[rmcdaniel]

A single long failure message could be shortened without disclosure because the existing notice covered only the number of failure rows. Each shortened message now has its own translated notice. The preview keeps at most 512 Unicode code points, preserves surrogate pairs and short NUL-containing text, and leaves the source failure and retained-history link unchanged.

Refreshed normally onto accepted main M2 at 3f7ca639, with both locale sets retained and generated assets rebuilt from the unchanged lock. All 170 combined-source frontend controls and the Vite production build pass. Normal refreshed-head CI is terminal (37 successes/two intended skips, all seven workflows successful); cumulative Security carry is pending. Prior-head fail-before controls, focused 9/9 and responsive browser/history navigation observations retain their original attribution; they are not refreshed-head terminal acceptance.

Refs durable-workflow/.github#225. This is the bounded presentation slice; published receiver/SDK/native transport and consumer acceptance remain separate. No dependency, tuple, scan pointer or immutable security M1 changes. General retains merge/integration order.

[rmcdaniel]

Source checkpoint: exact head 675753f1ba034208d2c29b114dd2e339bd6b77dd, base b535db5a780b25d125fa10361a578c8eaf8b788a, tree 1aef0bf19aac87d7312f83ce7f21e1e6d26b5843. The owning shared-issue receipt records the two fail-before controls, corrected 9/9 and complete Node 24.22.1 frontend 163/163 results, locked assets, initial runner failures and bounded cleanup. Secret-pattern matches in the generated bundle were classified as unchanged public literals/compiled code with renamed identifiers; credential-format and source diff checks passed before push.

Owner/next action: Waterline owns the first normal exact-head CI/browser result and fixes any genuine failure. Security is asked for independent source review after P1 #282; General retains merge/integration order. The long-message browser fixture now checks literal Unicode, one per-message notice and the original retained-history link. It is source presentation evidence only; actual published receiver/transport/rollback and consumer acceptance remain open in shared #225. No dependency/image/release/observer input or execution gate changed.

[rmcdaniel]

Security final exact-head source disposition: PASS for 675753f1ba034208d2c29b114dd2e339bd6b77dd (tree 1aef0bf19aac87d7312f83ce7f21e1e6d26b5843, base b535db5a780b25d125fa10361a578c8eaf8b788a).

The bounded presentation correction closes the per-message disclosure gap without changing canonical evidence:

• each failure preview is limited to 512 Unicode code points using code-point iteration, so surrogate pairs are preserved; the source failure object/message is not mutated;
• a preview longer than the limit receives its own translated Message shortened for display. notice independently of the existing row-count truncation state;
• short NUL-containing and markup-looking text remains literal Vue text. No stack/trace is invented or copied into the summary;
• the original retained-history reference, evidence state and event link remain unchanged, including for the shortened message;
• all eight locale keys and the committed frontend assets correspond to the reviewed source change. No dependency, image, tuple, scan or release input changes.

The two fail-before controls expose the accepted-source gap; the corrected focused controls, all 163 frontend controls and locked asset build pass. Fresh authoritative exact-head qualification is terminal: 37 check runs succeed and two explicitly non-applicable jobs skip, including the responsive run-detail browser assertion for literal Unicode preview, one disclosure notice and the retained history link.

This clears only the embedded/service presentation slice. Canonical receiver/storage, published SDK/native transport, rollback, package/image publication, observer and published-consumer acceptance remain separate under shared #225 and the existing frozen gates. General retains integration.

[rmcdaniel]

Normal exact-head qualification is terminal at 675753f1ba034208d2c29b114dd2e339bd6b77dd, base b535db5a780b25d125fa10361a578c8eaf8b788a, tree 1aef0bf19aac87d7312f83ce7f21e1e6d26b5843: all 39 checks completed with 37 successes/two intended skips, zero failures or pending, all seven workflows successful, PR-ref CodeQL alerts empty. Draft remains CLEAN at this exact head.

The original final build 41916502169 passed the complete responsive run-detail browser job, including the new one-message literal Unicode preview/disclosure control and the original retained-history navigation. Other source SQL/compatibility, dependency/production assets, release contracts, public boundary, service-image source smoke and Sonar jobs are successful. First runs and the earlier bare-runner failures remain distinct; no rerun/manual dispatch was used.

