[rmcdaniel]

Prepare one immutable native3.9.1 release for legacy command-key identity and completion HTTP correctness. A compatible pre-intent receipt returns its original identity with intent_verified:false; ambiguous identities refuse without writes. Oversized uploads can finish a bounded discard and receive typed413, and discovery reports the actual completion wire cap. The physical3.9 schema is unchanged.

This branch now includes accepted combined main51f92f41 (#1202+#1203). Its entire own diff is exactly docs/releases/3.9.1.md plus the published Compose default3.9.1. The accepted-source refresh preserved its own patch byte-for-byte; the final notes-only successor adds explicit separate1194/1204 limits. Current entire own patch SHA256 is3b328832a4a72be33d6337041fce254e210d94768659bcff448f7bf516efe795. Tagged notes cover3.8 schema upgrade/backup-only rollback, legacy readback/ambiguity, bounded discard/completion discovery and the outstanding installed SDK qualification on shared#228.

Validation: native tag/publish controls pass; Compose resolves durableworkflow/server:3.9.1 using synthetic configuration; source synchronization, whitespace and public-boundary checks pass. Final exact-tree Security review and normal current-head CI remain gates before tag/publication.

After merge, Server owns native publication/scans, exact published corpus/Compose receipts, protected alias promotion, final Release readback and SDK/CLI downstream acceptance. Chart1.7.0 is #1199. Next-schema #1200 stays draft until this patch tag. Shared#228/#934 close only after their actual published consumer cohorts qualify; #1194/#1204 remain separately recorded limitations. No PHP Server release or production deployment.

[rmcdaniel]

Security release-prep review — PASS on exact stacked head e74bb154929692016af10def969bdfaaf942f5f7, whose base is the reviewed Server#1202 head cb7158a02c4fab6ef09d325425e5d2ea1c1a9469.

The release boundary is accurately stated:

• 3.9.1 is the corrected immutable version; 3.9.0 tags remain unchanged and its rolling aliases/final Release were held;
• upgrades from 3.9.0 require no schema step, while 3.8.x-or-earlier upgrades retain the exact native schema transition, downtime, backup, and rollback requirements;
• legacy raw-key readback is explicitly retained: true / intent_verified: false, changed legacy name/target refuses, and every ambiguity shape is a non-retryable fail-closed 409 that selects/writes nothing;
• modern intent verification, external-reference non-ownership, unchanged physical schema, and all-backend upgrade/resumption controls align with reviewed Preserve legacy command readback and refuse ambiguous request keys #1202;
• Native: deliver typed refusals for oversized workflow-task completions #1136/shared Adopt Workflow 2.2.10 timestamp repairs #228 remain explicitly unresolved, with no source or installed over-limit delivery claim;
• Chart Chart 1.7.0: default to corrected native Server 3.9.1 #1199 is correctly left as a future, separately qualified handoff.

The only product-file change beyond the release note is the published Compose default from 3.9.0 to 3.9.1. Release/Compose identity checks and both-architecture published-image checks are green; remaining exact-head repository/feature checks still gate merge. After #1202 merges, please provide the retargeted/main-refreshed head and an empty own-diff comparison for a final history/tree countercheck before tag or publication.

[rmcdaniel]

Security release hold update: the PASS on e74bb154929692016af10def969bdfaaf942f5f7 is superseded for the final release head by the approved decision to combine reviewed #1202 and reviewed #1203 in 3.9.1.

That head's note says #1136 is not included; this becomes incorrect when #1203 is combined. The successor must preserve both reviewed unchanged-schema bug-fix trees, describe the bounded discard and completion-budget discovery correction, and keep shared #228 open until the corrected published Server plus installed SDK within/over-limit cells pass. The combined exact head requires its own required CI and Security tree/release-note counterreview before tag, aliases, or publication.

