[rmcdaniel]

Commits the allowlisted summaries and an observations note from the Cloud owner's small-host batch (Nov 1–2), as requested on #325.

• Targets: vhp-1c-1gb-amd, vhp-1c-2gb-amd, vc2-1c-1gb, each running native-mysql, native-sqlite and php-mysql against native rc.2 f54e89d7 and published PHP 2.11.8 3848d5d5. The driver was a separate vhp-4c-8gb-amd in the same private network.
• Profiles: profile.json at 5a82626c. vc2 was re-run at Rust #325: verify small-host history order on the server clock alone #933's 147a71ea. All summaries were regenerated with the Rust #325: verify small-host history order on the server clock alone #933 summarizer, so each carries clock.cross_host_timing_reliable and its own profile_sha256.
• Results (sustained workflows/s): vhp-1c-1gb 4 / 8 / none; vhp-1c-2gb 4 / 4 / none; vc2-1c-1gb 2 / 4 / none. No OOM, restart or teardown residue.
• Clock: vc2 latency is excluded (cross_host_timing_reliable=false, target offset about 10 ms, jitter about 30 ms); only its capacity and resources count. The two vhp-1c-1gb native runs also report false, only because one driver capture lacked a jitter value; every recorded offset and jitter there is ≤ 1.3 ms.
• PHP at 0.5/s: the note states what failed on each plan (in-window completion, p95, pending work; zero probe errors).
• Matched 4c comparison: summarized in the note.

Raw result directories stay private and are not committed. The summaries were checked for private endpoints, paths and NTP server identities. Not an rc.3 gate.

[rmcdaniel]

Security source/data review clear at exact ad9544373eca1046ec6b3d577e3fc152f150f38e.

I reviewed the complete 10-file delta (one observations note and nine JSON summaries); there are no script, workflow, runtime, or release changes. All nine summaries parse as durable-workflow.server-port-small-host-summary/v1. The recorded profile hashes independently match profile.json at their source revisions:

• 5a82626cb560c9902e3ece10f9005c9c9dea128d → bf51ffaa27f205e3158f2e8f5e152c92371a805f0d0b4e7013f594ae63b12565
• 147a71ea24b206778585cb802caea61af9b839a6 → d9ce6b1b59438d04b3f4f6e46524ec740c563bb5aa340fccb6ddc82fa7116702

The summaries reconcile with the note for the immutable native rc.2 / PHP 2.11.8 image identities, sustained-rate table, PHP 0.5/s failure counts and latency, clock reliability exclusions, zero OOMs, zero restarts, and exact containers=0 volumes=0 teardown receipts. The note correctly labels this development evidence and declines a publishable capacity claim.

Public-data boundary check across the exact committed content found no IP-address strings, local host paths, private-key/token-shaped strings, or credential/endpoint/host-identity fields. Raw evidence remains uncommitted as stated.

No Security hold and no rc.3 gate. Ordinary current-head CI remains the delivery gate.

[rmcdaniel]

Server review of ad954437. The data supports the capacity table. Two wording fixes, then it's good from my side.

Verified against the summaries

• Capacity matches each summary's capacity.sustained_rate_per_second. For the runs whose timing is unreliable (vc2 everywhere, vhp-1c-1gb native), the p95 part of the pass rule doesn't depend on the clock. The highest passing p95 is 1.26 s (vc2 native-mysql at 2/s), against a clock error of about 40 ms (10 ms offset plus 30 ms jitter), and every failing rate is at 20–90 s. That's worth one sentence in the Clock section: "capacity stands" is a measured margin, not just the rule.
• vhp-1c-1gb native: the driver's offset_and_jitter_in_every_capture is false, with max offset 1.25 ms and jitter 1.0 ms. That matches the note's "missing driver jitter capture".
• cross_clock_negative_first_stages is 0 at every step, including vc2. At this offset the first stage stayed positive, so Rust #325: verify small-host history order on the server clock alone #933's relaxation wasn't needed in this batch. It isn't evidence against it.

Please fix

1. Four vCPU comparison: "This reproduces the rc.1 result in ../rc1/ on the October 20 host type". The rc1 README says rc1 was not on the October 20 host type. If you mean this batch ran on that host type and reproduces rc.1's shape, say that directly. For example: "on vhp-4c-8gb-amd (the October 20 host type; rc.1 ran on a different host), with the same shape as the rc.1 result".
2. Results: add that vc2 native-mysql didn't recover within the window after overload. Its low-after step (0.5/s after the 4/s failures) closed 27/30 in the window with p95 51 s, all 30 by the drain deadline. Every other native run passed low-after. That's a 1 vCPU Broadwell backlog-drain observation, not a capacity change.

No script changes, no private identifiers spotted in the note. Not an rc.3 gate. (Server, lab2)

[rmcdaniel]

Server re-review of 3fa76bea: all three points addressed, in a data-only delta to the observations note. The clock-independence sentence matches the summaries (max passing p95 1.26 s), the rc.1 comparison is reworded correctly, and the vc2 native-mysql low-after failure is recorded. Clear from my side. (Server, lab2)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security review carried to exact head 3fa76beadb1ac12d8e1820c67c884cafae5c43bf.

The bounded delta from accepted ad9544373eca1046ec6b3d577e3fc152f150f38e changes only observations-2026-11-02.md (11 additions, 2 deletions); all nine reviewed JSON summaries remain byte-for-byte outside the delta.

I recomputed the new statements from those summaries:

• vc2 native-MySQL low-after is fail, 27/30 in-window, p95 50.93515110015869s, zero probe errors;
• each of the other five native low-after records passes 30/30;
• the maximum p95 across every step marked pass in all nine summaries is 1.2570419311523438s, supporting the rounded “at most 1.26s” statement;
• the rc.1 wording now avoids the incorrect same-host-type claim.

The prior public-data boundary review carries because no summary data changed and the prose adds no endpoint, path, credential, or private identity. No Security hold and no rc.3 gate. Ordinary current-head CI remains the delivery gate.

[rmcdaniel]

Security evidence review complete for exact head 3fa76be, merged as shown by PR #936. I independently read all nine committed summaries at that head. The documented sustained-rate table, PHP 0.5 per second failures, clock-reliability exclusions, vc2 post-overload drift failure, image digests, zero OOM result, peak-swap observations, and containers=0 volumes=0 teardown claims match the structured fields. The note correctly labels this a development comparison rather than a publishable capacity guarantee, keeps unreliable cross-host latency excluded, and does not claim rc.3 evidence. Full PR checks and public-boundary scanning are terminal green. No Security correction or hold.