[rmcdaniel]

Operators need to identify open runs which still depend on a legacy getVersion/patched branch. This adds the namespace-scoped legacy/current/unknown contract and embedded read-only query for durable-workflow/.github#220. Missing markers, incomplete history and unavailable ownership/import provenance remain visible as unknown.

docs/version-usage.md and resources/contracts/version-usage-v1.schema.json define the collision-free native route and shared response. All-state counts precede state filtering. Authenticated opaque cursors bind exact identities and a byte-ordered, upper-bounded keyset; results remain explicitly live observations. Marker reads use frozen event kinds, strict reuse provenance, exact inner identities and a 1,000-marker/run budget, without application payload decoding.

The original corpus guard remains intact. A retained-history fixture exercises the new reader alongside every declared replay consumer. The only guard correction ensures untracked support-file changes are inspected. No observer exemption remains.

Runtime and corpus validation, unchanged by the formatter-only successor 04d863046eb2f9e7e2d9cee006124fb728254d77: 73 focused cases / 179 assertions on SQLite, MySQL and MariaDB; complete declared-consumer loop plus dedicated case 2/1956; cold corpus 144/5369; 72 policy controls; full Stan and a clean final ECS check without --fix. Causal controls cover malformed reuse, case-folding contamination, missing reader capability and the former consumer-dispatch defect. Earlier failed attempts retain their recorded scopes. Local PostgreSQL lacked its PDO driver; hosted PostgreSQL verification remains required.

Exact source review, ordinary PR CI and the full dispatcher pass at current 04d86304: 6,314 covered unit cases, six MySQL and six PostgreSQL shards, Maria controls and both Laravel upgrade jobs. Combined coverage is 93.91% against the unchanged 93.08% ratchet; the separate unit contract passes at 80.08% against 60%. The ordinary PR job verifies the base-bound corpus counterfactual. Final qualification evidence and inherited PHPUnit diagnostic classification retain earlier failed attempts at their original scope.

Final independent integration review passes. Merged normally as c93cadad8a0104b6e7e5f38e022c3b06c26c86e6; the merge tree exactly equals the reviewed tree. All four actual-main workflows pass, the accepted-main review passes, and the topic branch/worktree are removed. Server #1221, CLI and Waterline retain their own integration and installed acceptance.

[rmcdaniel]

Concrete native compatibility finding: the proposed GET /api/workflows/version-usage occupies the existing GET /api/workflows/{workflow_id} URL for the valid workflow ID version-usage. It would turn that existing describe request into a 422 query-validation failure. Reserving an existing customer ID on an additive API change is not acceptable.

The native route is therefore GET /api/workflow-version-usage (relative route /workflow-version-usage). Query fields, v1 response shape, workflow_version_usage capability, error behavior and namespace semantics stay the same. No conflicting alias is added. I am adding a regression that creates version-usage, then verifies its original describe URL still works. Workflow and CLI have the same concrete correction for their contract/transport references before adoption. The draft is not published yet.

[rmcdaniel]

Security/source review at 0f8f30f2094c175f8432e0d0150e189f13738870 / tree 5b4ec9cc0fae41fcad67ed6098061b42b2e8dab4: HOLD for three fail-closed contract gaps.

1. VersionUsageCursor is only canonical base64 JSON. Its query digest is public and an authorized caller can manufacture a valid-looking through/after, omit older run IDs and receive an incomplete traversal. Although the cursor is not an authorization token, it is a safety-decision input. Bind the canonical body with a domain-separated HMAC using the existing application signing-key pattern, verify the tag before JSON parsing, and add missing/tampered through/after/query/tag controls.

2. The real embedded producer calls WorkflowHistoryEvent::record(..., $task). snapshotPayload() therefore adds payload.task to every ordinary VersionMarkerRecorded event, but VersionUsageDecision::observe() excludes task from its closed field set. Current source-shaped markers consequently become history_unavailable; the focused fixtures bypass the actual producer shape. Add a real recorded-event positive and admit only the exact known task snapshot field while keeping unknown marker fields fail closed.

3. The supported-history fence is dynamically built from HistoryEventType::cases(). A later enum addition would silently become accepted by the v1 reader without a v1 contract change. Freeze an explicit retained-v2 event-kind set and keep an unsupported/future-kind regression.

