[rmcdaniel]

Release PR for native 3.6.0, per General (2026-11-12): schema-free, cut once the queued PRs landed.

• docs/releases/3.6.0.md: no schema upgrade (MySQL/MariaDB/PostgreSQL stay at 12, SQLite at 11), and rollback to 3.5.0 is an image change. It covers update outcome reads (Native: read a retained update outcome later by update id (.github#212) #1131), the replay entry clock (Native: produce the replay_clock entry carrier on workflow tasks (.github#215) #1132), heartbeat resume (Native: resume activities from their last acknowledged heartbeat (.github#218) #1139), the image scan gate plus base refresh fixing CVE-2026-109518 (Scan published Server images for actionable vulnerabilities #802), large fan-out completions (Native: deliver typed refusals for oversized workflow-task completions #1136), the schedule re-apply no-op (Native: make re-applying an unchanged schedule a no-op (match workflow#1089) #1147) and replay-blocked metrics (Native: report replay-blocked runs in operator metrics and health (match workflow#1091) #1154). It names MySQL json columns round JSON doubles in history; store JSON losslessly (3.2.0) #1016 as the planned 3.7.0 MySQL schema change.
• docker-compose.published.yml defaults to durableworkflow/server:3.6.0.

After merge: tag 3.6.0 at this merge commit, run native-release (now with the scan jobs), dispatch the corpus and Compose qualifiers from the tag, build the evidence with native_alias_manifest.py, promote the aliases, create the GitHub Release and bump the chart.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud