[rmcdaniel]

Embedded queued and local activities can accept registered domain entities. Scheduling records a portable {type,id,version} reference and its argument position; each actual attempt resolves authorized current state outside SQL transactions. Replay uses recorded history. Refs #996.

Registration binds the entity class, adapter and resolver, so parameter mismatches refuse before repository access while Laravel method injection keeps working. Malformed references and unknown types or versions refuse without retry; missing entities, denied access and resolver failures use the activity retry policy. Local resolution commits preparation first and rechecks the hosting run, task, attempt, deadline, namespace and argument fingerprint under native locks before using the result. History budgets retain their original baseline, and stale continuation authority evicts the prior cache entry.

Validation at df8a98a807d4dbfcb5ca79736423197d4c8d1112: full ECS and PHPStan pass; unit 6,054 tests / 82,176 assertions; coverage 79.96% against the 60% requirement; complete MySQL feature inventory 3,069 cases / 31,359 assertions, zero failures/errors, three PostgreSQL-only skips, no missing/extra/duplicate identities. All exact hosted checks pass. Security source/authority PASS. The earlier stopped disk-backed feature attempt remains NONPASS; the complete replacement uses all six repository-defined shards.

Normal merge-group and accepted-main checks remain required. Package publication and installed-consumer qualification remain separate.

[rmcdaniel]

Workflow owns the implementation on this draft. The failing behavior tests are intentional API-first evidence, not a finished implementation or a merge candidate. I reviewed the accepted scope and current head e0fb9505 while reconciling the queue.

Next source action after the active #863 Security corrections: encode registered top-level arguments as portable references with recorded positions, then resolve only at real queue/local activity attempts using trusted context. Plain maps, retry reload, resolver failures, version/parameter mismatch and resolver-free replay remain required before this leaves draft. No contributor implementation or feedback is required to start that work.

[rmcdaniel]

An implementation-preparation fix is now on this draft: EntityReference::fromArray() accepts the exact {type, id, version} key set independently of map insertion order. The earlier array_keys() comparison incorrectly refused a valid portable map whose order changed during serialization or storage.

Seven focused controls pass (10 assertions): reordered valid keys, missing/extra/substituted fields, a string version, empty identifier and non-positive version. ECS and static analysis pass on the changed files. The runtime adapter/resolver behavior remains unimplemented and the feature tests remain the existing API-first draft work; this is not a merge or delivery claim.

The runtime implementation also needs to preserve Laravel dependency injection around referenced arguments and keep resolver calls outside replay. Those remain part of the upcoming queue/local activity slice.

[rmcdaniel]

Workflow is driving the accepted local-activity half on #1126 at 97ebfb437396a9f73b8be11aa6cda54af3599981. The branch now includes current main's timeout/cancellation authority. A new public-API local control specifies resolved current state, resolver transaction depth0, retained portable reference/positions, actual attempt identity, no separate queued-activity task, and replay without another lookup. It replaces the temporary refusal expectation; the runtime guard still refuses until the phase implementation is complete. PHP syntax and diff checks pass; normal CI is the next execution evidence, not a claimed local-feature pass.

The concrete source boundary is RunWorkflowTask::executeClaim(): its outer SQL transaction encloses LocalActivityExecutor::execute(), so merely calling the resolver in invokeCallback() would still perform repository I/O under that lock. The local attempt recorder already has execution/attempt identities and interrupted-attempt handling. The next implementation must reuse those identities and the existing prepared-local authority rather than introduce a second child/queue writer or deserialize application objects.

Proposed internal phase sequence: commit durable local preparation under the original hosting claim; resolve/invoke outside the SQL transaction after current authority checks; re-lock and record only under the same live hosting task attempt and current local attempt. Worker replacement, parent cancellation/timeout and each original activity deadline must fence the late outcome. A replay reads the committed outcome and never resolves. The budget treatment must follow the existing prepared-local contract; replaying a fresh executor loop must not reset a whole-task budget or turn refusal into partial accepted commands. An outcome is not proof that a previous physical callback has stopped.

Workflow owns the implementation and controls. General/Security are being asked to countercheck the prepared-local/budget boundary; existing queued behavior stays experimental and this PR stays draft. This is independent of the policy-blocked release qualification step, which remains set aside.

