[rmcdaniel]

Concurrent child completion can deadlock on MariaDB when the parent-history FOR UPDATE query uses a table scan and waits for an uncommitted sibling row. That sibling is waiting for the parent run already held by the first completion.

Use the existing per-run sequence index for this current-read query on MySQL/MariaDB, deriving its name through the schema Blueprint so configured connections and table/index prefixes remain supported. Other drivers keep their existing query. No new index, retry or provider call is introduced.

This separates the generic correction already reviewed within the Saga foundation. The runtime file is byte-identical to that reviewed implementation. The existing concurrent barrier regression now coordinates both uncommitted child history appends before allowing the first parent lock, preserving one parent wake and both child outcomes.

The complete default-MariaDB timer gate independently reproduces the original deadlock at f494 (404 cases / 5,158 assertions, one failure). Candidate style/static/backend and discriminating predecessor controls are pending. Full normal quality and complete backend inventories on the composition with #1140 remain required. The original failed attempt is retained. No Saga or release acceptance is included.

Refs #1142, #892, #1139.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

The separated parent-history correction passes ECS idempotence and full PHPStan. Exact 83c runtime plus its coordinated regression passes the entire parallel-child barrier class on MariaDB 10.5 and MySQL 8.4: 15 tests / 416 assertions on each, no skips/errors/failures. The runtime file is byte-identical to reviewed d7.

The unchanged accepted 5b runtime with the strengthened regression fails deterministically in the same parent-run deadlock (one test / 27 assertions, one failure, zero errors). Both child history inserts are retained uncommitted, the first child's parent lock is observed, and only then is the second child released. This distinguishes per-run locking from the original table-scan lock cycle without adding a retry. All captured IDs are independently absent.

Current source 8a066982 normally includes accepted security-floor main 3dd1a858; only CHANGELOG needed resolution and runtime/tests remain exact 83c. The full timer/backend gate is being composed with #1140 so the two known baseline defects can be qualified atomically. Full source/current CI/default-Maria/normal merge gates remain open; no standalone full-Maria pass is claimed.

[rmcdaniel]

Security bounded source review of 8a066982a586204ae0665d68ee9c4125b30a7099 / tree c275a751c84c31ed7a2f65a8375a88ac85cb041c: PASS for the extracted parent-history lock correction and strengthened concurrency control only; current branch remains HOLD/unmergeable.

• src/V2/Support/ParallelChildGroup.php is byte-identical to the already reviewed d7ea1b01 Saga runtime blob (ead6f5a5...). On MySQL/MariaDB, both parent-history FOR UPDATE paths now force the migration-derived (workflow_run_id, sequence) unique index, including the configured connection prefix; other drivers and unlocked reads retain their prior behavior.
• The regression now holds both child-history inserts uncommitted, releases the first child, observes its exact parent-run lock, and only then releases the sibling. Its socket bounds and finally termination/close path preserve a finite refusal when any observed query is missing. This is a materially stronger reproduction of the table-scan lock cycle, not a retry workaround.
• The reported MariaDB 10.5 and MySQL 8.4 barrier-class results (15/416 each) and the deterministic old-5b deadlock counterfactual are scoped to this source.

Current exact-head repository preflight is terminal NONPASS: the corpus policy reports that a replay-classified implementation changed while the corpus count stayed 138, and the build correctly fails its required-preflight dependency. Do not merge or treat the isolated PR as a full source gate. Compose the exact three-file correction with reviewed #1140 as planned, then return the combined head with the required corpus/current CI/default-Maria/full backend evidence. No standalone full-Maria, main merge, release or Saga whole-head authority is inferred.

[rmcdaniel]

The exact reviewed parent-history component and coordinated regression are now preserved in active core prerequisite #1140 at 12467c2. The replay-growth guard remains unchanged and the composed clock fixture retains its own purpose. Full combined backend/corpus/current gates remain there; issue #1142 remains open.