The namespace predicates, missing-owner accounting, marker budget, exact collation, live keyset semantics and re-read after observation are otherwise appropriately fail closed. I executed no runtime or application payload path; current dispatcher/backend/coverage gates remain separate.

[rmcdaniel]

Security review of exact 79b2f531491da2472f31972c071f612a35003b4d is HOLD on three concrete fail-closed gaps:

1. Malformed replay provenance can be classified current. VersionUsageDecision::observe() allowlists reused_from_run_id and reused_recorded_at, but lines 46–53 validate neither their pairing nor their values. A target marker with otherwise-valid fields plus only reused_from_run_id => [] (or an invalid/blank recorded clock) reaches lines 54–63 and becomes current. That conflicts with the v1 rule that malformed markers remain unknown. Require both-or-neither, a nonempty string run ID, and the canonical/valid recorded-clock form before accepting the marker; add causal unit/query controls for lone, wrong-type, blank, and malformed provenance.

2. History/run identities are not exact on the inner queries. decisions() starts with ordinary whereIn('workflow_run_id', ...) (line 279), then uses ordinary groupBy, keyed plucks, marker whereIn (line 333), and the final run whereIn (line 352). On case-folding MySQL/MariaDB collations a history row whose run ID differs only by case can enter another selected run's aggregate/marker scan. The marker loop then indexes $decisions[$event->workflow_run_id] exactly, so the foreign-case row can cause an undefined-key failure; the aggregate can also be contaminated before the reader decides availability. Apply the existing binary/C identity expression to every run/instance/history join/filter/group/keyset identity, and add a MariaDB/MySQL case-collision control proving a foreign/case-variant history row is neither consumed nor able to fail the query.

3. The new replay-corpus exemption can admit SQL writes. classify-version-usage-observer.php allows selectRaw()/get() and scans each string token independently for write keywords, but permits concatenation. For example, a VersionUsageQuery body containing $run->selectRaw('id IN'.'TO OUTFILE \'/tmp/version-usage-write\'')->get() is composed into a MySQL SELECT ... INTO OUTFILE while neither string token contains the banned INTO word. Reject constant concatenation (or parse/close the complete SQL expression rather than token fragments) and add this predecessor-accepted counterexample to the policy tests.

The cursor HMAC-before-parse, closed event-kind set, bounded counts, start-prefix grammar, and the untracked-source + prefix correction otherwise match the reviewed contract. Current hosted checks remain separate and do not clear these source findings.

[codecov]

Codecov Report

❌ Patch coverage is 97.60479% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 94.12%. Comparing base (8bb05a6) to head (04d8630).
⚠️ Report is 12 commits behind head on main.

Files with missing lines	Patch %	Lines
src/V2/Support/VersionUsageQuery.php	96.55%	8 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1146      +/-   ##
==========================================
+ Coverage   94.10%   94.12%   +0.02%     
==========================================
  Files         684      687       +3     
  Lines       89982    90308     +326     
==========================================
+ Hits        84677    85004     +327     
+ Misses       5305     5304       -1     

Flag	Coverage Δ
v2	94.12% <97.60%> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[rmcdaniel]

The three findings at 79b2f531 are corrected in exact 30341b139323c4bf3fa26a34c2c562f88c075bbe / tree 64956a6b5a4bd18af1e3e1a4a249aed289dd0605:

• Reuse metadata is both-or-neither, with a bounded nonblank source run identity and strict valid explicit-offset RFC 3339 clock. Calendar/offset errors, malformed types and incomplete pairs stay history_invalid. Original strings remain untouched; the embedded precision limit is not imposed on native readers.
• Binary/C predicates now cover owning-instance IDs, every history/run ID filter, history grouping/distinct identity and both run/marker keysets. Markers remain bounded in batches of 250. Foreign case variants cannot supply another run's missing prefix or enter its marker reducer.
• The observer classifier refuses concatenation in the query/decision readers. SQL methods and configured-model construction are unavailable to the cursor/decision classes. Direct and parenthesized constant-concatenation INTO OUTFILE controls are included.

Exact corrected source passes 73 PHP tests / 179 assertions on SQLite and MySQL, targeted ECS and full Stan. All 73 Python policy controls and exact-base preflight pass; the latter retains counterfactual enforcement, unchanged 39 codec/146 replay fixtures and all 12 actual changed paths. Current full dispatcher: 43594963032.

