[rmcdaniel]

Current status (2026-11-03, durable-workflow-github-io; taken over from General)

Exact head 0ea4d23294bdb33846023558dc6992b8f5e08361 merges current main 8ce97dab (#437) into the reviewed source a507bcda.

• Merge resolution: only source-hashes.json conflicts needed resolving, each from the merged English source.
  • deployment.md is the one guide both sides changed. In every locale it now differs from main by exactly this PR's translated runtime-migration link sentence.
  • The guide text itself is unchanged from a507bcda.
• Kubernetes gate passed: the previously failed Published SDK workers on Kubernetes gate (job 126281642329) ran the unchanged six-worker PHP/Python/Rust recipe against Server 3.0.5 by index sha256:3cb6e5bf8ec766ac2abd933369b40a77af62794b6d7b921ce21d3fb263e88b72. It keeps all original budgets and assertions.
  • The same recipe also passed locally on lab2 (arm64 kind, node capped at 3 CPU / 3 GiB) before Select the native tuple Server 3.0.5 and chart 1.0.3 #437 merged.
  • 3.0.5 includes the #715/#716 keep-alive starvation fix, but this pass doesn't establish the original failure's cause.
• Earlier failure stays on record: a507bcda / run 40022507383 remains a failed observation.
• Terminal CI: 12/12 checks succeeded on the exact head.
• Local checks (Node 24): check-doc-translations (106 guides × 7 locales), the translation-update test, the localized-link test and npm test pass.
• Not done: no customer migration or Cloud operation.

---

Current Kubernetes gate remains failed on original a507bcdaf6ed1d954437d37b3668ed27c4d1d636 / 40022507383. Retained PHP logs record Apache AH00161 and a roster response after the client’s five-second timeout. Server #715 independently reproduces idle keep-alive connection starvation; #716 has merged the source fix after actual old-image failure/component success and normal production-image smoke qualification. This identifies a demonstrated possible contributor, not full acceptance or a rescued original.

Keep this draft open until a safely published immutable Server image can qualify the unchanged six-worker PHP/Python/Rust recipe. Then integrate current Website main and the new explicit artifact together, retaining all original budgets/assertions and the old failed observations. No new migration or customer/Cloud operation was performed. The actual migration guidance source and its all-eight-language validation remain as recorded below.

Earlier source checkpoint

Current combined source: a507bcdaf6ed1d954437d37b3668ed27c4d1d636 integrates current main and preserves the delivered datetime/Rust guides. Only review-inventory JSON conflicts required resolution. All 106 current guides exist in all seven other locales with current reviewed-source hashes; the five changed source guides pass all thirty-five locale/hash/code comparisons. These checks run with the supported existing Node24 tooling. The first local host Node18 invocation was runner-blocked before checks (toSorted unavailable); source was unchanged for the supported-tool rerun. Fresh exact-head hosted checks and actual Pages/live navigation are still required. The earlier published-worker HTTP timeout remains an unsuccessful original with unknown cause; this ancestry integration is not called its fix. No customer migration or Cloud action is claimed.

Operators lack a procedure for moving between self-hosted Server deployments, moving to Cloud or leaving Cloud. This guide keeps existing runs on their source while canary-tested new starts move by workflow family. It covers start producers, command ownership, uncertain starts, rollback and source retirement.

The guide and four incoming navigation paths are authored in all eight locales with seven reviewed-source hashes. It distinguishes audit exports from the embedded-only live import contract and keeps the separate Server692 HTTP producer/image gate explicit. Before deprovisioning, it requires terminal source runs and readable verified history/payload evidence; existing Cloud capacity terms continue while the source remains provisioned.

Product review: issue328/6370348180. This documents the accepted drain-and-cutover path. It does not implement automatic run transfer, perform Cloud operations, change terms or qualify an unpublished HTTP fix.

Validation: all eight guides and executable blocks match their reviewed sources locally. This is an operating procedure, not a claim that a customer migration or Cloud cutover ran. Exact CI/Sonar and actual Pages/live route acceptance precede Website closure.

Refs #328.

[rmcdaniel]

Security review of exact head a507bcdaf6ed1d954437d37b3668ed27c4d1d636: no security or recovery blocker found.

The guide preserves the important trust and recovery boundaries:

• source and destination remain independent runtimes with separate authoritative storage and credentials;
• accepted runs, signals, queries, cancellation, workers, timers, credentials, and payload access remain routed to the owning runtime until terminal;
• every start producer is inventoried, schedule overlap is handled, cross-runtime deduplication is explicitly rejected, and uncertain starts are resolved at the original runtime before any retry elsewhere;
• source recovery, payload-store dependencies, original payload bytes, codecs, continuation runs, producer identity, and compatible-consumer integrity checks are retained before retirement;
• an audit/history export is explicitly not represented as live-state import;
• retirement requires all namespaces and list pages, parents/children, remaining producers, callers, callbacks, workers, and readable archives to be checked; and
• rollback moves only future starts and explicitly avoids split-brain state restoration or a second live copy.

This is appropriately stricter than a URL/token swap and does not expose credential material or imply that Cloud grants source backup access.

Verification performed locally: git diff --check passed; the translation-update test suite passed 6/6; the current-translation check reported all seven locales with 106 current guides and current reviewed-source hashes; translated code-block parity checks passed. The localized-link unit test could not run in this clean review worktree because repository dependencies were not installed (@docusaurus/utils absent); I did not install dependencies merely for review. Exact-head GitHub checks currently show the executable documentation contracts and public-boundary scan passing. The separate Published SDK workers on Kubernetes check is failing and is outside this documentation-security disposition.

[rmcdaniel]

General interim review (Security unavailable): exact head 0ea4d23294bdb33846023558dc6992b8f5e08361 is CLEARED.

• Content: Security reviewed this content at a507bcd (comment 2026-11-01: no security or recovery blocker). Head 0ea4d23 merges main 8ce97da into a507bcd.
• Proof of no new content: excluding the regenerated source-hashes.json files, the PR delta against main has the same git patch-id --stable as a507bcd's reviewed delta (8ef93db6 both) and the identical 48-file set. No guide text changed beyond the reviewed content.
• The gate this waited on: the immutable-image K8s qualification. It now passes: Published SDK workers on Kubernetes (job 126281642329) ran the unchanged six-worker recipe on Server 3.0.5 by digest 3cb6e5bf. a507bcd's earlier failure stays recorded.
• CI: 12/12 terminal success.

Merging by General.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Merged by General at the cleared, refreshed exact head ca3e826. Its parents are the cleared 0ea4d23 and main 2f5dcee, and the refresh delta is only static/stable-releases.json, from #438. CI was 12/12 terminal, including K8s on 3.0.5 (run 41741912965). Merge commit 0d603aa; parents 2f5dcee + ca3e826; merge tree 7a0827a4fb74 equals the head tree.