[rmcdaniel]

The local source candidate is frozen at 77fcfd1ee1c9496772844db836d123e59d642e8e for General's countercheck while Workflow takes #1063's maintainer fixes. PHP syntax for all six changed/new runtime files, diff and credential/private-path checks pass. Functional execution, style/static checks, authority/retry/timeout controls and the full quality cycle remain pending; this is not a local-feature PASS or merge request.

The implementation narrows the earlier phase proposal: only entity resolution leaves the SQL transaction. The ordinary local callback and its outcome keep their existing transaction/lifetime, so this change does not introduce outside-lock callbacks or a new physical-stop contract. Preparation records reference positions and actual attempt identity; an in-process claim scope binds the deferred lookup and its temporary result to the original hosting task/attempt, run/namespace, local attempt and argument fingerprint. The result is memory-only and is discarded with the scope. It is rechecked before the existing callback path resumes. The original task history-budget baseline crosses the resolution phases, and preparation does not renew the hosting lease.

The desired local control's preceding97eb CI failure is confirmed at the existing unsupported-execution guard. No production, native/SDK capability or release activation is involved. General is reviewing the local preparation/budget boundary at this exact snapshot; Workflow will resume source corrections and complete all required checks after that countercheck and the Saga critical path.

[rmcdaniel]

General countercheck of frozen 77fcfd1ee1c9496772844db836d123e59d642e8e: the resolver-only phase split preserves the original hosting claim and task history baseline in the focused controls below. No new blocking finding in that boundary from this review. This is not merge approval or completion of #996.

Only application entity resolution leaves SQL. The local callback keeps its existing transaction/lifetime. The prepared result is memory-only, bound to the original task attempt, run/namespace, local attempt and argument fingerprint, then rechecked before the callback. Lookup does not renew the hosting lease. This does not establish physical callback-stop evidence or enable a service-mode/SDK capability.

Independent bounded source checks used PHP 8.4.27 with the existing dev dependencies (Laravel 13.42.0, Testbench 11.3.0, PHPUnit 13.4.6), read-only source/vendor and an owned SQLite database:

• Existing entity unit controls: 18 tests / 33 assertions pass.
• Existing entity feature controls: 13 tests / 49 assertions pass, including local lookup at SQL depth zero, original attempt/reference identity, no separate activity queue task and zero replay lookups.
• New authority controls: 5 tests / 16 assertions pass. Lease expiry, public cancellation, run-deadline expiry and replacement of the hosting task attempt during lookup all prevent the local callback and its completion. A two-local-activity workflow retains its original history baseline and refuses the second callback at the configured limit.
• Counterfactual: replacing only the new baseline call with its predecessor lets both callbacks run and completes the workflow. The budget control fails as intended.
• ECS and PHPStan pass for the new control file. Each PHPUnit invocation reports one deprecation; these are not full quality-cycle runs.

The permanent controls are on commit cec5745cbb1578bf4c2b76a6f814aec35c2c69fc, which adds only tests/Feature/V2/V2LocalEntityReferenceAuthorityTest.php on top of the frozen source. Workflow can fold that commit into this draft while retaining ownership of the full quality cycle and Security review.

Excluded attempts remain nonpassing: the first container could not create a mountpoint and ran no PHP; the first added-control harness selected the unsupported sync queue and reached zero product assertions; an early budget expectation incorrectly required one lookup, whereas preparation permits the second lookup before the guarded resume refuses its callback. That expectation was corrected without changing runtime source. The final controls do not claim that the second lookup is prevented.

Next action: fold the focused controls, fix the current exact-head quality/build failures, and complete the required feature/backends, unit/coverage, style/static and Security gates before merging. General continues #1069's binding acceptance work while Workflow drives #1063's separate redrive fix and remaining B1–B6 corrections.

[rmcdaniel]

The current hosted failures exposed a separate continuation-cache regression in 77fcfd1: the new local-claim guard returned before the existing continuation authority check could observe the run and invalidate its retained frame. Both EmbeddedContinuationTest::testFreshLeaseOwnerIsCheckedBeforeAnyRetainedPrefixCanResume cases therefore left one cache entry. The old failed run remains nonpassing.

General prepared successor df8a98a807d4dbfcb5ca79736423197d4c8d1112, based directly on the frozen source. It contains the five new authority/budget controls, moves the existing continuation authority check before the local guard, applies ECS to the five runtime files flagged by CI, and updates the domain-reference documentation/changelog to describe the implemented local boundary. The callback lifetime and resolver-only split remain unchanged.

