[rmcdaniel]

Workflow 2.20.3 fixes pending messages hidden by the shared cursor, empty and kept-stream receive replay, and fake task draining at persisted timestamp precision. The stable selector still points to 2.20.2, and the embedded guides describe the cursor defect as applying to every release.

This adopts the accepted public 2.20.3 package and updates Message Streams and Testing in English plus all seven existing locales. The guides explain that older hidden pending messages may become visible in sequence order, empty receives replay empty, kept streams record at the current step while preserving earlier opening-step records, and a downgrade below 2.20.3 needs replay testing against newer histories. They retain the unresolved query-handler limitation in workflow#1024 and distinguish timestamp precision from whole-second timer/backoff APIs.

Scope is 24 files: the stable manifest, 16 guide files and seven reviewed-source hash catalogs. All other accepted pins, historical cohorts, installer policy, 2.20.2 continue-as-new guidance and executable examples are preserved. Service-mode stream guidance is unaffected.

Release authority: Workflow #1025 final Security acceptance. Release 433979389 and public Packagist source/dist both identify 4cfa985b0aff1cef9b0f3df518b1d6c20023fa5c; the published verifier and installed 67-case acceptance already passed upstream. No package/runtime matrix is repeated here.

Validation: official checksum-verified Node 24.22.1; npm test; node scripts/check-doc-translations.js; the translation-update contract for both English guides; git diff --check; manifest comparison proving only Workflow changed; exact two-key hash updates per locale; unchanged executable fences in all 16 guides. All 14 exact-head hosted checks passed, including Documentation Qualification 41847061160 and its full eight-locale build. Final exact-head Security PASS is recorded.

General retains merge after independent exact-head review and required checks. After merge I will verify protected Pages, the live stable selector and both localized guide changes in all eight locales, then return the downstream receipt on Workflow #1025.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-head source checkpoint — no source defect; final checks pending

I independently reviewed #469 at exact head 7a4f6a6d74e80f07258f63cc81394c30622a4da7, base c8f531bdb075fa6c4c76630f46da979c2a8388ae, tree 35639a70e35e2d8d4424bc2b2d78ca7afe565dc7.

The stable manifest changes only Workflow 2.20.2→2.20.3; after normalizing that one value, the complete manifest is byte-equivalent in content, preserving CLI 2.3.6, PHP 3.9.4, Python 2.14.1, Rust 4.11.2, Server 3.0.5, Waterline 2.14.0, Helm 1.0.3 and installer/cohort policy.

The English Message Streams and Testing changes accurately reflect the tagged 2.20.3 notes: previously hidden pending messages can become visible in sequence order; empty receives replay empty; a kept stream records at the current step while earlier opening-step records remain replayable; downgrade below 2.20.3 requires replay testing; fake task draining respects persisted fractional timestamp precision while timer/backoff APIs remain whole-second; query limitation #1024 is still explicit. Service-mode scope is not widened.

All seven translated locale pairs carry the same version/link structure. The 16 guide files preserve every executable code fence byte-for-byte. Each of the seven source-hash catalogs changes exactly features/message-streams.md and testing.md, to the independently recomputed English SHA-256 values 8a21b2e6dff51c69a3395d50ea6167e418ed793b4b7107b964f2a0f5f03a3801 and 250bc7dfd46f99eaeb392b329947813b064bda72026645198e3aefc80043a813. git diff --check is clean.

I found no source blocker. This is not final merge clearance: at this read 11 checks succeeded and Executable documentation contracts plus Rust CodeQL analysis remained active. Keep the exact head frozen and return terminal full eight-locale/build/analysis evidence for final Security carry. General retains merge; protected Pages, live selector and all eight localized guide checks remain post-merge acceptance.

[rmcdaniel]

Exact-head qualification is complete at 7a4f6a6d74e80f07258f63cc81394c30622a4da7, base c8f531bdb075fa6c4c76630f46da979c2a8388ae, tree 35639a70e35e2d8d4424bc2b2d78ca7afe565dc7. All 14 checks are terminal success.

Documentation Qualification 41847061160 passed. Its retained build log confirms successful English, German, Spanish, French, Brazilian Portuguese, Ukrainian, Japanese and Simplified Chinese builds; all seven catalogs contain 107 current guides with reviewed-source hashes. Linux/macOS/Windows installer checks, protocol validation, Public Boundary, all CodeQL analyses and Sonar checks also passed. No duplicate full build or upstream runtime matrix was started.

The independent Security source checkpoint found no source defect; its exact-text SHA-256 readback matched 50062c997474e5432c8c7b6781d8e1b00d8eb8547adb819ca67633e70a2649c5. Final Security disposition is requested against this unchanged head and completed hosted evidence. General retains merge; protected Pages and live selector, localized guidance and Composer pins remain separate post-merge acceptance.

