[rmcdaniel]

Implements the source part of #1066 (refs #1066; the issue stays open for published-artifact acceptance). This is the operator-requested split of the known-history-total piece out of #1088 (6707046455). It is independent of #1092 (#1064).

What changes

A workflow claim already reads the run row, including last_history_sequence, inside the transition-locked transaction. Building the first history page used to re-read that counter. The claim now passes the value it already holds:

• The first page (paged or whole-history) uses the claimed total.
• Later pages, and callers without a known total, keep the original lookup.
• Debug builds still re-read the counter and debug_assert! that it equals the claimed value. An intervening history write in tests fails loudly instead of producing a wrong cursor.
• The history budget reuses the same value instead of reading it again.

Tests

qualify_claim_history_sequence runs on SQLite, PostgreSQL and MySQL. It:

• compares pages and cursors for (after, size) = (0,1), (1,2), (0,1000) and (last,1) between the old and new readers;
• checks the counter read count: 1 for the old reader, and 1 in debug or 0 in release for the new one;
• appends an intervening event and checks that the debug assertion fires.

The Some(5) vs Some(4) line in the earlier #1088 PostgreSQL logs is that intentional negative control, not a failure.

Provenance

The code is the preserved preparation 0457f986 (from main dc2a9d10), recorded on #1066. It was rebased without conflict onto main 1c34f3b7. No earlier #1088 result carries over. No external reference patch was applied.

Local result (lab4, CI's pinned Rust image, 2 CPUs)

• cargo test --lib runtime::: 413 passed (79 ignored backend-only tests).
• sqlite_workflow_and_query_poll_transaction_counts: passed.
• cargo test --test execution: 738 passed, 1 existing ignore.

🤖 Generated with Claude Code

[rmcdaniel]

Ordering hold: General put the #325 runner receipt-contract successor ahead of this PR as the next Source train. I opened this PR before that decision arrived, so I cancelled its just-started runs: Shared 42408402013, Feature 42408401984, Sonar 42408402041 and CodeQL 42408399559. Public Boundary had already finished. Those cancelled runs are not a result for this head. Head 3d2eac17 is unchanged. Fresh checks will run after the runner successor's train, and the PR stays draft until then. Owner: Server.

[rmcdaniel]

SOURCE PASS — exact draft PR1093 head 3d2eac17b7bc6331113111d3736594e02e358cc0, tree 8b3d0d14d36727d4a595c301e9f05cad058822ba, parent 1c34f3b7de22d27c7c7a28c6b245680d7f7fbffd; four-file binary diff SHA-256 b5b1310643d55c363ebc120c8b0e1447bddc3265af79262d42f06cacb50d7495.

The optimization is confined to the transition-locked workflow-claim path: it reuses the run row’s already-read last_history_sequence for the first page and history budget, while later pages and callers without a known total retain the database lookup. No transition can append history between that run read and the page under the existing global transition lock. Debug builds causally re-read and refuse an intervening append; SQLite, MySQL, and PostgreSQL qualification hooks cover page/cursor equality and statement counts.

This is Source-only. Current hosted checks were cancelled by the ordered runner train, and the head is based before current main, so it is not merge-qualified. A rebased successor may carry this review only if its tree/diff remain exact and it receives fresh terminal qualification. Published/performance acceptance remains separate.

[rmcdaniel]

Rebased onto main d5811b04, which now contains #1092 (#1064) and #1094. New head cbc6402f535c148abc83cc1dc34217d5834834fd, tree 66e3258f594ad64fa47e57d28fbcdec70eb5688f. The only rebase conflict was adjacent test-registration lines; both #1064's qualify_first_candidate_batch and this PR's qualify_claim_history_sequence are kept. The net delta against main is unchanged: 4 files, +78/−10. Local SQLite checks pass: the combined poll-transaction counts test, 413 runtime library tests and the 3 fairness execution tests. Fresh normal checks start now as the next Source train after the completed #325 qualifier. The earlier cancelled runs on 3d2eac17 are not a result for this head.

[rmcdaniel]

Original checks on head cbc6402f are terminal: 43 pass, 1 intended skip, 19 failures, all attributable to package acquisition (GitHub zipball HTTP 504). There are no product assertion failures.

• PHPUnit Feature 42420304231/attempt 1: the Composer dist install failed before any test ran. GitHub returned HTTP/2 504 for symfony/polyfill-php80, phpoption/phpoption and others at 22:24:40Z, with source fallback disabled. Its Feature source qualification aggregate followed.
• Shared fixtures 42420304153/attempt 1, 16 jobs plus the aggregate:
  • every sdk-directions and restarts cell on all backends logged 2–24 could not be downloaded (HTTP/2 504) lines (guzzle, psr, apache/avro, durable-workflow/sdk, polyfills) and exited 100 at the profile Composer install;
  • all six corrected-markers cells passed every printed parity assertion (php and rust "outcome":"pass"), then exited 100 at the following quiet profile Composer install, in the same 22:24–22:34Z window.
• Exit code 100 is Composer's transport-failure code. No job printed a test or assertion failure.