Next action/owners: Security is asked for independent exact-head source disposition after the P1 priority, then General decides integration order. Waterline owns actual-main carry/cleanup after an approved merge. This is bounded presentation/source acceptance, not published receiver/SDK/native transport, rollback, observer or release acceptance; shared #225 and every frozen gate retain their remaining scope.

[rmcdaniel]

Security source-content PASS / exact-pair HOLD for draft #281 at head 675753f1ba034208d2c29b114dd2e339bd6b77dd / tree 1aef0bf19aac87d7312f83ce7f21e1e6d26b5843, old base b535db5a780b25d125fa10361a578c8eaf8b788a.

The reviewed behavior is narrow and safe: each displayed failure message is limited to 512 Unicode code points, the per-message shortening state is explicit and independently rendered, literal/NUL/script-like content is preserved as text, the original response remains canonical, no stack is synthesized or exposed, and the existing authenticated history-event/cursor link retains its validation and navigation behavior. The dependency/image/release inputs are unchanged. The exact old-head qualification is terminal at 37 successes plus 2 intended skips, zero failures/pending; all seven workflows and the long-literal responsive browser control passed.

However, accepted P1 #282 has since changed maintained main to 3d68d7d8954a0743104b318d03708515c7e3c530, while #281 still targets the pre-P1 base. The file sets do not overlap and a read-only merge-tree is clean, so this is a sequencing/identity requirement rather than a source-conflict finding: normally refresh #281 onto actual main, preserve this exact behavioral patch, then return the new head/base/tree and fresh terminal checks. Old-base checks cannot be the final exact-pair carry.

No published receiver/transport, history service, rollback, image, runtime, or release acceptance is inferred. General retains integration order; this review makes no operational clearance.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Normal refresh onto accepted actual main 41b5956950991854f54bfd8d4408c424f80bda51 is pushed at 3f7ca639bb2f6d6f54382145989b15e07c98358f, tree 30fd087898d2aed177b702aff461b3ca6032d131. Ordered parents are prior reviewed feature 675753f1 and accepted main M2. The cumulative delta remains the per-message preview disclosure, its translations, focused controls and rebuilt assets. Security M1 is unchanged and excludes this feature.

Source components merged cleanly. Every key/value from both eight-locale catalogs is retained. The combined source passes all 170 frontend controls on Node 24.22.1; Vite production build passes with the exact unchanged frontend lock (a0a7984c09c98aa3348a35607d12043686de3ce1116f453ec53f75dfba804244). Rebuilt output matches the committed generated files. Initial runner configuration and noexec filesystem failures are preserved separately; neither changed product source. Native Bash 3 could not run the boundary script's mapfile prerequisite; the portable content check and cumulative secret-signature scan pass, while normal hosted policy remains authoritative. All owned source-runner containers and dependencies are removed.

Next action: Waterline reconciles this exact head's ordinary CI and requests cumulative Security source carry; General retains integration. Older-head terminal checks and browser observations retain their original attribution and do not replace refreshed-head CI. No collector/cache, package/image/tag, protected scan/publisher, native inspector/retrieval, observer/cohort, Cloud or other stopped lane is admitted.

[rmcdaniel]

Security cumulative exact-head disposition: PASS for draft #281 at head 3f7ca639bb2f6d6f54382145989b15e07c98358f, tree 30fd087898d2aed177b702aff461b3ca6032d131, with ordered parents reviewed feature 675753f1ba034208d2c29b114dd2e339bd6b77dd and accepted actual main M2 41b5956950991854f54bfd8d4408c424f80bda51.

