[rmcdaniel]

The site still selects Python SDK 2.14.0, which has the replay-breaking condition-wait fingerprint defect in sdk-python#258. Select the accepted published 2.14.1 patch and explain the worker deployment constraints in the Python guide and all seven translations.

The guidance requires upgrading every worker on a queue together and keeping workers at 2.14.1 or later once v2 waits exist. It retains legacy-v1 unverifiability and the combined fingerprint for same-line comprehension lambdas, with a link to the immutable tagged compatibility notes. The stable tuple qualification date remains November 4, inherited from merged #465.

Release evidence:

• Security final published-package acceptance clears this exact-version downstream adoption. The fix-only release excludes the unreleased typed workflow/child/client API.
• Fresh reads confirm the stable public release and non-yanked PyPI wheel/sdist match the accepted SHA-256 identities. The tagged CHANGELOG agrees with all four compatibility caveats.

Validation: all 14 checks pass at exact head 70e3b6ae05b8d87b4b6b20071f0b7d0040b8f36c, including the full eight-locale documentation build, all three installer platforms, protocol catalog, public boundary, CodeQL and Sonar. Local Node 24 protocol/preflight tests passed on the preserved source. The superseded original-head local full build was stopped after hosted qualification completed; no local full-build pass is claimed. Scope, translation meaning, review hashes, credentials/private-content inspection and git diff --check pass.

General retains the merge decision after independent Security review. If another stable-manifest PR merges first, refresh normally and requalify the new head. After merge, verify the protected site deployment, live manifest and all eight localized guides before recording docs completion on sdk-python#258.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Refreshed normally onto merged #465/main 0be89919cb91f38b2820acbf43735c19cc8e70a3 at exact head 70e3b6ae05b8d87b4b6b20071f0b7d0040b8f36c, preserving recovered commit 9d2e3fd9. The qualification date and Waterline selection are inherited from main. The remaining diff is Python 2.14.1 plus its upgrade guidance and reviewed translations/source hashes.

Local npm test, dependency/toolchain checks, translation checks, executable-example parity and changed-guide hash checks pass on the preserved source. Its full local eight-locale build is still running. Fresh hosted qualification is now running on the updated exact head, including the full documentation build, installer platforms and security/boundary checks. Independent Security review and General's merge decision remain required.

[rmcdaniel]

Ready for independent Security review and General's merge decision at exact head 70e3b6ae05b8d87b4b6b20071f0b7d0040b8f36c, based on merged #465/main 0be89919. All 14 checks pass, including full eight-locale documentation qualification 41810563242, all installer platforms, CodeQL, Sonar, protocol and public boundary.

The source/translation delta is unchanged from recovered 9d2e3fd9; the normal merge inherits accepted Waterline 2.14.0 and the November 4 qualification date. Local protocol/preflight tests passed. The superseded original-head local full build was intentionally stopped after fresh exact-head hosted qualification passed, and its container was removed. No local full-build pass is claimed.

The patch retains all four tagged compatibility caveats and excludes unreleased Python APIs. Deployment/live verification remains pending. If CLI #466 merges first, this candidate needs its new base and fresh qualification before final review/merge.

[rmcdaniel]

Recorded by General at Security’s request. The review below is Security’s frozen exact-head disposition, delivered through native agent chat; General retains the merge decision.

Security review — exact 70e3b6ae05b8d87b4b6b20071f0b7d0040b8f36c

PASS for source/selection. No security or compatibility defect was found in the exact 16-file delta over 0be89919cb91f38b2820acbf43735c19cc8e70a3. General retains the merge decision; this does not claim a deployment or live-site result.

Independent evidence:

• static/stable-releases.json changes only sdk-python from 2.14.0 to stable 2.14.1; the November 4 tuple date and every other artifact identity remain unchanged. The site authority deterministically produces durable-workflow==2.14.1 and the exact PyPI release URL.
• Public release identity matches the prior Security package acceptance: annotated tag a2e17a4f2c3c782eecd3a4f44dc848b8f6842b64 peels to reviewed source dc47958c026b35167d2f90a33b96f7a575c48aee; the GitHub Release is stable with zero assets; the non-yanked PyPI wheel and sdist SHA-256 values remain 1b3bc645cc167979849cc2d07bc5ee342ba486f84d1ad9fbc8592594ce83c285 and 4e6882a4326fafd0353ecc23bf60011a64964b8733678f4d30fb4f6d6f4e4e0e.
• The English guide and all seven translations preserve the accepted compatibility boundaries: upgrade every worker sharing a queue together; once a v2 wait exists, keep replay-capable workers on 2.14.1 or later and do not roll back; mismatched legacy-v1 fingerprints are accepted as unverifiable and cannot detect predicate changes; same-line list/dict/set comprehension lambdas share one combined fingerprint and should be separated in new definitions. All link to the immutable tagged notes and use the stable upgrading-workers anchor.
• The canonical English source recomputes to SHA-256 612f664afbfb1d81377c57c9cf7f535836d4d3e4738daab9fff940cb3ae2c658, exactly the value recorded by all seven locale source-hash catalogs. The merge from current main has no manual conflict resolution, and git diff --check is clean.
• All 14 checks are terminal success at this head: full eight-locale executable documentation contracts (41810563242), three installer platforms, protocol catalog, public boundary, four CodeQL languages, SonarQube and SonarCloud.

After merge, the owner still needs the normal protected deployment and live readback of the manifest plus all eight localized guides before closing sdk-python #258. The active GitHub incident is an operational reliability concern; no merge or deployment outcome should be inferred without exact remote readback.

[rmcdaniel]

General merged exact reviewed 70e3b6ae05b8d87b4b6b20071f0b7d0040b8f36c normally as b8b543b4c236dc834f7122af94c41afc3a43f876 after verifying the unchanged base, durable attributed Security review 6628298809, and all 14 terminal-success checks. Independent readback verifies the exact ordered parents, reviewed tree and main at M.

Docs owns protected Pages deployment and live stable-manifest plus all eight localized Python upgrade-guide checks before returning the final sdk-python#258 receipt. Refresh #466 once onto this main and requalify it; keep #468 frozen until that validation catches up. No live-site success is claimed by this source merge.

[rmcdaniel]

Python 2.14.1 documentation delivery is verified live after normal merge b8b543b4c236dc834f7122af94c41afc3a43f876 and successful protected Pages deployment 41813828016.

Fresh anonymous no-cache readback confirms:

• The live stable manifest selects sdk-python: 2.14.1 with qualification date 2026-11-04.
• Every localized Python guide renders the exact install requirement durable-workflow==2.14.1 and the upgrading-workers anchor.
• Each live upgrade section matches its reviewed locale source from the merged commit after removing HTML/Markdown markup and normalizing whitespace. The queue-wide upgrade/no-rollback rule, legacy-v1 unverifiability and same-line comprehension limitation are retained, with the immutable tagged compatibility link in every locale.
• Canonical English source SHA-256 remains 612f664afbfb1d81377c57c9cf7f535836d4d3e4738daab9fff940cb3ae2c658, matching all seven merged locale review catalogs.

Verified live guides: English, Ukrainian, Spanish, Brazilian Portuguese, Simplified Chinese, Japanese, French and German.

This completes the docs adoption obligation for sdk-python#258. The independently reviewed source, protected deployment and user-visible readback are all recorded; remaining CLI/Rust adoption follows separately.