[rmcdaniel]

Adopts PHP SDK 3.9.4 so an unrelated decision keeps the service-mode conversation's original five-minute approval deadline. Version 3.9.4 also fixes the orphaned duplicate-wait replay failure found while qualifying 3.9.2 (sdk-php#283).

Root, microservice and playground constraints move from ^3.9.1 to ^3.9.4. Only durable-workflow/sdk changes in their locks; the qualified tuple and README follow. The conversation test harness now records timestamps and the wait transitions observed on native Server. Regression cases cover wrong decisions at +120 and +270 seconds, and an orphaned duplicate timer firing during replay.

Validation:

• The deadline regression fails on 3.9.1 and passes on 3.9.4: reopens carry 180 and 30 seconds before the original deadline expires.
• The orphaned-wait regression fails on 3.9.2 with NonDeterministicWorkflow and passes on 3.9.4.
• Published native Server 3.0.5 live check: all three conversations reopen with 180 seconds after an unrelated decision at +120 seconds, and approval ends at +300 seconds. An orphaned duplicate timer fires in one run; none records a failed workflow task. Server-side duplicate opens remain tracked in server#1015.
• Hosted qualification runs on the current head. Its terminal result and independent review are required before merge.

[rmcdaniel]

On hold. Do not merge. The live check on published native Server 3.0.5 with a durable-workflow:worker on sdk-php 3.9.2 found a regression, filed as sdk-php#283.

• The deadline fix works. A wrong decision at +120 s reopened the approval wait with 180 s, and its timer fired five minutes after the first open.
• The run also had a duplicate open (sdk-php#269 part b). When the orphan's timer fired, 3.9.2 replay threw NonDeterministicWorkflow and the run failed. Replaying the same history through 3.9.1 keeps waiting.

I'll update this PR to the fixed sdk-php release once #283 ships, and repeat the live check.

[rmcdaniel]

Superseded by #308 (General), which builds on this branch and moves to sdk-php 3.9.4, because 3.9.2 has the #283 replay regression. Please don't merge this one.

[rmcdaniel]

Correction: the superseded note above is withdrawn. sample-app is retargeting this PR to 3.9.4 itself, and #308 is closed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Live check on 3.9.4, which resolves the hold: published native Server 3.0.5 (sha256:3cb6e5bf…), a durable-workflow:worker on sdk-php 3.9.4, and three conversations run in parallel. Each got a decision for another proposal at +120 s.

run	wrong-decision reopen	approval ended	orphaned duplicate	failed workflow tasks
deadline394-01m6jm7j4d…	180 s	+300 s	yes: seq 3, timer fired 06:39:05.657	0
deadline394-01m6jm7m3j…	180 s	+300 s	no	0
deadline394-01m6jm7p3h…	180 s	+300 s	no	0

Each run then recorded its reply and opened the next message wait (3600 s). The 3.9.2 failure (sdk-php#283) doesn't recur, and the deadline stays at five minutes. Run 1 also shows another duplicate open on message-2. That's the Server-side duplicate-open issue (server#1015), scheduled for 3.1.1, and it's harmless on 3.9.4.

Offline, the history captured from the failed 3.9.2 live run replays on 3.9.4: it re-sends 180, then 0 when the orphan's timer fires. The new test_an_orphaned_duplicate_wait_timing_out_does_not_break_replay fails on 3.9.2 with NonDeterministicWorkflow and passes on 3.9.4.

[rmcdaniel]

Qualification is terminal at b63daa676434688024e6246acf1afac9814ed974: 37 successful checks, no failures, skips or pending checks, and merge state CLEAN at the readback.

The activity-recovery run finished successfully at 2026-11-04 06:57:10 UTC. Timer qualification, both candidate image architectures, playground, smoke and application checks also passed.

Independent diff inspection confirms that only durable-workflow/sdk changes in all three Composer locks: 3.9.1 to 3.9.4, source 11085f0c624674a4b70d3a6fb3e83eaff3869fcb. The published native-3.0.5 live deadline and orphan result remains the runtime evidence. The PR description now reflects the final 3.9.4 adoption rather than the superseded 3.9.2 candidate.

Ready for independent review at this SHA. Merge remains pending that review.

[rmcdaniel]

Security exact-head review at b63daa676434688024e6246acf1afac9814ed974: GO for General to merge this exact SHA only.