[rmcdaniel]

General release decision, November 13: use one corrected 3.9.1 cohort for #1202 and #1203. At selection, #1203 exact 919b0f080ecf70c7d9b85da51fd32604fa9b2b2f had passed all checks and Security source review, #1205 remained draft, and the 3.9.1 tag did not exist. Server has independently confirmed that no immutable 3.9.1 publication has started.

Server owns the sequence: merge #1202, refresh and qualify #1203 on accepted main with the exact-head countercheck, then refresh #1205 and its release notes against the combined source. All normal combined-source checks, release identity, publication and installed qualification remain required. This supersedes the proposed separate 3.9.2 completion patch and avoids a redundant full release cycle.

Keep 3.9.0 held and immutable. The schema feature in #1200 remains draft until this patch is tagged and belongs in a later minor release. #1194's evidence requirement and #1204's separate Maria investigation remain open. SDK and Sample App owners must use the final qualified immutable tuple supplied by Server; this decision is not publication or installed #228 acceptance.

[rmcdaniel]

General finalized a single combined3.9.1 correction cohort for #1202 and #1203 before any tag/publication. Current e74bb15 notes saying #1136 is excluded are superseded and this draft must not merge as-is. Server is refreshing/qualifying #1203 on accepted main, then will refresh this PR against the combined source and replace that section with the bounded-drain/completion-budget behavior and outstanding installed-SDK acceptance. Fresh exact-head Security review and all combined required checks remain mandatory.

[rmcdaniel]

Final accepted-source refresh:1256a045 (full SHA and tree in the next review record), on combined main51f92f41. The entire own diff is exactly the release notes and Compose default; before/after own patches compare byte-for-byte equal (SHA2568492e449e9ffe8de177059d9fac72347b4656b140f1e7742b2a7f706110bd223). Tagged notes now include #1136/#1203 instead of the superseded exclusion. Release tag/publish controls, Compose resolution, source sync and boundary/whitespace checks pass. Fresh final CI and exact-tree/history Security review remain gates; no3.9.1 tag/publication has started.

[rmcdaniel]

Security final tree/history/release-notes PASS for exact head 1256a0451b239c93dbd036bbcb4b9fc81f40dbb0 (tree 2c7bc5ca15569ef55fde969a945e0fd8a769bbf6).

I independently verified:

• the head is a normal merge of the previously reviewed release branch 87d826752a0e74f1f9026c650d4d3f8d27214671 with accepted combined source main 51f92f4100c569710c7f12fab878f2f6b030b550;
• relative to accepted main, the entire change is exactly docs/releases/3.9.1.md plus the one-line docker-compose.published.yml default from 3.9.0 to 3.9.1. No runtime, schema, workflow, credential, build or publication logic differs;
• the old and refreshed release patches are byte-identical, SHA-256 8492e449e9ffe8de177059d9fac72347b4656b140f1e7742b2a7f706110bd223; the diff is whitespace-clean;
• no 3.9.1 tag exists, so no immutable release identity has been reused.

The notes accurately describe the combined unchanged-schema correction:

• 3.9.0→3.9.1 needs no schema step; 3.8.x→3.9.1 still requires the documented additive dw_command_intents upgrade and backup-only rollback;
• legacy raw-key readback remains explicitly intent_verified:false, changed target/name refuses, ambiguous raw/token/collation matches fail closed and nonretryable, and no retry external reference is claimed;
• bounded pre-auth discard retains the typed 413 within the documented 64 MiB/two-second ceiling, while larger/stalled inputs may still see transport failure;
• the advertised positive completion cap is the full encoded workflow/continuation-completion body budget, separate from per-value limits and from upload/reference authority;
• continuation command values stay inline and cannot reuse result-bound upload authority;
• shared Adopt Workflow 2.2.10 timestamp repairs #228 explicitly remains open for exact published Server plus installed PHP/Python/Rust within/over-limit acceptance. Source tests and small fan-out do not claim delivery;
• storage draining still does not grant completion-upload allowance; Chart 1.7.0 remains a post-image-qualification handoff; Corpus-b flake: large-command-batches overflow polls exhaust PHP reference lock-pressure retries #1194/MariaDB held activity poll can time out worker re-registration in native tests #1204 and next-schema Report bounded schedule dispatch summaries for Waterline refresh #1200 remain outside this release.

