[rmcdaniel]

The successor evidence helper admits unsupported delivery families and duplicate or foreign terminal evidence, while refusing valid failed/timed-out activity and cancelled-timer progress. This change binds modeled calls to their exact kind, mode, workflow step, resource and row order, and refuses duplicate or contradictory terminal rows.

The evidence model explicitly covers sequential remote/local activities, plain timers and recorded untimed signal waits. It refuses condition/child/service-operation calls, timed wait histories and group/selection/scope/operation metadata. This keeps backed-wait timer cleanup outside the scalar one-terminal rule. Untimed signal application also binds its earlier receipt. SDK production behavior and all frozen corpus bytes remain unchanged.

Compiled predecessor controls on Rust 1.86/stable exposed five initial test-group failures (44 existing tests pass) and independently confirmed four duplicate-terminal admissions among seven paired controls; the other three were already refused by Rust's narrower event filter. The implementation and expanded positive/negative controls are pushed; pass-after CI is pending. Formatting uses the official SHA-verified Rust 1.86 component inside a temporary network-disabled container, with no Cargo/image pull/host installation.

References #179. This is source evidence-model work, with no Server/authentication, installed consumer, runtime, package/tag or release carry. #191/#192/#210 admission remains separate.

[rmcdaniel]

The corrected baseline controls at 31cc6c26c39d4f58f68e918a7f310c7fb82349af now have an actual compiled fail-before result in CI 41960355182. Rust 1.86 and stable both compile and run the successor corpus: 44 existing tests pass and all five new test groups fail. Those failures independently expose unmodeled delivery admission, valid failed/timed-out activity refusal, valid cancelled-timer refusal, an internal timeout resolving a plain timer, and a mismatched activity type justifying next-step progress. Loop groups stop at their first failing case, so this does not claim every synthetic variant was executed before the first failure.

The earlier 869e92f Rust-job failures were formatting, not this compiled proof. One formatting correction was pushed normally; no suppressions or fixture-byte changes are involved. sdk-rust owns the implementation and expanded positive/negative controls. #210's concrete Security source consumption fixes were given immediate priority and have now been submitted for exact re-review, so this isolated evidence-model correction can resume. No PHP count, production SDK behavior, installed consumer, Server, package or runtime result is carried.

[rmcdaniel]

Exact candidate 729d5b6e54528191f77b803b5ba09c4ea0b4473f, tree 13b9b9be24e55d16ae8583767c095e9da2f79632, normally merged accepted main 46cf3651, has terminal 17 successful checks/two intended Server skips. CI 41965336164 passes Rust 1.86/stable, all 715 unit tests and all 53 successor corpus tests; CodeQL, package/docs/protocol/boundary and Sonar pass, but the independent Sonar issue query reports one unresolved issue; sdk-rust is correcting it before source review. The passing quality gate alone is not a zero-issue result. All original fixture bytes and verdicts remain unchanged; only the Rust corpus helper/tests differ from main.

The evidence contract is now explicit: scalar remote/local activities with Completed/Failed/TimedOut/Cancelled outcomes, plain timers with Fired/Cancelled, and recorded untimed signal waits with Applied plus the matching receipt. Terminal pairing binds kind, local mode, step, resource/type and physical row order. A recorded call has at most one terminal, and every terminal requires its exact earlier call. Prior-call progress needs that valid resolution before delivery. Request-relative eligibility retains Core 28893f97's row order, including equal timestamps and resolution after request.

Condition/child/service-operation deliveries, timed wait histories and grouped/selected/scoped/operation metadata are explicitly refused. This is an evidence-model boundary, not an SDK/API capability removal. Backed waits can legitimately have timer cleanup alongside a logical result; they are not subjected to the scalar one-terminal rule.

Independent compiled predecessor proof is 41963400105: 44 existing tests pass and six new test groups fail. Among seven multiplicity pairs with accepted single-terminal positives, Rust independently admitted four duplicate cases: remote/local Completed twice, plain TimerFired twice and untimed SignalApplied twice. Its narrower typed filter already refused the failed+completed and cancelled+fired pairs; no PHP count/PASS carries. Earlier five controls separately expose the family/identity omissions and valid-terminal refusals. All those controls plus expanded positive/negative type/mode/receipt/scope tests pass on the candidate.

The behavior tests pass. sdk-rust still owns the unresolved Sonar correction and final source qualification, before Security's exact evidence-integrity review and General's integration decision. The draft is retained for review. No production SDK source, Server/authentication, installed consumer, VM/runtime, package/tag or release is changed or qualified. #191/#192/#210 execution admission stays separate.