Causal controls retain the old reader failures separately: restoring only the old decision reducer produces 16 expected malformed-provenance assertion failures; restoring only the old query produces the single gap-a undefined-key error in the 73-case MySQL run. The old classifier accepts the exact SQL-concatenation source and the new classifier refuses it, without executing that SQL. The fixed files were restored byte-for-byte afterward. The counterexample controller initially expected exit 1 for every failing test; PHPUnit correctly returns exit 2 for the query error, so the original controller failure is retained and a typed result check records that distinction without a rerun.

The PR remains draft for independent exact-head source disposition and complete current quality/backend/coverage checks. Earlier full-cycle results retain their own revisions and do not clear these findings.

[rmcdaniel]

Security exact-head rebind for 30341b139323c4bf3fa26a34c2c562f88c075bbe / tree 64956c488816fe3677758d7b521f805a71a8f80e: HOLD (one remaining source-policy finding).

The first two findings from the prior review are closed. VersionUsageDecision::validReuse() now requires the source/timestamp pair together and validates the bounded RFC3339 value. VersionUsageQuery now applies binary/C identity predicates and binary keysets/grouping consistently across run, owner, history, marker, and unsupported-owner paths.

The observer exception is still not closed against dynamically constructed raw SQL. classify-version-usage-observer.php allowlists base64_decode, implode, and the raw sinks selectRaw / whereRaw / orderByRaw / groupByRaw, but examines prohibited SQL words only inside literal tokens. Consequently this valid VersionUsageQuery body passes every present token rule while reconstructing a prohibited write-capable SELECT clause at runtime:

$sql = base64_decode("aWQgSU5UTyBPVVRGSUxFICcvdG1wL3ZlcnNpb24tdXNhZ2Utd3JpdGUn");
return $run->selectRaw($sql)->get();

The same gap exists with implode("", ["OUT", "FILE"]). Rejecting only the . operator therefore fixes the captured counterexample, not the unsafe provenance class.

Please make raw-sink arguments structurally closed/provenance-checked (or remove the blanket raw-sink waiver), use class-specific function allowlists so query observation cannot decode/assemble SQL, and add both transform cases as causal negatives. The current 73 policy controls and dispatcher remain evidence for this head but do not clear this bypass. No runtime or release inference.

[rmcdaniel]

Exact successor daa00a65b597f43f1cd4b9eb15c00b3cec2497ed / tree 47e90ca039190d85d7c0393e850e8fdb72b96ebd removes the observer exemption completely. The classifier file and its validator exception are deleted. Every observer stays under the original replay-evidence guard, including transformed SQL; the untracked-source guard correction remains.

A new immutable candidate fixture, version-usage-retained-reused-decision.json, records a supported reused decision. The official embedded corpus consumer now reads that history through the new API and checks current/legacy thresholds, an unreached marker's unknown state, and unchanged history/attempt counts. This proves the new reader capability; it does not claim that workflow replay execution changed. Without the reader files, the targeted official consumer fails one explicit capability assertion with no setup errors. With the candidate reader it passes 1/13; the complete cold-runner corpus passes 144/5369. Full official base/current/counterfactual execution remains a hosted gate.

Production reader bytes are identical to 30341b13, whose provenance and binary-identity findings were closed in the prior review. Local focused controls pass 73/179 on SQLite, MySQL and MariaDB 10.5.29 (case-folding collation, original timestamp default); full Stan and targeted ECS pass. All 72 policy controls and the exact-base preflight pass with replay evidence growing 146→147 and codec evidence unchanged at 39. Earlier fixture/runner failures remain separately attributed.

Current complete dispatcher: 43597103396. The PR stays draft pending exact-head source disposition, the complete counterfactual job, full quality/backend/coverage and current required checks. No exemption, fixture-count waiver or threshold relaxation is retained.

[rmcdaniel]

Security rebind for exact daa00a65b597f43f1cd4b9eb15c00b3cec2497ed / tree 47e90ca039190d85d7c0393e850e8fdb72b96ebd: HOLD on one test/corpus contract defect.

The unsafe observer classifier and waiver are fully removed, so the prior dynamic-SQL policy finding is closed. Production reader bytes are identical to 30341b139323c4bf3fa26a34c2c562f88c075bbe.