This closes Security's final source/tree/history review only. Merge requires every current-head required check to finish green. After exact-head merge, tag/publication must still bind the accepted merge, pass immutable multi-platform image/corpus/Compose/SBOM/scans and protected alias gates, and obtain exact tag/image/Release readback. Do not close shared #228 or promote downstream cohorts from source evidence alone. Any head/tree/notes change requires counter-review.

[rmcdaniel]

Update / HOLD: the preceding exact-head review is now superseded for final release purposes. The owner identified that 1256a045… keeps #1194/#1204 only in the PR work record, while the tagged notes themselves mention shared #228 but do not explicitly preserve the separate pool-timeout/non-closure limitation. A notes-only successor is in progress.

Do not merge, tag or publish 1256a045… on the basis of the preceding PASS. Its accepted runtime/Compose parent and byte-identical release patch remain useful evidence, but the forthcoming exact head/tree and amended tagged notes require counter-review and fresh required checks.

[rmcdaniel]

Final notes successor df0503a, tree34a4e2ffbdb15e565dfecf36bc968190cdf7dd71: exactly9 lines added to1256a045 to keep #1194/#1204 limitations explicit in the tagged notes, not only the PR record. Runtime and Compose are unchanged. Entire own diff vs accepted combined main51f92f41 remains exactly the notes plus Compose default; current patch SHA2563b328832a4a72be33d6337041fce254e210d94768659bcff448f7bf516efe795. Fresh exact-head CI and final Security review gate tag/publication. No3.9.1 tag has been created.

[rmcdaniel]

Security final tree/history/release-notes PASS for the corrected exact head df0503ae03880de1add82d40f8526a17f30bc727 (tree 34a4e2ffbdb15e565dfecf36bc968190cdf7dd71). This supersedes the held 1256a045… disposition above.

The only successor delta is nine lines in docs/releases/3.9.1.md. They accurately preserve two separate open gates:

• Corpus-b flake: large-command-batches overflow polls exhaust PHP reference lock-pressure retries #1194 is the PHP-reference 20-run / large-command-batch lock-pressure corpus gate; source/native-image checks do not close it;
• MariaDB held activity poll can time out worker re-registration in native tests #1204 is the intermittent MariaDB held-poll worker re-registration pool-timeout investigation; 3.9.1 claims no underlying fix;
• incomplete or infrastructure-blocked controls are explicitly not counted as passing qualification.

Runtime, schema, workflows and Compose are byte-identical to the prior reviewed head. Relative to accepted combined source main 51f92f4100c569710c7f12fab878f2f6b030b550, the entire own diff remains exactly the two release files: the one-line Compose default and the 3.9.1 notes. The final patch SHA-256 is 3b328832a4a72be33d6337041fce254e210d94768659bcff448f7bf516efe795; it is whitespace-clean. No 3.9.1 tag exists.

All other findings and release conditions in the preceding review remain unchanged, including shared #228 installed-worker acceptance and the separation of upload/reference authority. This closes Security's final source/tree/history review for df0503ae… only. Merge still requires every fresh current-head check to finish green; exact tag/image/corpus/Compose/SBOM/scan/alias/GitHub Release readback remains mandatory after merge. Any further head/tree/notes change requires counter-review.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Final Security gate confirmation: exact reviewed head df0503ae03880de1add82d40f8526a17f30bc727 is now terminal with 21 successful checks, 8 intended skips, zero failures, and zero pending jobs; GitHub reports the merge state clean. The source/tree/notes verdict remains the exact-head PASS above. Normal merge is eligible at this unchanged head.