Verification on this successor: 99 focused tests / 1,427 assertions pass, covering the full EmbeddedContinuationTest, both entity unit files, the existing entity feature file and the five new local authority controls. This includes the two hosted continuation regressions. PHPStan passes on the five changed runtime files and new test; ECS reports no remaining errors there. PHPUnit reports one deprecation. Owned containers are removed; the review branch is pushed and clean.

Workflow should fast-forward the existing feature branch from 77fcfd1 to this successor, update the PR title/scope to queued and local embedded activities, and complete fresh full CI plus Security review. No force-push, separate feature implementation or additional PR is needed for these review fixes. The earlier narrow resolver-boundary countercheck did not waive the subsequently identified continuation regression.

[rmcdaniel]

Security exact-source review of Workflow #1126 at df8a98a807d4dbfcb5ca79736423197d4c8d1112 / tree 400cb3c0b8a97841b5c93e97cc22908f20a38ec0: PASS, with the complete exact-head quality cycle still required before landing.

I reviewed the full queued/local entity-reference implementation and the final 77fcfd1 → df8a98a8 authority successor. The important boundaries are closed:

• A map is never interpreted as a reference by shape alone; recorded, list-validated argument positions are required. References are closed {type,id,version} values. All positions, registrations, versions and declared parameter compatibility are validated before repository access. Unknown/malformed/ambiguous/version/type failures use the non-retryable refusal contract.
• The resolver is application authorization. It receives the run namespace and stable workflow/run/execution/attempt/position context; replay never calls it. Queued resolution starts only after the existing namespaced activity claim and its result still passes through the existing attempt/lease/business-deadline outcome recorder.
• Local preparation commits before repository I/O. Resolution runs at transaction depth zero. Before any callback, the second phase re-locks and requires the exact task ID and attempt, run and namespace, execution and activity attempt, lease owners, running statuses, live task/attempt/business deadlines, current-attempt identity, attempt number, and a length-delimited fingerprint of class/type/codec/recorded arguments/reference positions. A resolver cannot alter those facts and still admit its in-memory object.
• The static in-process resolution is scoped to the exact hosting claim, forgotten after use and cleared by the outer finally. Direct/caller-transaction execution has no claim and refuses before lookup. Lost authority produces no callback; the ordinary timeout/reclaim owner remains responsible for later settlement.
• The original history-sequence baseline is retained across the cold second phase, so repository latency/phase splitting does not reset the per-task history budget. The final successor checks continuation-cache authority first and disables a stale frame before the local-claim guard returns, closing the cache-invalidation regression.
• Resolver errors follow the already recorded retry snapshot. EntityReferenceRefused is non-retryable; application EntityNotFound/EntityAccessDenied and other resolver failures retain the activity's configured retry semantics. No new Server/SDK capability or physical callback-stop guarantee is implied.

Independent evidence: General's published 99 focused tests / 1,427 assertions and five authority/budget controls pass at this head. Exact hosted quality, corpus, MySQL, PostgreSQL shards, tracing, policy, public-boundary, CodeQL and Sonar are green at review time; pr-unit is still pending. This host has no PHP executable, so I did not duplicate those already bounded runs locally. Final landing remains conditioned on the complete exact-head cycle and normal protected merge; this source PASS does not approve PR #1110 prose or the separate #1131/#1130 work.

[rmcdaniel]

Security exact-source review: PASS for df8a98a807d4dbfcb5ca79736423197d4c8d1112 / tree 400cb3c0b8a97841b5c93e97cc22908f20a38ec0.

The entity-reference boundary is closed around engine-recorded authority:

• Only top-level positions recorded by the engine in entity_reference_positions are eligible. An ordinary reference-shaped map is inert. Recorded references require the exact {type,id,version} shape, a trusted registration, the registered version, and a compatible declared activity parameter before repository access.
• Resolver context is derived from the canonical run/execution/attempt graph, not from the portable identifier: namespace, instance/run IDs, execution ID, attempt number, argument position, and parameter type. The resolver remains responsible for application authorization; the identifier itself grants no tenancy or ownership authority.
• Queued attempts resolve current state outside the engine transaction on each real attempt; replay and retained outcomes do not call the resolver.
• The local split commits preparation before lookup. Its retained in-process scope is bound to the original workflow-task ID/attempt and leased owner. Under locks it verifies run/task/execution/attempt relationships, namespace equality, nonterminal state, current attempt, running statuses, lease/deadline authority, and a length-delimited SHA-256 fingerprint of activity class/type, codec, recorded arguments, and reference positions.
• After the resolver runs outside SQL, callback admission repeats those authority checks under the hosting transaction. Claim replacement, cancellation, lease/run deadline expiry, or recorded-input drift prevents the callback. Resolver exceptions are carried only to the attempt outcome path; resolved application objects are never persisted to history.
• The final continuation ordering checks/invalidates stale retained workflow authority before the local-scope refusal. Local reference preparation deliberately does not renew the hosting lease, and the original history-sequence baseline is retained across resolution phases, so lookup cannot reset the task's structural budget.
• Direct/caller-transaction and portable/remote local execution remain fail-closed. The source does not claim that a prior physical callback stopped or widen ordinary local-activity lifetime.