[rmcdaniel]

Pass-after behavior remains 715 unit tests / 53 corpus tests. The independent Sonar query found one S3776 complexity issue in the new activity-terminal test setup despite the passing quality gate; the qualification record was corrected immediately. I extracted that setup into a focused fixture helper without changing the generated scenarios or assertions, and pushed the correction for normal CI/Sonar verification. No suppression, fixture-byte change, production SDK change or new runtime claim is involved.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Final source qualification is complete for af01d4dc19ed48ef8f105ff5cde4ba7d3b3c5bf0, tree 549c32399a3b1dc67c4ff2adf59a6d8aa47bd9c0, based on accepted main 46cf3651. All 17 checks pass with two intended Server skips. CI 41966304556 confirms 715 unit tests and all 53 corpus tests pass on Rust 1.86; stable, package/docs/protocol/corpus/boundary/CodeQL checks pass too. Independent Sonar query now reports zero unresolved issues after the test-fixture extraction; no suppression was added.

The behavior, source-only model boundary, unchanged frozen fixture bytes/verdicts and independent compiled predecessor evidence are described in the earlier qualification record. The sole change since 729d5b6e separates activity scenario construction from assertions, preserving every scenario and assertion. Only tests/replay_regression_corpus.rs differs from main.

Ready for Security's exact evidence-integrity review, then General's integration decision. No SDK production API, Server/authentication, installed consumer, VM/runtime, package/tag or release is changed or qualified. #191/#192/#210 operating admission remains separate.

[rmcdaniel]

Security exact-head source/evidence disposition: PASS, limited to af01d4dc19ed48ef8f105ff5cde4ba7d3b3c5bf0 / tree 549c32399a3b1dc67c4ff2adf59a6d8aa47bd9c0 / accepted base 46cf36514f7a39e819213771abf9efc82321c062.

Independent review confirms that the exact PR delta is one test/evidence file only; SDK production source and all checked-in fixture bytes/verdicts are unchanged. Within its deliberately narrow model, the checker now:

• pairs each scalar opener and terminal by physical row order and workflow step;
• binds remote/local activity mode, activity type and execution ID; plain-timer ID; and untimed-signal wait/name plus the matching earlier receipt identities;
• recognizes the closed activity terminal set (Completed/Failed/TimedOut/Cancelled), plain TimerFired/TimerCancelled, and untimed SignalApplied;
• requires at most one terminal per modeled call and refuses every unmatched, duplicate or contradictory terminal;
• refuses condition, child and service-operation deliveries, internal/timed waits, and scope/group/selection/operation membership rather than extrapolating support.

The predecessor evidence is appropriately scoped: it independently exposes the Rust baseline's four admitted duplicate pairs and the separate valid-terminal/family/identity defects without importing PHP counts. The exact successor's current 17 successful checks/two intended Server skips, Rust 1.86 715-unit/53-corpus result, and zero unresolved Sonar finding are terminal. I additionally ran the focused corpus against the exact head using the cached official rust:1.86-bookworm@sha256:300ec56abce8cc9448ddea2172747d048ed902a3090e6b57babb2bf19f754081; all 53 tests passed. The bounded security-rust213 container and its Cargo/target data were removed and absence verified.

This is a source/evidence-integrity carry for General's normal integration only. It is not SDK product behavior, Server/runtime, consumer, package, tag, release, or any #191/#192/#210 VM/execution admission. Backed condition/signal waits remain outside this scalar model and must retain their separate shape-aware evidence rules.

[rmcdaniel]

Terminal source delivery for #179: normal merge 33a303b94f4f19714e1f37df53ff4c8867356623, reviewed tree 549c32399a3b1dc67c4ff2adf59a6d8aa47bd9c0, ordered parents 46cf3651 + af01d4dc, independently read back from GitHub. Only the reviewed corpus checker file changed. Main has 16 successful checks and two intended Server skips; CI 41971913096 independently confirms 715 unit and 53 corpus tests on both Rust 1.86 and stable. Security's exact source/evidence PASS remains the narrow disposition.

No new documentation artifact or deployment was triggered: the sole changed tests/replay_regression_corpus.rs path is outside docs.yml's push filter. The latest protected docs run remains 41959739724 / artifact 13384761426 / deployment 7564108107, previously accepted in #211's owner receipt. A fresh raw HTTPS __build.json matches that receipt exactly, including tooling 46cf3651 and published 4.12.0 source/checksum. There is no new Docs candidate identity to retarget. No dispatch or repeat build was performed.

The merged branch is deleted remotely and locally; remote absence verified. The detached source worktree is preserved. #179's requested validator gaps and independently found scalar-ledger issues are closed with compiled predecessor controls and the reviewed successor. Condition/child/service, timed/internal waits and group/scoped/selection/operation families remain explicitly unsupported by this scalar evidence model. No production SDK behavior, runtime, package or release claim is made; #191/#192/#210 operating holds remain separate.