The new fixture declares query-state-replayer and workflow-executor as consumers, but its dedicated positive test invokes only VersionUsageQuery::page(). The shared testFixturesExecuteThroughDeclaredReplayConsumers() loop treats either declared replay consumer as failure evidence and unconditionally requires expected_failure; this fixture contains only expected. There is no ID-specific branch for version-usage-retained-reused-decision. On the exact head, the declared-consumer path therefore reaches:

version-usage-retained-reused-decision embedded replay evidence must declare its failure.

Make the metadata and official execution agree: either introduce/dispatch a closed version-usage-query consumer for this positive fixture, or remove the falsely declared replay consumers and bind the dedicated reader test through the corpus policy without claiming those consumers. Preserve the original replay guard and the no-waiver design.

Bounded record correction: my prior 30341b13 review comment misspelled its tree. The commit API/current Git object gives exact tree 64956a6b5a4bd18af1e3e1a4a249aed289dd0605, not 64956c4888.... That correction does not change the prior production findings.

Full current dispatcher/quality/backend checks remain required; no merge/runtime/release is cleared.

[rmcdaniel]

The declared-consumer finding is corrected at exact 7e1706ef770285d337f7cb91d7fa24109b70a7fc / tree be9ac80110987bd80d6ff7f6b3b1586a115c4d11. Only the embedded corpus test changes from daa00a65; production, fixture, schema and guard bytes are identical.

The dedicated test and the shared declared-consumer loop now call the same complete helper. It checks the new version-usage reader's current/legacy/unknown answers and read-only history/attempt counts, then actually executes QueryStateReplayer and the native workflow-task/executor path. Those paths must retain the prefix, remain waiting on the recorded activity, keep one marker/schedule and invoke no activity provider. The fixture's three declared replay consumers therefore execute rather than being exempted from the loop.

The complete declared-consumer loop plus dedicated case pass 2 tests / 1,956 assertions. Restoring only the old daa00a65 test file reproduces exactly one missing-expected_failure assertion in that loop (1,701 assertions, no setup errors). Removing the newly added reader capability still produces the intended single capability assertion. Files are restored afterward. Full Stan passes on the corrected source; ECS is clean.

The removed classifier/waiver stays removed. Focused reader proof remains 73/179 on SQLite/MySQL/MariaDB, the cold corpus remains 144/5369, policy tests remain 72, and the corpus grows 146→147. Current full dispatcher 43598113270, the complete official counterfactual job, current coverage/backend checks and final independent disposition remain gates.

[rmcdaniel]

Security rebind at exact 7e1706ef / tree be9ac80110987bd80d6ff7f6b3b1586a115c4d11: PASS for the remaining corpus-fixture finding.

The only delta from daa00a65 is the corpus test. The shared loop still runs executeColdReplayFixture() first (workflow-fiber-runner), then the exact version-usage fixture takes one closed helper which performs the read-only VersionUsageQuery assertions, invokes the real QueryStateReplayer, and executes the ready workflow task (workflow-executor) while proving no activity provider callback ran. It therefore exercises all three consumers declared by the fixture without inventing expected_failure, skipping a declared consumer, or restoring the deleted classifier/waiver. The helper also preserves the original retained history prefix and version marker while admitting only the expected pending activity schedule.

This closes my daa00a65 missing-expected_failure HOLD. Production remains byte-identical to the already reviewed 30341b13 source; full current-head dispatcher/integration remains a separate merge gate. The corrected 30341b13 tree identity remains 64956a6b5a4bd18af1e3e1a4a249aed289dd0605.

[rmcdaniel]

Responsible source-quality disposition for exact 7e1706ef770285d337f7cb91d7fa24109b70a7fc / tree be9ac80110987bd80d6ff7f6b3b1586a115c4d11: the current PR analysis has 15 open CODE_SMELL advisories in the three reviewed reader files. I accept these exact advisories for this change, with no suppressions or gate/threshold changes.

Rule	Count	Source rationale
php:S1142	2	Early refusal returns keep malformed/unavailable metadata from reaching dependent parsing or optimistic classification. Guard clauses make those fail-closed boundaries explicit.
php:S5843	1	The bounded recorded-clock expression deliberately spells out the supported RFC 3339 shape and offset bounds, followed by strict calendar validation. Malformed and valid clock controls cover this boundary.
php:S6353	9	Explicit ASCII [0-9] classes state the canonical stored-clock character set. Replacing them only changes notation.
php:S3358	1	The result expression directly maps unknown/legacy/current into the fixed three-state response; its threshold and unknown behavior are covered independently.
php:S3776	2	The page/decision methods keep each run's bounded metadata observation, counts and returned state together. The complete tenant, provenance, pagination and read-only controls exercise these cohesive read paths.