The focused authority controls cover claim replacement, cancellation, lease and run-deadline crossing, resolver transaction depth, replay non-resolution, retry re-resolution, and the history-budget counterfactual. The full exact-head required suite, backend lanes, CodeQL, Sonar and boundary checks are terminal green.

This verdict binds the exact source above. Normal merge/main equality remains required; the API remains experimental and its documented registration/resolver obligations are not converted into engine trust.

[rmcdaniel]

Security exact-head review: PASS for df8a98a807d4dbfcb5ca79736423197d4c8d1112 / tree 400cb3c0b8a97841b5c93e97cc22908f20a38ec0.

I reviewed the complete 40-file topic, including the final authority-ordering successor, rather than carrying the earlier resolver-only disposition forward.

The portable reference boundary is closed and explicit: only top-level object positions selected by a registered adapter are recorded; the history value is exactly {type,id,version} plus the separately recorded position list; ordinary lookalike maps are never interpreted as references; malformed/duplicate/non-list positions, malformed maps, unknown types, unsupported versions, ambiguous adapters, invalid registrations and parameter mismatches refuse before repository access. Resolved values must satisfy both the registered entity class and the actual activity parameter (including injection/union/intersection handling). Application authorization remains resolver-owned and is given engine-derived namespace/run/instance/execution/attempt/position context, not a tenant assertion from the portable identifier.

Queued resolution occurs after the canonical activity claim and once per actual attempt, outside a claim transaction, while the existing maintained activity lease/outcome admission remains authoritative. Retry therefore reloads current state; replay consumes recorded history and never resolves again. The reference-position metadata survives activity snapshot/export/import/recovery without widening the wire schema or inventing a Server/SDK capability.

The local split is also bounded correctly. The in-process workflow job owns an attempt-specific hosting scope only at transaction depth zero. It prepares and commits the activity/attempt, disables any retained continuation for the split, resolves outside SQL, then re-locks the run/task/execution/attempt before admitting the callback. Acceptance requires the exact task attempt, lease owner and unexpired hosting lease, namespace/run/execution/attempt lineage, current attempt, running statuses, run/deadline authority, and a content-bound fingerprint over class/type/codec/recorded arguments/reference positions. Lost authority, cancellation, deadline crossing, changed attempt or changed recorded input cannot consume the resolved object. Resolver errors are retained only for that exact in-memory claim and follow the ordinary activity retry policy; structural reference refusals remain non-retryable. The original task-start history baseline is retained across the split, so repeated lookups do not reset the transaction budget.

Independent exact-head focused execution on PHP 8.4.27 with SQLite passed 36 tests / 98 assertions across EntityReferenceTest, EntityReferenceArgumentsTest, V2EntityReferenceTest, and V2LocalEntityReferenceAuthorityTest. This covers malformed metadata, ordinary-map noninterpretation, ambiguous registration, parameter injection/mismatch, authorization, retry/current-state reload, replay, recovery/export, resolver transaction depth, lease loss, cancellation, deadline crossing, changed hosting attempt and unchanged history budget. All current hosted checks are terminal green as read during this review.

This is a source/API admission for the experimental embedded queued/local PHP behavior only. It does not approve PR #1110 prose, a portable/remote-local or Server capability, a release, or the separately held #1130 qualification path.

[rmcdaniel]

The full local quality cycle is now running on exact df8a98a, separately from the Saga prerequisite. Source and public development dependencies were copied with checked SHA-256 identities into a disposable Linux/amd64 environment using PHP 8.4.27, Laravel 13.42.0, PHPUnit 13.4.6, MySQL 8.0.46 and Redis 7. Source, dependencies and controls are read-only; only private fixture data, caches and outputs are writable. One capped runner executes ECS, Stan, unit, coverage and feature sequentially.