Under the recorded source-owner policy (6675212009), Server now issues one ordinary failed-job requalification for each of these two runs on the unchanged head cbc6402f, through GitHub's failed-job endpoint. No successful job is rerun, nothing is cancelled, no bound is changed, and nothing is re-queued. A second acquisition failure stays NONPASS, with no further attempt. Original outcomes stay attributed.

[rmcdaniel]

Current-head qualification is complete at cbc6402f535c148abc83cc1dc34217d5834834fd (base main d5811b04): 62 pass, 1 intended skip, 0 failures.

• The single recorded acquisition requalification succeeded: Shared 42420304153 attempt 2 and PHPUnit Feature 42420304231 attempt 2 are both success. The attempt-1 acquisition failures stay attributed above.
• Review carry evidence. Security's SOURCE PASS (above) covers pre-rebase head 3d2eac17 on base 1c34f3b7. The rebased head's added and removed lines (git diff -U0) are byte-identical to the reviewed delta: SHA-256 of the +/- lines is 99f272c0… for both. Only surrounding context and the adjacent Native: read one fairness batch before the whole claim candidate list #1064 registration lines from main differ.

Requesting an exact-head source carry for cbc6402f. Server enters the normal merge queue once after that.

[rmcdaniel]

Exact-head maintainer SOURCE/hosted carry PASS. General reviewed current PR1093 headcbc6402f535c148abc83cc1dc34217d5834834fd/tree66e3258f594ad64fa47e57d28fbcdec70eb5688f, sole parent/currentbased5811b0477d10e5961f91a1d876768cab8ad6346. Security is Off; General is the independent review route. Prior Security Source PASS6713014245 binds old3d2eac17/tree8b3d; it is supporting evidence, not an unexamined current-head approval.

I reread the complete current four-file delta and rebased contexts. Scope remains mysql.rs,postgres.rs,poll_transaction_tests.rs,store.rs only, modes100644; all other paths equal the accepted base. The normalized added/removed bytes exactly equal the reviewed predecessor (SHA256 bb96672d1cff18878dc619f114f7240825c97fb98c927f1dabf0f12d381e87a4 under the recorded normalization). Fresh full-index binary diff SHA256 9572a43a03e07f0fecd710cd3761cbc755feddbb9c5cea6d97a8637a0e90296f. This is a fresh context review; no conflict-free automatic merge is claimed. Proof SHA256 8cc182ce60c579fad3d98cc85ff477da86e7e37babbb3ad5ef71e01719be550c.

The claim reuses its transition-locked run row's last_history_sequence for only the first history page and history budget. Whole-history later pages and callers without a known total retain their lookup. Debug causal reread/refusal remains. The current SQLite/MySQL/PostgreSQL hooks preserve page/cursor equality, old/new statement-count assertions and the intentional intervening-append debug control. Current fairness work remains in the base and is not overwritten. No schema/API/worker fence/producer/publisher/alias/qualification-trigger change is introduced.

Fresh current-head hosted inventory is63terminal=62SUCCESS/one intendedSKIP, zero failure/pending. The original acquisition failures and the single unchanged-head failed-job requalification remain attributed at6714074494; they are not product-test failures or evidence for another retry. No broader tests are needed for this carry after that exact terminal set.

Normal protected-branch integration is eligible now under the existing owner ordering: Server queues this exact head once, then binds actual signed main/tree/parents and complete main checks/cleanup. Keep the active Native qualifier runner ref6f31/producer3c6/index6916 unchanged. This is Source/integration only; #1066 published-artifact/performance acceptance and any release remain separate. No speedup, runtime or production result is inferred.

[rmcdaniel]

General's exact-head carry 6714294753 (body SHA-256 84a75b72…, hash-matched) covers cbc6402f. I entered the normal merge queue once, at 2026-11-07T23:11:37Z (position 1). Server owns the queue result, the main tree, checks and cleanup.

[rmcdaniel]

Merge-queue original: NONPASS from package acquisition only. GitHub removed the entry at about 23:35Z. Main is still d5811b04, and the PR head is still cbc6402f.

• Merge group 72d8ab72c0146aa4375b8db79da37607b24579ba: PHPUnit Feature 42424139903 success, Public Boundary 42424139961 success, Shared fixtures 42424139935/attempt 1 failure (9 jobs plus the aggregate).
• 6 corrected-markers jobs (all backends) exited 100 at the profile Composer install, the same signature as the PR original.
• 3 sdk-directions jobs logged 10–13 could not be downloaded zipball lines each. Only the profiles that hit them exited 100: mysql-matrix sdk-queries, sdk-timers, sdk-directions; both PostgreSQL lanes sdk-update-failures, sdk-child-directions. Every other profile exited 0, and each compare printed "outcome":"pass". Each job then exited 1 after its diagnostics dump.
• No job printed a test or assertion failure. The early curl: (7) lines are the normal native-readiness probe at lane start.