This is not publication acceptance. After merge, retain the stated immutable tag/image/corpus/Compose/SBOM/scan/rolling-alias/GitHub Release readbacks, keep #1194/#1204 separate, and require shared #228 installed-worker qualification against the actual published tuple. Any head/tree/notes change reopens exact review.

[rmcdaniel]

Merged through the normal queue as 7d7ad9d6c9aee2e4592d74389ba9efd36e741f44. The actual merged tree is exactly Security-reviewed 34a4e2ffbdb15e565dfecf36bc968190cdf7dd71, includes accepted combined source 51f92f41, and is byte-identical to final reviewed head df0503ae. All 21 final PR checks passed with eight intended skips; the queue's required checks passed. The merged remote release branch is deleted and absence verified.

Created immutable tag 3.9.1 on that accepted merge commit after verifying the tag was absent and rerunning the native release-tag/refusal controls. Publication has started in native-release run 43423285947. No rolling alias or final GitHub Release has moved. 3.9.0 remains held and unchanged.

Owner server continues both-architecture exact publication/scans, then fresh exact-index corpus and four-cell published Compose qualification, protected alias promotion and final Release readback. SDK/CLI/Sample/docs/Cloud handoffs require the actual qualified version/source/index/platform tuple. Shared #228 installed within/over-cap worker proof, #1194's 20-run gate and #1204 reliability work remain separately open. #1012 SBOM generation remains unwired and is not claimed by this patch.

[rmcdaniel]

Immutable 3.9.1 publication 43423285947 is successful, including both architecture build/smoke jobs, common index/provenance verification and per-child scans. Source remains 7d7ad9d6c9aee2e4592d74389ba9efd36e741f44.

Read-back index: sha256:946c65eb70e8b4b7c4694be8a181c9669d46c3408b80d4e44d96f2030ea3cf51; linux/amd64 child sha256:b0f2bf2a37e8b229282362acb26d9ed511596ebdd366ea4e53bd9f16008a356e; linux/arm64 child sha256:2400a252f7877e3f4876ca96486b9c740bfab47e4d5184fdf3657a2d3a045c3a. These are the actual new image identities, not a qualification result by themselves.

Fresh exact-tag/index Compose 43425106728 passed all four architecture/profile cells. Corpus 43425102353 is still running. Owner server will select the exact receipt artifacts/current attempts only after it succeeds, obtain independent published evidence review, then use protected alias promotion and final Release. Aliases remain unchanged and SDK installed #216/#228 acceptance is not inferred. Chart #1199 is refreshed on the accepted source with corrected 3.9.1 default; its exact-head checks/review and OCI delivery are separate gates.

[rmcdaniel]

Independent Security publication/scan receipt: artifact PASS; final promotion still held for native 3.9.1.

Read back from the public registries and exact publication run 43423285947:

• annotated tag 3.9.1 peels to accepted source 7d7ad9d6c9aee2e4592d74389ba9efd36e741f44, tree 34a4e2ffbdb15e565dfecf36bc968190cdf7dd71;
• GHCR and Docker Hub raw OCI index bytes both hash to sha256:946c65eb70e8b4b7c4694be8a181c9669d46c3408b80d4e44d96f2030ea3cf51;
• the index has exactly linux/amd64 child sha256:b0f2bf2a37e8b229282362acb26d9ed511596ebdd366ea4e53bd9f16008a356e and linux/arm64 child sha256:2400a252f7877e3f4876ca96486b9c740bfab47e4d5184fdf3657a2d3a045c3a;
• both child configs label release tag 3.9.1, run 43423285947, revision 7d7ad9d6…, the expected source repository, and run as 1000:1000; their architecture fields match their index entries;
• the publication workflow is terminal success for both digest-only builds, same-architecture smokes, index tagging/verification, both registry provenance attestations, and both published-child scans.

I downloaded and inspected both scan receipts. Each names its exact child digest/platform, Debian 12.15, pinned Trivy 0.76.1 image sha256:790fd66d…, and the same DB update. Their normalized HIGH/CRITICAL finding sets are identical (sha256:cc19ec6d…) and their recorded advisory fingerprint is sha256:d5e5d391…: 1 critical, 34 high, 11 advisory IDs, 0 actionable/fixed-version rows. No platform divergence or digest mismatch is present.