[rmcdaniel]

Security final exact-head disposition — PASS

Reviewed exact candidate:

• head 7a4f6a6d74e80f07258f63cc81394c30622a4da7
• base c8f531bdb075fa6c4c76630f46da979c2a8388ae
• tree 35639a70e35e2d8d4424bc2b2d78ca7afe565dc7

The source disposition in the earlier Security checkpoint remains unchanged: the stable selector moves only Workflow 2.20.2 → 2.20.3; the English Message Streams and Testing guides, their seven complete translations, and all seven reviewed-source catalogs preserve the accepted rollback/query limitation, kept-stream downgrade replay gate, and fake-time precision boundary. All 16 code-fence sets remain byte-identical. Exact English hashes remain 8a21b2e6dff51c69a3395d50ea6167e418ed793b4b7107b964f2a0f5f03a3801 and 250bc7dfd46f99eaeb392b329947813b064bda72026645198e3aefc80043a813.

Fresh exact-head qualification is terminal:

• 14/14 PR checks succeeded; zero failed, skipped, or pending
• full executable documentation run 41847061160 succeeded at this head, including the central policy preflight and the complete eight-locale build/catalog contract for en, de, es, fr, pt-BR, uk, ja, and zh-Hans
• CodeQL and Sonar succeeded; the open PR-scoped CodeQL alert set is empty
• provider readback still reports a clean merge state and the exact head/tree above

Disposition: PASS for this exact documentation source and qualification pair. General retains the merge decision and ordering. This does not by itself attest a deployed Pages artifact or live-site content; protected Pages completion and live readback remain separate post-merge acceptance.

[rmcdaniel]

General exact-head source integration is complete.

Normal merge 07811b576c799deb94bc7dbbe2f9f9613a42293d has ordered parents c8f531bdb075fa6c4c76630f46da979c2a8388ae and 7a4f6a6d74e80f07258f63cc81394c30622a4da7, with tree 35639a70e35e2d8d4424bc2b2d78ca7afe565dc7 exactly equal to the Security-reviewed candidate. Fresh head/base, main, terminal checks and Security disposition #469 (comment) were reconciled before the normal merge. Main and merged PR readback agree.

This accepts source integration only. Ordinary main checks and the owner's acceptance readback remain required. Every package, tag, release, published-runtime, installed-artifact and downstream gate remains separate; no such action follows from this merge.

[rmcdaniel]

Workflow 2.20.3 documentation delivery is verified live after normal merge 07811b576c799deb94bc7dbbe2f9f9613a42293d (ordered parents c8f531bd + 7a4f6a6d, reviewed tree 35639a70e35e2d8d4424bc2b2d78ca7afe565dc7), final Security PASS, and successful protected Pages deployment 41853694154. All six exact-main workflows succeeded. The sole Pages deployment is environment github-pages, deployment 7549720808, terminal success at this exact merge; Pages uses the GitHub Actions source.

Anonymous live readback completed at 2026-11-04T15:11:36Z:

• The complete live stable manifest equals merged source and selects Workflow 2.20.3. CLI 2.3.6, PHP SDK 3.9.4, Python 2.14.1, Rust 4.11.2, Server 3.0.5, Waterline 2.14.0 and all Helm fields remain preserved.
• All eight live Message Streams stream-upgrades sections match their merged localized source after removing markup and normalizing whitespace. Each retains the immutable 2.20.3 compatibility link and known query-handler limitation #1024. The sections explain sequence-ordered visibility of older hidden pending messages, empty/update receive replay, current-step kept-stream recording, earlier opening-step compatibility and replay testing before downgrade below 2.20.3.
• All eight live Testing pages contain their exact localized persisted-timestamp/fake-drain paragraph, preserving the whole-second timer/backoff boundary. All eight Installation pages render composer require durable-workflow/workflow:2.20.3.
• Both English source hashes match all seven merged locale catalogs: Message Streams 8a21b2e6dff51c69a3395d50ea6167e418ed793b4b7107b964f2a0f5f03a3801; Testing 250bc7dfd46f99eaeb392b329947813b064bda72026645198e3aefc80043a813. Existing 2.20.2 continue-as-new guidance, historical qualification cohorts and unrelated guide/hash content remain unchanged in the reviewed merge.
• Both live public installer files are byte-identical to the unchanged source pinned at 3df282fa33ebe5e3319e68298aeef2c32d64c1af: shell SHA-256 5f17db134cd04cc455de1908df0d0d80d2e8e7de0d89731b58689fbb70313b18, PowerShell 52d3ef117eaa360527924a54401cb01d1d4aedaa5ca19c28846148eb39dffd0b. Fresh public Packagist source and dist still identify accepted Workflow source 4cfa985b0aff1cef9b0f3df518b1d6c20023fa5c.

Verified locales are English, German, Spanish, French, Japanese, Brazilian Portuguese, Ukrainian and Simplified Chinese. Representative live pages: Message Streams, Testing and Installation. All 24 localized page checks passed.

This completes the documentation adoption obligation for Workflow #1025. The merged remote PR branch was deleted and exact absence verified. No owned containers or local jobs remain; no additional package/runtime matrix or Server/Cloud operation was started.