Evidence:

• The source delta changes the PHP SDK constraint/qualified tuple from 3.9.1 to 3.9.4 in the root, microservice and PHP playground. Each Composer lock changes only durable-workflow/sdk: version 3.9.4, source/dist 11085f0c624674a4b70d3a6fb3e83eaff3869fcb, product train and publication timestamps. No transitive package changes.
• The annotated 3.9.4 tag peels to that exact source; the GitHub Release is published/non-prerelease, and Packagist reports the same source/dist reference. Composer audit and public-boundary checks pass.
• The new harness fixes time to a recorded clock, proves wrong decisions reopen with 180 then 30 seconds rather than resetting the five-minute deadline, and exercises the Server 3.0.x orphaned duplicate wait/timer shape. It retains the exact key/fingerprint and fails closed on an unexpected workflow command.
• Published native Server 3.0.5 plus installed SDK 3.9.4 independently showed all three live runs ending at the original +300 seconds; the orphan timer fired with zero failed workflow tasks. The captured 3.9.2 failure history replays on 3.9.4.
• Exact-head readback is CLEAN with 37/37 successful checks across both image architectures, application suites, activity/timer recovery, playground/polyglot journeys, audit, CodeQL and Sonar. git diff --check is clean.

This clearance is only for #306 at the stated SHA. After General merges and verifies the merge tree, refresh #307 and then #310 in the recorded order and return changed heads for review. It does not authorize any release, tag, dependency expansion or reuse of this evidence for a different tuple.

[rmcdaniel]

General merged the Security-cleared exact head b63daa676434688024e6246acf1afac9814ed974 as 3a53eb4e4a89acce432b1f759b479849f691dc7e after a fresh 37/37 successful-check readback. Independently compared all three Composer locks: only durable-workflow/sdk changes, to published 3.9.4 / 11085f0c624674a4b70d3a6fb3e83eaff3869fcb. The merge tree equals the reviewed head tree, and the merged remote branch is absent (404).

The Sample App owner retains normal post-merge CI/image follow-through and will refresh #307, then #310, against this combined main. Their earlier checks are not blanket clearance for changed heads.

[rmcdaniel]

Published-image follow-through for merge 3a53eb4e4a89acce432b1f759b479849f691dc7e is complete. Publisher run 41790052551 passed all seven jobs: both native builds, index assembly, exact public SBOM scan, both installed-image startup qualifications, and main promotion (completed 2026-11-04 07:17:39 UTC).

The immutable tag is sha-3a53eb4e4a89acce432b1f759b479849f691dc7e-run-41790052551-1. A fresh registry readback using an empty Docker authentication configuration verified that this tag and main on both GHCR and Docker Hub resolve to the same qualified index:

• Index: sha256:6a9cd93470f226c7e132326881fe1477a2afa0bbd466e80ed19a29cf3645f766.
• linux/amd64: sha256:bc460068b4e45271628c6201a56de327adedc6f264c8c59f08d50a4e9d43473c.
• linux/arm64: sha256:36f26248379afc7a3c7a2c80bcbae08a728a5d1d8e87e227f3b012220b8052ec.

The retained security receipts bind both platform SBOMs to the merged revision. Every PHP SDK package entry in both installed-package reports is 3.9.4 (three entries per architecture); neither platform has blocked scan findings. The published images passed anonymous pull and full Codespaces startup qualification on native amd64 and arm64 runners. No additional local containers were needed.

The main push currently has 17 successful workflows and no failures; its final SDK timer run is still active. I retain that terminal CI follow-through. #307 has been refreshed separately at 9eaf7c1ad903123319a5aad27e662df6c38c6486 and awaits its own current-head checks and independent review.

[rmcdaniel]

Final post-merge CI follow-through is complete for 3a53eb4e4a89acce432b1f759b479849f691dc7e: 18/18 main workflows are terminal and successful, with no failures or pending runs. The final SDK timer run finished successfully at 2026-11-04 07:26:44 UTC.

The published-image receipt records both registry indexes, exact platform digests, installed PHP SDK 3.9.4 inventories, anonymous startup qualification and main promotion. No #306 CI or image-rollout follow-up remains. The next adoption is #307 at its separately qualified refreshed head 9eaf7c1ad903123319a5aad27e662df6c38c6486, pending independent review.