This passes the immutable published image and scan inventory only. Keep aliases/final GitHub Release and downstream installed #228 acceptance held until the exact-tag corpus, complete five-receipt manifest/current Compose qualification, and final release readback succeed. SBOM #1012 remains unwired/unclaimed, as stated; #1194/#1204 remain separate.

[rmcdaniel]

The exact published-image corpus 43425102353/a1 and all four Compose cells 43425106728/a1 are now successful, with five canonical promotion-receipt artifacts present. Security independently passed the actual two-registry index/children/source/run labels and scan inventories in comment 6852977535.

The tag's read-only manifest builder selected the following exact current attempts, workflow blobs, job/artifact IDs and archive digests. Workflow evidence string SHA-256 (excluding terminal newline): e7bd4179d361b9451b08b2b346e38d98883cfe2273ce2bc7893f3f4fbbad717b.

{"compose":{"cells":[{"artifact_digest":"sha256:de5cb23166daf926efae4df2e0cc1ebe9301408a473dfb86c8ad4405b4093b6b","artifact_id":14036375968,"job_id":131884512364,"platform":"linux/amd64","profile":"local"},{"artifact_digest":"sha256:72f6de4f25d9d147b5660e7c5dace9fb5d52abf1406e2b2c3a43a59563ace7b5","artifact_id":14036430864,"job_id":131884512477,"platform":"linux/amd64","profile":"production"},{"artifact_digest":"sha256:4b9bfd89b4ca1cd6943c686f4bfdef6eb50a4f2e3195ca451f8d4638e6bd64bb","artifact_id":14035832218,"job_id":131884512002,"platform":"linux/arm64","profile":"local"},{"artifact_digest":"sha256:624faf5bb0cf51c92ad7ab7c3567380e895b04f3ac3abe19270ba48111f8e546","artifact_id":14037056115,"job_id":131884513597,"platform":"linux/arm64","profile":"production"}],"run_attempt":1,"run_id":43425106728,"runner_commit":"7d7ad9d6c9aee2e4592d74389ba9efd36e741f44","workflow_blob":"09082357d57e7c95746d2f815715bb91414cf112"},"corpus":{"artifact_digest":"sha256:f8ce8750af97b520e171783bf055313ebe46e9c6e2d737f683165c672ae100bc","artifact_id":14038437232,"run_attempt":1,"run_id":43425102353,"runner_commit":"7d7ad9d6c9aee2e4592d74389ba9efd36e741f44","workflow_blob":"5130b55602951940869d215bee8a08c2dc9722d3"},"release":{"index_digest":"sha256:946c65eb70e8b4b7c4694be8a181c9669d46c3408b80d4e44d96f2030ea3cf51","run_attempt":1,"run_id":43423285947,"source_commit":"7d7ad9d6c9aee2e4592d74389ba9efd36e741f44","tag":"3.9.1"},"schema":"durable-workflow.native-alias-promotion-evidence.v1"}

This selection is reviewable metadata, not a substitute for archive verification. Owner server requests Security's bounded final evidence countercheck, then uses the tag's protected alias workflow, which verifies the five archives/provider/provenance without writes and repeats under the mutation lock before any alias update. Final GitHub Release will use this identical evidence and independently check live aliases. No alias/Release mutation has started yet; 3.9.0 remains held. SDK/CLI/Sample/docs/Cloud handoffs retain their exact published tuple and installed acceptance boundaries; #216/#228/#1194/#1204 are not closed by this record.

[rmcdaniel]

Security final qualification-evidence countercheck: PASS for the exact manifest in comment 6853287663.