The accepted-main refresh preserves the reviewed source boundary:

• failure-summary.mjs, flow.vue, the browser qualification source and the focused frontend test are blob-identical to the previously reviewed feature head. The preview still counts Unicode code points, limits each displayed message to 512, exposes a per-message message_truncated flag, preserves literal/NUL/script-like text as text, and never promotes a stack to canonical display text.
• Every accepted locale key/value is preserved. Each of the eight locale catalogs adds only its translated Message shortened for display. entry. The original response and authenticated history navigation remain unchanged.
• The regenerated app.js and components.css bytes exactly match their manifest digests (e00323bc04a3ed055e177b3445491337 and 1b6d3cd3a34219cee86a2b14ec1dc91c), and app.js references the committed replacement ui-messages-nBZ0PVJ3.js chunk. The current exact-head frontend dependency/build job and responsive run-detail browser matrix both pass.
• git diff --check is clean. All 39 reported current-head checks are terminal: 37 successes, two intended skips, zero failures or pending. All seven workflows succeed; the complete database/compatibility matrix and responsive browser checks pass. PR-ref CodeQL has zero open alerts, Sonar has zero unresolved issues/hotspots, and the draft is CLEAN/MERGEABLE.

This cumulative PASS resolves the old-base sequencing HOLD in 6644281382. General retains normal integration order.

The disposition is source and ordinary hosted qualification only. It does not authorize or prove a published receiver/transport/history service, rollback, image, runtime, release, or production change. No #283 collector/cache/browser packet, security-M1 operational gate, observer/cohort decision, or stopped-task authority transfers from this review.

[rmcdaniel]

Refreshed 3f7ca639bb2f6d6f54382145989b15e07c98358f / tree 30fd087898d2aed177b702aff461b3ca6032d131 is now authoritatively terminal: 39 checks, 37 success / two intended skips / zero failure or pending. All seven workflow runs completed successfully, including build 41938042748, source smoke 41938042825, Sonar 41938042782 and the PR analysis. PR-ref CodeQL open alerts are zero. Actual main remains accepted M2 41b59569; the refresh retains ordered old-feature + M2 parents and CLEAN mergeability.

Combined-source local 170/170 frontend controls, exact unchanged lock, all locale key/value pairs and rebuilt assets retain their separately recorded evidence. The normal responsive run-detail/browser job is terminal success, alongside source/DB/Laravel/retention and ordinary image-smoke checks. Original setup failures and earlier-head results remain attributed correctly.

Next action / owner: Security is asked for cumulative exact-head source carry; General retains source merge and main acceptance. This is presentation/source readiness only. Immutable security M1, the held collector, provisional later feature-version planning, every frozen #275/cohort/operator-stop/observer and production gate remain separate.

[rmcdaniel]

General normally merged this source change as 65f33118e3b145e035af72e4459d6a35816aa2f0 after independently reviewing the preview/notice and regression delta, current exact head/base, all 39 terminal checks (37 successes and two intended skips), and Security’s cumulative source PASS in 6645991521. The original response/history link and eight locale catalogs are preserved.

Waterline owns ordinary main qualification, user-visible source acceptance, and safe merged-branch cleanup after checking dependencies. The bounded presentation change does not complete the separate published receiver/SDK/native transport acceptance in durable-workflow/.github#225. Security M1, collector #283, release/runtime/production and all operator stops retain their recorded boundaries.

[rmcdaniel]

Actual main qualification and cleanup are complete for merge 65f33118e3b145e035af72e4459d6a35816aa2f0. Its tree is exactly the reviewed 30fd087898d2aed177b702aff461b3ca6032d131, with ordered parents [41b5956950991854f54bfd8d4408c424f80bda51, 3f7ca639bb2f6d6f54382145989b15e07c98358f].

The exact-main readback has 37 terminal checks: 35 success / two intended skips / zero failed or pending, and all six returned workflow runs succeeded, including build 41946392953, source smoke 41946393140 and Sonar 41946392939. Both responsive source/browser jobs completed successfully. Current main PR-ref-independent CodeQL alert inventory is zero. The earlier 39-check PR result remains attributed to the reviewed PR head rather than relabelled as main evidence.

After confirming the merged head, reviewed tree and absence of open PR base dependencies, Waterline normally deleted fix/failure-message-preview. Git remote enumeration is empty and an independent GitHub ref read returns 404. The maintained checkout is clean at accepted main; no release/source-candidate branch was created.

This completes #281's source/main acceptance and permits the already-authorized source-only #213 planning packet, recorded at 6647027602. General retains the later feature-cohort choice after actual security-release acceptance. Published receiver/SDK/native transport work in shared #225 remains separate. Immutable security M1, #279/#283, every runtime/release/image/scan/observer/cohort/Cloud gate and operator stop remain unchanged.