Exact finding keys: AaHaCEoEGhjC-EaUYvpR, AaHaCEoEGhjC-EaUYvpS, AaHaCEoEGhjC-EaUYvpT, AaHaCEoEGhjC-EaUYvpU, AaHaCEoEGhjC-EaUYvpV, AaHaCEoEGhjC-EaUYvpW, AaHaCEoEGhjC-EaUYvpX, AaHaCEoEGhjC-EaUYvpY, AaHaCEoEGhjC-EaUYvpZ, AaHaCEoEGhjC-EaUYvpa, AaHaCEoEGhjC-EaUYvpb, AaHZ5ulZMioAmihI3L54, AaHZxNRhMioAmihI0uPA, AaHZxNRhMioAmihI0uPB, AaHZxNaoMioAmihI0uPC.

This is an owner disposition of those style/maintainability advisories, not a security-finding waiver or acceptance of any failed test. Independent source review, all required current checks, full coverage/counterfactual/backend proof and normal integration/readback remain required.

[sonarqubecloud]

Quality Gate passed

Issues
15 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security source rebind PASS at exact 04d863046eb2f9e7e2d9cee006124fb728254d77, tree 42d6ff38.

The complete delta from reviewed 7e1706ef770285d337f7cb91d7fa24109b70a7fc is one ECS-only method-chain wrap in V2EmbeddedReplayRegressionCorpusTest.php (one line becomes two). PHP tokens, assertions, production sources, corpus fixtures and policy controls are unchanged, so the prior corpus/source verdict remains valid. Current-head ordinary/full integration remains a separate gate.

[rmcdaniel]

Final source-stage qualification at 04d863046eb2f9e7e2d9cee006124fb728254d77, tree 42d6ff38db0456e619e1c823ec0ab2ce5aa49da1.

Full dispatcher 43599262886 is terminal SUCCESS. Current PR contexts are 32 terminal: 26 success and six intended skips; no pending/failure, merge state CLEAN. Ordinary PR build 43599245780 separately passes the actual base-bound corpus counterfactual, ECS, Stan, full unit/contracts and backend selection.

• Covered unit: 6,314 cases / 84,688 assertions; extracted current artifact passes the unchanged unit contract at 80.08% / 60.00% floor.
• Six complete MySQL shards: 3,198 cases / 32,415 assertions. Six PostgreSQL shards: 3,198 / 31,706. Hosted Maria controls and both embedded Laravel upgrade jobs pass. The new reader additionally passes its 73/179 focused controls on actual local SQLite, MySQL and MariaDB; the earlier local missing-PDO PostgreSQL result remains NONPASS and is superseded only by the current hosted PostgreSQL evidence.
• Combined unit + six MySQL reports: 81,644 / 86,932 executable lines, 93.91%, above the unchanged 93.08% ratchet. Both Codecov contexts pass.
• Final source matches the captured 2,583 tracked blobs. Production bytes remain reviewed 30341b13; the corpus helper executes every declared consumer, and the last successor changes only whitespace. No observer classifier or exemption remains.

I downloaded and verified the three coverage ZIP digests against the API; all API artifact records bind this exact head and run:

Artifact	ID	SHA-256
unit-coverage	14116651034	4eebc9eb781d4f70227a6f46db38db15086d98cf67cbf4a91442f18f019638d9
v2-coverage-summary	14116690893	a1b3aa09c8fe6db060e5973dd44b23793befa45cc2601f4825e9ea46e2a8657b
sonar-coverage	14116354043	d7befde0523c7ad7b9248027c54a230ef804ac5fda8b5f2c2169fe9e608fbc7e

The 15 unit notices are inherited mock-without-expectations diagnostics in unchanged Provider/Watchdog tests; accepted base 8bb05a63 also reports 15. The PHP 8.5 / PHPUnit 13 ordinary run additionally reports two inherited with*()-without-expects() deprecations in unchanged QueryStateReplayerSignalTest. A bounded 24-case/148-assertion display run reproduces these exact diagnostics; all 51 new unit cases are clean. No test or suppression changed to hide them. The existing Sonar maintainability disposition applies unchanged to this whitespace-only successor.

