, SQLite/MySQL 8.0/MariaDB failing as recorded. No old original was rerun or relabeled.

Independent retry/terminal-response PHP/embedded follow-through now passes two matched cases, 86 corruption checks and stopped read-only deadline verification. That branch remains outside #435/default corpus and still needs native/global-timeout/renewal/matrix qualification. Its runtime, dependency trees, DBs, image and raw scratch are removed. No release, takeover, performance or historical-cause claim.

[rmcdaniel]

Original 871eec1 / run38477701278 is terminal: SQLite, PostgreSQL16/17, MariaDB10.11 and MySQL8.4 pass. MySQL8.0 fails in native pressure after its corrected portable/clock/expiry comparisons pass. Original artifact11857877879 matches GitHub digest7b6f380a. Its retained MySQL8.0.46 database state proves exit137/OOMKilled=true at23:14:18.806680 UTC under the declared1GiB cap. Native storage refusal and loss of the database alias follow. TLS remains unexecuted. This is the failed fixture allocation, not evidence establishing a native runtime defect or historical503 cause.

The prospective MySQL8.0 DB allocation is now2GiB, matching expanded MySQL8.4. Native treef8ca2ece, all actor/native CPU and memory limits, original scenario deadlines and75-minute whole-job ceiling remain unchanged. A new revision/qualification is required. No same-SHA retry or relabeling of this failed original.

Independent SQLite artifact11858815390 readback matches digestabbeb877. Its recorded CI merge623d900a has the exact candidate871 treea58061e1. All2415 ZIP members pass CRC, three corrected comparisons pass, and31 recorded observations match current source fixture hashes, selected package manifest and canonical typed inputs. All six retained HTTP recorder states are exit0/noOOM. Native35 library/85 execution tests pass, with18 explicitly ignored library cases; comparator1617/1617 passes. Local combined checks at the prior checkpoint included1622.

The numeric JSON fixture-input copies are rounded by JavaScript. Their raw equality is not claimed; exact source hashes and canonical typed int64 values remain intact and are the qualified logical-value evidence. Recorder diagnostic precision needs separate follow-through.

Both ZIP downloads, readback scratch and temporary artifact access files are being removed after this immediate inspection. No bulk retention. Expanded final-head/promotion/fresh-main, performance, migration, release and full#325 remain pending. #438's separate activity profile stays stacked and source/matrix-pending.

[rmcdaniel]

Final head 5a9ab7d36b4cd679ae22ddf1f39e3a251edc003b passes the complete six-database candidate run: SQLite, PostgreSQL 16/17, MySQL 8.0/8.4 and MariaDB 10.11. Every applicable source/PHP, repository, boundary and isolation check also passes. Conditional cancellation/prepared-local source qualification is explicitly skipped.

Review confirms authored timeout snapshots, inclusive outcome/progress fences, original global deadline across retries, bounded heartbeat renewal, strict full retry lists and explicit original-task replay repair. The normal runner executes the existing frozen corpus plus the separate three-runtime marker/range/expiry profile and service clock cases. Completed jobs also pass their applicable process-loss, pressure and TLS controls. This does not claim the additional #438 live retry/duplicate/renewal matrix, which remains in progress.

The completed SQLite job log independently names CI merge d56b975f771f46e405c586dd8708f00d6c07f7cd, with parents current PHP main 158f4c6f2 and candidate 5a9ab7d36. Its complete tree b9f7e9bd652586e23a4e80aa58433c79c1e51ea6 equals the candidate. Native subtree remains f8ca2ece95360786f404ec1f77512149ecd8c9cf. No PHP dependency, default image or historical frozen actor changes.

The original 871eec1ec MySQL 8.0 OOM failure and all earlier failed/cancelled records retain their dispositions. The new run passes at the prospectively declared 2 GiB database allocation, including pressure and TLS, without changing actor/native limits or individual deadlines. It does not establish historical 503 causes. Original canonical typed values remain the exact-value evidence; older rounded JavaScript diagnostic copies are unchanged. Lossless new recording is qualified separately in #438.

The qualified head is ready for main integration. Fresh-main acceptance remains required after merge. Full #325, migration, performance, native publication and cutover remain open. Completed local bulk and runtimes are deleted; this review did not download another archive.

[rmcdaniel]

#435 is merged at 7b53fc26db4e69a8013b6f1ad991fd1d98266833. Its complete tree b9f7e9bd652586e23a4e80aa58433c79c1e51ea6 equals qualified head 5a9ab7d36 and reviewed CI merge d56b975f. Native subtree remains f8ca2ece95360786f404ec1f77512149ecd8c9cf.

The exact final-head six-database run and all applicable normal checks pass, as recorded in the candidate review. Fresh-main qualification is starting and remains required before declaring this slice delivered. #438 retains its separate final-head retry/duplicate/live-renewal qualification and is being retargeted to main without editing its source or frozen actors.

Earlier failures and the prospective resource changes retain their original dispositions. PHP remains the default published image. No Rust release, same-database takeover, performance result, cutover or full #325 completion is claimed.

[rmcdaniel]

#435 is delivered at 7b53fc2, complete tree b9f7e9bd652586e23a4e80aa58433c79c1e51ea6 identical to final candidate 5a9ab7d and reviewed CI merge d56b975. Native subtree f8ca2ece remains exact.

Fresh main 38489133816 passes all six original database jobs without reruns: SQLite, PostgreSQL 16/17, MariaDB 10.11 and MySQL 8.0/8.4. The last original finished 01:04:54 UTC October 14. Applicable main PHP/source/repository/action-policy/public-boundary checks pass. Conditional cancellation/prepared-local qualification is explicitly skipped. Independent completed SQLite job-log inspection confirms actual three-runtime corrected marker/policy/range cases, fixed Python clocks, all four expiry families and separate worker-fencing/database-pressure controls. Git confirms whole-tree identity. No local bulk copy was needed.

This qualifies the selected corrected source cohort, original process recovery, declared pressure allocations and applicable TLS controls. Frozen published tuples and failed/cancelled records remain unchanged. The earlier MySQL8 OOM stays failed; this pass does not establish historical 503/namespace causes. Separate #438 retry/renewal/recorder follow-through is pending at c99b113. Full parity, CPU/deadline, performance, backup-first same-database takeover, major release and cutover remain open under #325.

Completed #435 remote/local head/worktree removal remains verified. Immediate audit archives, transport collections and database copies are deleted under the operator's bulk-retention override. Code, fixtures and readable GitHub outcomes remain the durable result. No Rust publication or stronger capability claim.