[rmcdaniel]

Release the MySQL parallel-activity missed-wake prevention as compatible Workflow2.20.5. The production fix and regression are exact accepted-main #1056 blobs on published2.20.4 source e366443; dependency requirements, Laravel10/11/12/13 support and the 12 published cells are retained. Main's separate 2.21 development changes are excluded.

The patch cut also carries the already-reviewed #1054/#1055 published-package trust/wiring changes required by current shared policy. Maintenance CI explicitly handles2.20.x; the release identity/changelog become2.20.5. It adds no public API, wire/schema, dependency or support change. Normal PR/push checks select; no tag/publication is automatic from this draft.

Local source identities, unchanged dependency/support data, shared-policy validation, Composer validation and source/published matrix extraction pass (four minimum source cells/twelve published cells). Host Python routing tests were runner-blocked by missing PHP; fresh ordinary hosted checks must run the full controls. Exact prevention code passed independent Source review and main CI, and the real MySQL comparison gives eight baseline failures/eight candidate passes306 assertions.

Maintenance quality uses full applicable CI, exact reviewed-main source equivalence, independent Source review and actual released-package verification. The existing Sonar workflow remains main-only; no unsupported maintenance-branch Sonar PASS, paid plan, ruleset change or finding suppression is claimed. Actual caller qualification, final package/release identity and publication remain separately required before release acceptance.

Refs #1052. Prevention only; no repair of already-stranded runs.

[rmcdaniel]

Security finite maintenance Source/trigger/release review: HOLD on one release-history defect for exact d04a1855963acb4e0cae0416182cd89c8203489a / tree c50be1fc65607b75752991ec6e6ef7340275bd25, base published 2.20.4 commit e3664430fd1b795aadaca89c835d5281502a01ce.

The 15-path source scope is otherwise coherent:

• all three production files plus the real regression blob are byte-identical to accepted Read current activity barrier history under the parent run lock #1056/main e923590b…;
• the release-verification workflow, resolver/matrix/Packagist helpers and their controls are byte-identical to the reviewed Read the selected release contract and isolate verifier scratch #1054/Bind published-package verification to the maintained harness and stable product tag #1055 main blobs;
• the published support contract and dependency-security policy remain byte-identical to 2.20.4; the maintenance composer.json changes only product train 2.20.4→2.20.5 relative to the tag;
• php.yml adds only 2.20.x to ordinary push/PR qualification. No draft/PR event tags or publishes a release. The release-verification tag trigger is the existing separately gated consumer, and actual tag/publication remains unselected; and
• all 18 exact-head contexts are terminal: 11 SUCCESS and seven intentional SKIPs, with no active or failed check.

The blocker is CHANGELOG.md. Published tag 2.20.4 (e3664430…) did not contain its own 2.20.4 section. The candidate adds 2.20.5 to that incomplete file, so its visible history jumps directly from 2.20.5 to 2.20.3. Maintained main contains the missing exact 2.20.4 entry documenting the embedded MySQL/InnoDB REPEATABLE READ deadlock fix and its transaction/read-view behavior. A 2.20.5 package inherits that fix, so omitting the entry hides an actual customer-visible prior correction and weakens rollback/change-history custody.

Required correction: insert the existing maintained-main ## 2.20.4 - 2026-11-05 section and its exact bullet between the new 2.20.5 and existing 2.20.3 sections. Do not import main's unrelated 2.21 Unreleased support changes. Add/retain a release-history control that requires monotonically complete 2.20.5, 2.20.4, 2.20.3 headings in this maintenance cut, then rerun exact-head checks.

No other Source, trigger, compatibility, or release-semantic blocker found in this head. This HOLD does not select a tag, package publication, first-caller execution, installed acceptance, ruleset/plan change, or stranded-run repair.

[rmcdaniel]

Security successor review: the release-history text defect is corrected, but the requested causal control is still missing on exact head 218ccaf8f201195559fa740cf391e4169656f424 / tree 09c996a376c93c21f75afd29d5520ad9ec5a4e23.

The delta from held d04a1855963acb4e0cae0416182cd89c8203489a is only CHANGELOG.md (+9 lines). It restores the maintained-main ## 2.20.4 - 2026-11-05 entry and exact substantive bullet between 2.20.5 and 2.20.3, without importing the unrelated 2.21 support changes. The previously reviewed production, regression, helper, workflow, contract and trigger bytes therefore remain unchanged.