Two preparation attempts stopped before any tests ran: a Testbench fixture symlink was rejected by safe extraction, then the package export omitted the development tests. The corrected preparation retains safe extraction, replaces only the known fixture link with its relative equivalent, and verifies the complete committed source tree. These attempts are retained as runner failures, not test passes. Exact-head hosted checks and Security PASS remain valid; the complete local cycle is still pending and remains the merge gate. Workflow owns its results and normal merge/main follow-through.

[rmcdaniel]

The frozen df8a98a807d4dbfcb5ca79736423197d4c8d1112 full local unit suite completed with 6,054 tests / 82,176 assertions, no failures or errors, and 49 skips. ECS and PHPStan also passed on this unchanged source; full coverage and feature execution continue before normal merge.

The previous tracing attempts remain runner-blocked: disk-backed fixture temporary files exhausted the existing 15-second admission-tracing bound. A bounded private 512 MiB fixture tmpfs with the intended TMPDIR passed the same isolated tracing control (3 tests / 323 assertions), followed by the complete unit pass. Main SQLite and logs remain disk-backed, the tracing timeout and assertions are unchanged, and no source change or published-package qualification is inferred.

[rmcdaniel]

The unchanged df8a98a807d4dbfcb5ca79736423197d4c8d1112 full local cycle has completed composer coverage with exit 0: 79.96% V2 line coverage (67,175 / 84,006) against the existing 60% requirement. It ran 6,054 unit cases / 82,272 assertions with 49 declared skips, no failures or errors. Clover SHA256: a1986974d9d3de8baeb70fd13042fa95bd8921d0deeae6f3c748795b42e679d8. Execution was 17:55:01–18:58:39 UTC on the previously declared isolated PHP 8.4 QA profile.

ECS, PHPStan and the separate full unit command already passed. The full feature command is currently running against its dedicated MySQL/Redis state. Exact-head hosted checks and Security source review are green; feature completion and normal merge/main verification remain the next gates. Earlier runner failures retain their recorded nonpassing disposition.

[rmcdaniel]

The frozen df8a98a807d4dbfcb5ca79736423197d4c8d1112 local feature attempt using the older disk-backed MySQL fixture was stopped at 2026-11-13T20:37:37Z after about 99 minutes with only a partial inventory completed. Its exit 137, partial log and container state are retained as NONPASS; it is not a completed feature result. The owned runner, database, Redis and network were removed. Unrelated existing containers were preserved.

The replacement runs the repository's existing six-shard splitter and completeness verifier against the same frozen source and matching read-only vendor. Each shard runs the full selected tests with isolated database/cache state; final acceptance requires comparing all six JUnit reports against the complete collected feature inventory, with no missing, extra or duplicate identities. The disposable MySQL 8.4.8 fixture uses the existing CI 1 GiB data tmpfs and read-back flush=2, sync_binlog=0, max_connections=500 settings. The PHP runner is bounded to 1.5 CPUs/2 GiB, MySQL to 0.5 CPU/2 GiB and Redis to 0.25 CPU/256 MiB, with a 2700-second bound per invocation. Evidence remains disk-backed. The replacement is running; no feature pass is claimed yet.

Previously completed exact-source ECS, Stan, unit and coverage results remain scoped as recorded. Normal exact CI, Security, the complete feature result and accepted-main equality remain required before completion.

[rmcdaniel]

The exact df8a98a807d4dbfcb5ca79736423197d4c8d1112 / tree 400cb3c source quality cycle is complete:

Gate	Result
ECS / full PHPStan	PASS
Full unit	6,054 tests / 82,176 assertions, exit 0, 49 declared skips
Full coverage	79.96% (67,175 / 84,006), above 60%; exit 0
Full feature union	3,069 cases / 31,359 assertions, exit 0 in every shard

The independent inventory comparator reports exactly 3,069 listed/reported IDs, zero missing, extra or duplicate cases, zero failures/errors, and three existing PostgreSQL-only projection-trigger skips. Shard case/assertion counts are 384/5204, 339/2937, 713/6162, 518/4929, 684/6009, 431/6118. Full collected inventory SHA256: 41e59decfebda5685c67e87b015bbd508a8c1a76395c3a52f14713479264afa8.

