[rmcdaniel]

Adopt published Core 2.15.10 so a child outcome recorded after a parent task was leased produces a follow-up delivery when that task completes into another wait. Only the exact Core requirement and lock entry change, from 2.15.9 to 2.15.10; all other runtime and development packages stay unchanged. Rust implementation and shared/frozen fixtures are unchanged.

Published-library acceptance covers the real worker HTTP interleaving on SQLite and PostgreSQL 17.11. This PR is PHP Server source integration. Published Server 2.11.7 still contains Core 2.15.7; this PR creates no tag, image, chart or deployment. Keep the existing release/publication boundaries and Workflow #962/#947 open for actual published-image and Nexus/host-query acceptance.

Validation:

• Ordinary Composer update/install, locked audit (zero advisories), and package-authority structural regression pass. All 1,010 installed Core runtime/resource/metadata files match immutable release source e2b199673d087fd278628db066e215217eec61cb; the bridge loads from the installed vendor package.
• Child, queue, Nexus and codec-corpus integration: 115 tests / 1,785 assertions pass with PHPUnit's declared SQLite in-memory/array-cache environment.
• Bridge admission/concurrency/controller/outcome contracts: 21 tests / 255 assertions, two expected SQLite skips. Release identity fan-out contracts: 3/3 pass.
• An initial local run inherited a tool image's file-database/cache defaults and produced 12 migration-lock errors (115 tests / 1,698 assertions); it is retained as failed evidence. The declared-environment run above passes. Full normal repository/database/image checks remain required before merge.

Refs durable-workflow/workflow#962, durable-workflow/workflow#947.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

General source review is complete for exact head fd7a6f56f79bcfd9160419bf9deaa3a22f7c423d: the only locked package change is published Core 2.15.9→2.15.10, with all 1,010 installed runtime/resource/metadata files matching its immutable tag. Child/queue/Nexus/corpus 115/1,785, Bridge21/255 (two expected SQLite skips), normal Composer audit/package authority and release-generation3/3 pass locally.

Actual Sonar API review at 2026-10-31 10:43 UTC binds that exact head, quality gate OK, zero issues and zero hotspots. It was inspected after the analysis completed and before any merge decision. The earlier empty PR API result while analysis was still running was not used as acceptance.

Marked ready for review. Normal PHP feature/image/database qualification and Rust CodeQL are still running; no failed checks are currently reported. Merge must use the normal protected queue after those gates pass. This is source integration only; published Server 2.11.7 remains Core 2.15.7, and no tag/image/chart/deployment or publication-boundary change is made.

[rmcdaniel]

All PR-head gates pass on exact fd7a6f56f79bcfd9160419bf9deaa3a22f7c423d: 16 SUCCESS / eight expected SKIP. Normal PHP qualification 41193364472 passes the full feature/Nexus/corpus suite: 3,445 tests / 74,926 assertions, six PHPUnit deprecations and 51 skips. Release continuation/immutability controls pass 50/237, and release publication-audit control 1/12. The source-built candidate production image passes first-run readiness and all eight logging modes/roles; this is an unprivileged candidate, not a published replacement image.

Actual Sonar review before queue submission binds the same source: zero issues/hotspots, gate OK. Rust CodeQL, repository contracts, shared fixture classification and concurrent replay/query HTTP checks pass. No required check was waived.

Submitted through the normal protected queue: position 1, state AWAITING_CHECKS, entry MQE_lQDOSATFBs8AAAABL8o1Mc4ABPZYzgOgf90. Queue PHP qualification 41194613984 is running. This is queued, not merged. Workflow #962/#947 and the existing publication boundaries remain open; no tag/image/chart/deployment change.

[rmcdaniel]

Merged through the protected queue as 08c7adab2fba84d4e22204421e1a8822bc9c7c71 at 2026-10-31 11:14:58 UTC. Tree 5c77af087191dfb37cb3d0f076722151cc2abdd7 exactly matches reviewed head fd7a6f56f79bcfd9160419bf9deaa3a22f7c423d.

All PR-head gates passed (16 SUCCESS / eight expected SKIP), followed by the normal queue's PHP qualification, fixture/boundary checks and queue Sonar proof. The merge group again passes 3,445 tests / 74,926 assertions, six deprecations and 51 skips, plus release controls 50/237 and 1/12. Its candidate production image passes first-run readiness, all eight logging modes/roles, and required database TLS/certificate refusals. Actual PR Sonar had zero issues/hotspots and was reviewed before queue submission.

Normal main qualification 41196061701 and main Sonar/topology/boundary workflows are running. This merge changes only the exact Core requirement/lock to published 2.15.10. The installed library’s 1,010 runtime/resource/metadata files match its tag, and real SQLite/PostgreSQL worker HTTP acceptance remains recorded in Workflow #962.

Source integration is complete; published-image delivery remains pending. Published Server 2.11.7 still contains Core 2.15.7. No 2.11.8 tag/image/chart/deployment or publisher/credential change occurred. Workflow #962 and #947 remain open for the authorized published tuple and their distinct child-wake-up and Nexus/host-query acceptance. Rust/shared/frozen source is unchanged.

[rmcdaniel]

Normal main qualification is now complete for 08c7adab2fba84d4e22204421e1a8822bc9c7c71: PHP41196061701, Sonar41196061743, concurrent topology41196061736 and the remaining normal main checks have no active or failed results. Main again passes 3,445 tests / 74,926 assertions, six deprecations and 51 skips, release controls 50/237 + 1/12, candidate image first-run/logging 8 PASS, and the required TLS/certificate refusals.

Source integration and normal main verification are complete. The published image is still Server 2.11.7 / Core 2.15.7; no 2.11.8 tag, image, chart or deployment was published. Workflow #962/#947 remain open for their specific actual published-image acceptance through the existing authorized release path.

Cleanup is verified: the clean task worktree, ignored vendor/bootstrap/test caches and own Composer cache/config are removed; the exact merged remote head was deleted with 404 readback. Zero task containers remain, including stopped ones. Only 476KB of active owning-issue qualification receipts/logs remain; shared images, other owners and the Server #825 worktree anchor are preserved.