The JSON is 1,486 bytes excluding its terminal display newline and hashes to e7bd4179d361b9451b08b2b346e38d98883cfe2273ce2bc7893f3f4fbbad717b. It closes over release run 43423285947/a1, corpus 43425102353/a1, Compose 43425106728/a1, source/tag 7d7ad9d6c9aee2e4592d74389ba9efd36e741f44 / 3.9.1, and index sha256:946c65eb70e8b4b7c4694be8a181c9669d46c3408b80d4e44d96f2030ea3cf51.

Independent checks:

• all three selected runs are terminal success on the exact tag/source and current attempt 1; corpus workflow blob 5130b556... and Compose blob 09082357... equal the tagged sources;
• the selected corpus artifact and four Compose artifacts are present, unexpired, have the exact IDs/names/provider digests in the manifest, and map to the exact successful corpus or {amd64,arm64} x {local,production} job IDs;
• I downloaded all five provider archives in memory and independently rehashed their complete ZIP bytes to f8ce8750..., de5cb231..., 72f6de4f..., 4b9bfd89..., and 624faf5b.... Each contains only canonical receipt.json;
• every receipt is eligible schema v2 and binds repository ID 1208272134, tag/source/index, runner ref, workflow blob/path, run/attempt/job, requested digest, exact platform/profile child and config, and a zero-container/network/volume verified cleanup;
• all four Compose receipts report ready/healthy, loopback binding, worker registration and release-version match; both production cells prove default-token and unset-token refusal; local cells prove unset-token refusal without claiming the production-only default check;
• the corpus receipt records zero comparison/native/reference/service/schedule/retention discrepancies. The two architecture subjects and pinned MySQL/QEMU dependency identities agree across the receipt set and with the independently reviewed publication/scan identities.

Finally, I ran the tagged source's own native_alias_promote.py plan and full read-only verify against this exact evidence. Both passed. The verifier re-read current provider attempts/jobs/artifacts, archive contents, provenance, both registries' index/children/config labels, final-tag identity, source-on-main ancestry, and absence of a pre-existing final GitHub Release. Its canonical output selected exactly these five artifact IDs and the previously passed two platform subjects.

Security approves this exact evidence string/tag for the repository's protected native-alias promotion workflow. That workflow must repeat the same verification after environment approval and under durable-workflow-server-rolling-aliases before its bounded write. Any source, attempt, job, artifact, digest or evidence-byte change requires a new review; an uncertain/partial write is not an automatic retry.

The final GitHub Release remains a separate post-alias check using identical evidence and live-alias readback. No installed SDK acceptance or closure of #216/#228/#1194/#1204 is inferred, and the unwired SBOM claim remains excluded.

[rmcdaniel]

Security post-promotion readback: PASS for the exact Server 3.9.1 rolling aliases produced by run 43428195557 at source 7d7ad9d6c9aee2e4592d74389ba9efd36e741f44.

I independently checked the protected run, its jobs/steps, the immutable tag ref and the live public registries:

• Dispatch, evidence verification and the environment-locked promotion job all completed successfully. The privileged step repeated the approved qualification before writing and reported exactly 3.9, 3, and latest.
• The run used the already-approved evidence manifest: release 43423285947/a1, corpus 43425102353/a1, Compose 43425106728/a1, and exact index sha256:946c65eb70e8b4b7c4694be8a181c9669d46c3408b80d4e44d96f2030ea3cf51.
• Fresh anonymous readback with an empty Docker configuration resolves all six public aliases to that exact index:
  • ghcr.io/durable-workflow/server:{3.9,3,latest}
  • docker.io/durableworkflow/server:{3.9,3,latest}
• The immutable 3.9.1 Git tag still resolves to the approved source commit.

This closes the rolling-alias mutation/readback gate. It does not by itself create or approve the GitHub Release: no 3.9.1 Release existed at this readback, so Release creation plus its final public metadata/asset/source/alias countercheck remain a separate gate. SDK/CLI/Sample/Cloud installed acceptance also remains owner-controlled and is not inferred here.

[rmcdaniel]

Security final publication/readback: PASS for Server 3.9.1.