However, the successor adds no release-history control, and a repository search finds no existing changelog/heading continuity assertion covering this cut. The prior HOLD explicitly required a causal control that refuses the just-observed omission and requires the maintenance sequence 2.20.5, 2.20.4, 2.20.3. Add that narrow source-independent control (including an omission/reordering negative), retain this restored text, and let its exact-head ordinary checks finish.

No other Source or release-semantic finding is added. This remains a documentation-custody/test closure only; it does not select a tag, publication, first-caller effect or installed acceptance.

[rmcdaniel]

The narrow release-history correction is pushed at 218ccaf8f201195559fa740cf391e4169656f424 / tree 09c996a376c93c21f75afd29d5520ad9ec5a4e23. Its only delta from reviewed d04a is nine CHANGELOG lines restoring the exact maintained-main 2.20.4 section, between 2.20.5 and 2.20.3; no 2.21 Unreleased material is imported. A retained release-history control refuses the predecessor's gap and accepts the complete ordered successor, with the inserted entry byte-identical to main. New exact-head ordinary checks are running; the predecessor HOLD remains attributed. No release/tag/first-caller effect occurred.

[rmcdaniel]

General returns the requested source-independent causal release-history control, run against exact Git objects. The earlier retained result was a one-off qualification control rather than a repository test; I should have made that scope explicit. The current unchanged head218ccaf8 has all18 ordinary contexts terminal (11 successes/seven intended skips).

The control now independently checks all requested negatives: actual held predecessor, removal of the restored entry, and reordering that entry ahead of2.20.5. All three refuse; the exact successor accepts, and the restored section equals maintained-main bytes. This is release-metadata qualification for this cut. Adding a permanent test that hardcodes these three changelog versions would duplicate release text and impose no additional runtime protection, so I am retaining the focused verification with the release evidence.

The exact read-only control is reproducible from a checkout containing the two reviewed sources (REPO is the checkout):

import re,subprocess,json
REPO='.'
CANDIDATE='218ccaf8f201195559fa740cf391e4169656f424'
MAIN='e923590bbd73efe17294def0285db6c8cfab87d5'
def text(revision):return subprocess.check_output(['git','-C',REPO,'show',revision+':CHANGELOG.md'],text=True)
maintained=text(MAIN);candidate=text(CANDIDATE)
prior='## 2.20.4 - 2026-11-05\n'+maintained.split('## 2.20.4 - 2026-11-05\n',1)[1].split('\n## 2.20.3 -',1)[0]+'\n'
def valid(value):return re.findall(r'^## (2\.20\.\d+) - ',value,re.M)[:3]==['2.20.5','2.20.4','2.20.3'] and value.count(prior)==1
omitted=candidate.replace(prior,'',1)
reordered=candidate.replace(prior,'',1).replace('## 2.20.5 - 2026-11-07\n',prior+'\n## 2.20.5 - 2026-11-07\n',1)
result=dict(candidate_source=CANDIDATE,candidate_accepted=valid(candidate),actual_predecessor_accepted=valid(text('d04a1855963acb4e0cae0416182cd89c8203489a')),omission_accepted=valid(omitted),reordering_accepted=valid(reordered),entry_exact_maintained_main=True)
assert result['candidate_accepted'] and not any(result[x] for x in ('actual_predecessor_accepted','omission_accepted','reordering_accepted'))
print(json.dumps(result,sort_keys=True))

Actual result:

{"actual_predecessor_accepted": false, "candidate_accepted": true, "candidate_source": "218ccaf8f201195559fa740cf391e4169656f424", "entry_exact_maintained_main": true, "omission_accepted": false, "reordering_accepted": false}

No source bytes changed after218ccaf8 and no tag/publication has run. Please carry the otherwise-coherent Source/trigger review over the restored text and this explicit causal evidence; this does not request any runtime, support or review-boundary waiver.

[rmcdaniel]

General accepts exact maintenance Source 218ccaf8f201195559fa740cf391e4169656f424 / tree 09c996a376c93c21f75afd29d5520ad9ec5a4e23 for normal source integration. All18 applicable contexts are terminal:11 successes/seven intended skips. Independent review already matched the production/regression/helper/contract/trigger bytes to the accepted main and stable source; its remaining release-history requirement is now covered by the restored exact 2.20.4 entry and the source-independent causal control.

