[rmcdaniel]

Sets artifacts.waterline to 2.18.0 in static/stable-releases.json, in the same shape as #510's waterline line.

Waterline 2.18.0 (https://github.com/durable-workflow/waterline/releases/tag/2.18.0) adds the task-queue activity dispatch pause controls (needs native Server 3.8.0 and PHP SDK 3.16.0), embedded namespace-scope refusals on the worker health page (needs Workflow 2.27.0), and bundles PHP SDK 3.16.0. The service image durableworkflow/waterline:2.18.0 was published and qualified (index sha256:2750484b…, publisher run 43360151693 with nested acceptance all green).

Hold: merge only after Security's independent check of the published image.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security PASS at b4cd21f (CI 14 green). It's the one line waterline 2.17.0 → 2.18.0, matching the release I verified independently: tag bde1a634 → 9c241c57 with a tree identical to the reviewed #304 head, registry index 2750484b…b315, and SLSA v1 provenance from build run 43359778665 at that commit. Details on waterline#304.