Independent checks after protected run 43428882154 completed:

• Public GitHub Release 444228334 is published, non-draft, non-prerelease, titled/tagged 3.9.1, and is the GitHub Latest Release.
• The immutable Git tag still resolves exactly to approved source 7d7ad9d6c9aee2e4592d74389ba9efd36e741f44.
• The Release identity table exactly records that source, release run 43423285947, and image index sha256:946c65eb70e8b4b7c4694be8a181c9669d46c3408b80d4e44d96f2030ea3cf51 in both registries.
• Reconstructing the protected writer's immutable relative-link rendering produces a body byte-equivalent to the public Release body after its documented trailing-whitespace normalization. The notes are therefore the exact tagged docs/releases/3.9.1.md, not later main content.
• Fresh anonymous reads with an empty Docker configuration resolve all eight public subjects—both registries' 3.9.1, 3.9, 3, and latest—to the exact qualified index above.
• The Release has no attached assets, matching this workflow's current declared scope. This does not claim the separately unwired SBOM work.

This closes the Server 3.9.1 native publication gate for the reviewed source, images, rolling aliases, and GitHub Release. It does not close #228/#216 installed SDK/CLI acceptance, Cloud production adoption, Chart/OCI publication, #1194, #1204, or SBOM follow-through; those remain separate owner gates.

[rmcdaniel]

Docs handoff is active in root draft #535. Final 3.9.1 Release and successful protected promotion/release at 7d7ad9d6 are verified. The draft covers the required 3.8→3.9 schema-upgrade/rollback path, published #607 correction, explicit encoded completion-cap discovery and bounded 413 transport behavior, retaining existing byte guards and per-SDK acceptance limits.

Owner durable-workflow-github-io: finish all seven translations/source hashes, independent semantic/source review, exact qualified artifact selection, normal checks and protected deployment/all-locale live verification. The English prototype is public for review; no final build PASS is claimed yet.

Concrete selection dependency: the existing root artifact contract requires selected Server to equal the qualified Helm appVersion. Chart1.6 is qualified with Server3.8, so the manifest stays unchanged until Server #1199 supplies Chart1.7's actual OCI manifest digest, package digest, source and qualification URL. Server confirmed it owns the active queue/publication. No guessed identity or pairing-rule relaxation is proposed. Installed SDK #228/#216 and Cloud acceptance remain with their current owners.

[rmcdaniel]

Final native 3.9.1 publication is complete: public stable/Latest GitHub Release, immutable tag/source 7d7ad9d6c9aee2e4592d74389ba9efd36e741f44. Protected publication/scans 43423285947, corpus 43425102353, four-cell Compose 43425106728, alias promotion 43428195557 and final Release 43428882154 succeeded. Security independently approved the exact artifact/scan, five-receipt manifest, locked promotion and final public readback (comments 6852977535, 6853373077, 6853517811, 6853650971).

Both registries' immutable 3.9.1 and rolling 3.9/3/latest references resolve to sha256:946c65eb70e8b4b7c4694be8a181c9669d46c3408b80d4e44d96f2030ea3cf51; amd64 child sha256:b0f2bf2a37e8b229282362acb26d9ed511596ebdd366ea4e53bd9f16008a356e, arm64 child sha256:2400a252f7877e3f4876ca96486b9c740bfab47e4d5184fdf3657a2d3a045c3a. The public Release identity table and immutably rendered tagged notes match exactly; empty assets are expected and claim no SBOM. Merged source/release remote branches were deleted and absence verified.

Chart 1.7.0/app3.9.1 subsequently published through #1199. Downstream installed completion/key cohorts remain separately recorded on shared #228/#216. Their discovered Unicode-key/fresh-metadata gaps are owned by #1207 for a new immutable patch; this completed release is not rewritten. #1194 separately completed its full 20-execution gate; #1204 remains open and unfixed. Cloud adoption and remaining storage/poll-capacity acceptance remain separate.