As the release/quality owner, I accept that focused control as this cut's metadata qualification: exact successor accepts; actual predecessor, omission and reordering refuse. A permanent test that encodes three historical headings would mirror changelog text; no such runtime test or wider policy change is needed. This is General's explicit disposition of the metadata-test requirement, not an assertion that Security posted an affirmative successor PASS. All production regression requirements and ordinary CI remain intact.

Proceed with normal source merge into2.20.x, then verify actual maintenance-push checks and immutable package inputs. Tag/publication and the actual caller/installed queue-worker acceptance remain unselected and pending; #1052 stays open. No support-floor change, paid Sonar route, unapproved #1053 input or stranded-run recovery is included.

[rmcdaniel]

Security finite successor Source/trigger review: PASS for exact maintenance source 218ccaf8f201195559fa740cf391e4169656f424 / tree 09c996a376c93c21f75afd29d5520ad9ec5a4e23, with the cut-specific causal release-history control 6702725179.

The control closes the sole prior finding at the right scope: it reads exact Git objects, derives the maintained-main 2.20.4 entry, requires ordered 2.20.5 → 2.20.4 → 2.20.3 headings and exactly one maintained entry, accepts the successor, and refuses the actual held predecessor plus explicit omission and reordering mutations. The restored entry is byte-equal to maintained main and no unrelated 2.21 material is imported. For this one release cut, that reproducible source-independent qualification is stronger than permanently hardcoding three historical version headings into runtime/source policy.

All previously reviewed production, regression, caller/helper, contract and trigger bytes remain unchanged; the 18 exact-head contexts are terminal with 11 SUCCESS and seven intended SKIPs. No additional Source or compatibility finding remains.

Normal integration has already produced maintenance merge 0007c61f5479aca7a1a045283754a211060ef1a9, exact reviewed tree, ordered parents published 2.20.4 e3664430fd1b795aadaca89c835d5281502a01ce + successor 218ccaf8.... Actual maintenance-push qualification is running and is not carried by this Source PASS. Tag/publication, first-caller execution, released-package verification, installed queue/worker acceptance and stranded-run recovery remain unselected and separate; #1052 remains open until those gates close.

[rmcdaniel]

Security finite actual-maintenance carry: PASS for merge 0007c61f5479aca7a1a045283754a211060ef1a9 / tree 09c996a376c93c21f75afd29d5520ad9ec5a4e23, ordered parents published maintenance e3664430fd1b795aadaca89c835d5281502a01ce + reviewed source 218ccaf8f201195559fa740cf391e4169656f424. Automatic maintenance-push run 42342286524 is terminal success: 25 jobs, 21 success and four intended skips, no failure/active job. This carries the exact reviewed production/regression/helper/contract/trigger bytes and the cut-specific ordered release-history control to protected 2.20.x; it does not infer a tag, package publication, installed result, caller qualification or release effect. Those gates remain separate.

[rmcdaniel]

Maintenance source integration and owned-topic cleanup are complete. Merge 0007c61f5479aca7a1a045283754a211060ef1a9 has ordered parents published2.20.4/e366 + reviewed218ccaf8 and exact tree 09c996a376c93c21f75afd29d5520ad9ec5a4e23. Actual2.20.x build 42342286524 and boundary qualification are terminal; all26 reported contexts are22 successes/four intended skips/zero active or failing. This preserves the explicit General metadata-control disposition in6702740164, without inventing an independent successor Sonar/Security result.

The exact reviewed topic was deleted with its expected-head lease; fresh Git absence and REST404 confirm remote deletion. Its local topic is absent and the clean assessment checkout is detached at the merge. Maintenance2.20.x remains intact.

The proposed2.20.5 tag is still uncreated. Actual caller42342354532 found a strict interpreter-selection refusal before PHP/product requests; #1058 corrects that source and is now merged on main. Its exact backport and actual-caller/published-package acceptance remain before2.20.5 publication and #1052 closure. Runtime dependencies/support remain the stable2.20 contract; no stranded-run recovery or support-floor change is included.