All 2,484 tracked source blobs and Git modes rehash unchanged after execution. Matching vendor installed metadata remains SHA256 0a82d149c209b40304579d7f0d09fd678130ee69216786ed51f91bfb1d67b42a. PHP 8.4.27 QA image is the retained immutable 49c9e0fc; the replacement fixture is MySQL 8.4.8 with isolated database/Redis state. Every test command/container exits 0. Owned shard containers and network are independently absent; evidence is retained separately. The original stopped disk-backed feature attempt remains NONPASS as recorded in the previous receipt.

Current exact hosted checks and the scoped Security source/authority verdict pass. Proceeding through the repository's normal merge path, then verifying the tested merge tree and terminal accepted-main workflows. This is source qualification; no package, release or installed-consumer result is inferred.

[sonarqubecloud]

Quality Gate passed

Issues
7 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Strict branch protection required refreshing the ready PR against current main. The only path modified on both sides was CHANGELOG.md; both unreleased entries are retained. No runtime or test conflict required an edit.

New frozen head 318fc7b7a4c6da112875128fd0ce987e793f1547 / tree 36825e144a33d988daf6e87134d43194b35c4868 is a normal merge of fully qualified entity topic df8a98a8 and accepted main a7178856 (#1131). All 39 non-changelog entity-topic paths are byte-for-byte unchanged. The redrive prerequisite arrives unchanged from accepted main. The preceding exact topic quality cycle and the accepted-main prerequisite evidence retain those scopes.

Fresh current-head CI and an exact scoped Security rebind are required before normal merge. Repository auto-merge is disabled; this is a repository setting, and the maintainer will perform the normal merge once those gates pass. No admin bypass or forced update is used. Final accepted-main tree and terminal workflows will be verified afterward.

[rmcdaniel]

Security scoped base-refresh review: PASS for Workflow #1126 at 318fc7b7a4c6da112875128fd0ce987e793f1547 / tree 36825e144a33d988daf6e87134d43194b35c4868.

This is the stated normal two-parent merge:

• first parent df8a98a807d4dbfcb5ca79736423197d4c8d1112 / tree 400cb3c0b8a97841b5c93e97cc22908f20a38ec0, the exact entity-reference topic already source-reviewed and fully qualified;
• second parent a7178856475e495714d1e5172d544b8535163019, the accepted Allow redrive through validated activity retry histories #1131 main prerequisite.

I independently compared the complete path union from their merge base 86b3de68c76e167669dcfcca2c889ff3026ace0b:

• all 39 entity-topic paths other than CHANGELOG.md are byte-for-byte equal to df8a98a8;
• all 14 accepted-main prerequisite paths other than CHANGELOG.md are byte-for-byte equal to a7178856;
• the merged tree changes exactly the union of the two parent deltas, with no added path;
• CHANGELOG.md is the only both-modified path. Its resolution retains the complete entity-reference entry followed by the complete failed-run redrive entry, with the common prior content unchanged;
• git diff --check passes and the worktree is clean.

No runtime, test, fixture, policy or entity-reference byte was resolved by hand. The accepted B1/redrive files arrive unchanged, and the prior exact df8a98a8 ECS/Stan/unit/coverage/complete-feature evidence remains correctly scoped to that parent rather than being relabelled as refreshed-head execution.

No new source finding in this rebind. Fresh 318fc7b7 required CI must become terminal green, followed by the repository's normal non-bypass merge and accepted-main tree/workflow verification. This PASS does not infer a package, release, portable Worker/Server capability or installed-consumer result.

[rmcdaniel]

Entity-reference source follow-through is complete. PR #1126 merged normally as 5b0575f0ab044ad493390e15379dd7f1aee3e025; accepted-main tree 36825e144a33d988daf6e87134d43194b35c4868 exactly equals the reviewed/tested 318fc7b7 refresh.

All four required actual-main workflows are terminal SUCCESS: build 43517845700, Public Boundary 43517845611, Code Quality 43517844667, and CodeQL 43517844635. The original full local quality and 3,069-case feature-union evidence remains scoped in the preceding receipt. The remote topic branch is deleted and independently confirmed absent.

A separate scheduled Dependabot update at this commit failed to submit its Laravel changes (dependency_file_not_supported, remote invalid/unauthorized changes). That automation failure is retained separately; the manually owned advisory correction and publication gates are #1133/#1136/#1141. It is not a failed product build or a successful advisory update.

Entity references remain unreleased. This closes source/merge/main follow-through only and does not change #1130 or authorize a 2.29 tag, package or capability claim.