Exact source rebind passes. Earlier failures remain scoped to their original attempts. Final independent integration disposition, normal non-bypass merge, accepted-main verification and topic cleanup remain. This establishes source qualification only; publication, Server/CLI/Waterline installed acceptance and existing release stops stay separate.

[rmcdaniel]

Final exact-head integration disposition: PASS for 04d863046eb2f9e7e2d9cee006124fb728254d77 / tree 42d6ff38db0456e619e1c823ec0ab2ce5aa49da1.

Independent readback confirms:

• PR Add namespace-scoped open-run version usage queries #1146 is still that exact head, draft/open, merge state CLEAN, with 32 terminal contexts: 26 SUCCESS and six intended SKIPPED; no failed or active context remains.
• Ordinary PR build 43599245780 is terminal success at the same head and includes the base-bound contracts/counterfactual, regression corpus, quality, unit/contracts, MySQL selection, and six PostgreSQL shards.
• Full dispatcher 43599262886 is terminal success at the same head: contracts, policy preflight, tracing, corpus, quality, unit coverage, MariaDB, six MySQL shards, six PostgreSQL shards, both Laravel profiles, aggregate coverage, and final build all succeeded. Its four PR-only jobs and Sonar upload are the expected dispatch skips.
• API artifact records for unit-coverage 14116651034, v2-coverage-summary 14116690893, and sonar-coverage 14116354043 all bind this head. I downloaded all three ZIPs, verified their archives, and independently reproduced the posted SHA-256 values (4eebc9eb…, a1b3aa09…, d7befde0…). The retained summary names commit 04d86304 and reports 81,644/86,932 lines = 93.91%, passing the unchanged 93.08% ratchet. Both Codecov contexts and Sonar's quality/security gate pass.

The prior exact source PASS therefore advances to exact-head source/integration PASS. The documented inherited notices/deprecations and responsible 15-code-smell disposition do not change this verdict. Normal non-bypass merge, accepted-main readback/topic cleanup, publication, downstream installed acceptance, and existing release stops remain separate; this review selects none of them.

[rmcdaniel]

Accepted-main closure PASS for merge c93cadad8a0104b6e7e5f38e022c3b06c26c86e6.

• Merge tree 42d6ff38db0456e619e1c823ec0ab2ce5aa49da1 exactly equals the independently reviewed and fully qualified PR head tree.
• All four actual-main workflows at that merge are terminal SUCCESS: Public Boundary 43601838815, build 43601838837, Push on main 43601839072, and Code Quality: Push on main 43601839157. The build run has 23 successful jobs and four expected PR-only skips, with no failed or active job.
• Remote topic feat/220-version-usage is absent.

This closes the source/integration/accepted-main delivery for #1146. It does not select publication, downstream installed acceptance, a Server/CLI/Waterline release, or any existing stopped scope.

[rmcdaniel]

Workflow's contract and embedded source slice is delivered at accepted main c93cadad8a0104b6e7e5f38e022c3b06c26c86e6, tree 42d6ff38db0456e619e1c823ec0ab2ce5aa49da1. The normal merge has the expected parents and exactly the reviewed 04d86304 tree.

All four actual-main workflows pass: build, public boundary, CodeQL and code quality. The commit has 33 terminal contexts: 29 success/four intended skips. Main's covered unit reports 6,314 / 84,544, with the same 15 inherited mock notices. Combined coverage is 81,643 / 86,932 lines, 93.91% > 93.08%. I downloaded main's unit ZIP (58c533d7b382631d1b43910efd8c7636e6a59f4bcb9bc1d38b0417ed2b3059e5) and summary ZIP (998c50fd409c07db1ab7b01acd73d097bce4b145c889a45d912979f9781559cd), verified their API digests/head bindings, and verified the retained summary names this merge. Independent accepted-main review passes.

The merged topic is absent through GitHub API and Git, and its clean local branch/worktree are removed. Consumers can pin the contract and v1 response schema. No published endpoint/package, downstream installed acceptance, release train or existing stop is changed by this source delivery; the cross-repository issue retains that unfinished work.