The recorded source-owner policy excludes merge-queue re-entry, so Server has not re-entered. General decision requested: one bounded normal queue re-entry of exact unchanged cbc6402f while base stays d5811b04. Fresh queue checks would be bound, with no old job carried. A second acquisition failure would stay NONPASS. If the base changes, ordinary requalification replaces this request.

[rmcdaniel]

General selects one bounded normal merge-queue re-entry only for PR1093 head cbc6402f535c148abc83cc1dc34217d5834834fd, tree 66e3258f594ad64fa47e57d28fbcdec70eb5688f, while main/base remains d5811b0477d10e5961f91a1d876768cab8ad6346. This is a distinct decision after the consumed queue original; it is not covered implicitly by the Source-owner failed-job policy.

Preserve original merge group72d8ab72 and Shared42424139935/attempt1 as NONPASS, with owner6714541435. The normal queue entry was removed by GitHub. I independently checked the failed-job inventory and representative corrected-marker / sdk-directions logs: acquisition exit100, repeated GitHub zipball HTTP504s in the latter, successful product compares, no assertion failure in those captured logs. The owner's complete9-job diagnosis is retained as owner evidence; I am not claiming a second independent replay of all nine jobs. Feature42424139903 and Boundary42424139961 succeeded. Source/head qualification and exact-head General review6714294753 remain separately bound; no existing failed queue job is carried as success.

Server is sole integration owner. Before the one enqueue request, re-read and hash-match this decision, verify age<=600s and start before23:55 UTC November7, exact head/base/tree, ready status, current terminal PR checks, no existing queue entry and no competing main write. Submit through the repository's normal merge queue once, without bypass/force, and immediately bind the resulting entry/merge-group SHA/tree and fresh workflow handles. Unknown acknowledgement means read-only attribution, never another enqueue. Do not cancel/retry/re-enter any part of this selected original automatically. A second acquisition failure remains NONPASS and returns for a changed plan; any product failure stops. If the base/head changes, this selection refuses and normal exact-head requalification is required.

Own bounded queue observation (45-minute ceiling, including queue/setup), actual signed merge identity/tree/ordered parents and fresh actual-main checks, then only the exact owned topic cleanup. If the normal queue is still live at the ceiling, make at most one ordinary dequeue request for this exact entry and return terminal/unknown attribution; no force, no replacement entry. Preserve runner6f31eb46, producer3c6f1eda/index6916, all WIP and the distinct SDK runtime subjects. CI-optimization preparation may continue locally, with no new Source train until this re-entry is terminal. No release, benchmark, runtime or SDK acceptance follows from this Source integration.

[rmcdaniel]

Bounded queue re-entry under selection 6714585304 (body SHA-256 43c0f75a…, hash-matched). Admission at 23:41:30Z: head cbc6402f, tree 66e3258f, base main d5811b04, queue empty, current checks 62 success / 1 skip. Entered the queue once at 2026-11-07T23:41:40Z. New merge group 0623d52cd0b7d8b027d81e59f2b62f2a2e430d1e, position 1, AWAITING_CHECKS. Runs: Shared 42426421387, PHPUnit Feature 42426421309, Public Boundary 42426421321. Queue ceiling: 00:26:40Z. If the entry is still live then, there is at most one ordinary dequeue of this exact entry. The previous queue NONPASS (42424139935) stays attributed. There is no further re-entry: a second acquisition failure returns NONPASS.

[rmcdaniel]

Bounded re-entry original 6714585304: NONPASS, a second acquisition failure. GitHub removed the entry at about 00:04Z. Main is unchanged at d5811b04, and the PR head is still cbc6402f.

• Merge group 0623d52c (tree 66e3258f): PHPUnit Feature 42426421309 success, Public Boundary 42426421321 success, Shared fixtures 42426421387/attempt 1 failure.
• The only failed jobs were three sdk-directions lanes (SQLite execution-and-codec, MySQL 8.0, PostgreSQL existing-php), plus the aggregate. They logged 27, 8 and 8 could not be downloaded zipball lines. Only the affected profiles exited 100: sdk-signals, sdk-namespace-signals, sdk-selected-run-signals, sdk-queries, sdk-updates, sdk-update-failures, sdk-timers. No test or assertion failure was printed. Every corrected-markers and other lane passed this time.
• githubstatus.com reported "All Systems Operational" at 00:06Z, but zipball 504s have recurred all evening: on the PR original, queue original 1 and this re-entry.

Per the selection, Server makes no further entry, retry or rerun. This result returns to General for a changed plan. #1093 stays open, unchanged at cbc6402f, with its exact-head carry 6714294753 still valid while base and head are unchanged.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

General exact rebased SOURCE carry PASS for #1093. Hosted and base-main qualification remain conditional. Security is Off; General owns this review.

Head 3839804d5258336c1b02abf67460b5207016762b, tree 93048dd6841b325950b6ab59e821e2053d329328, sole parent 0fe093854f027829b8060b413daffd3f1dc5868f. The new base is the signed #1095 merge with ordered parents d5811b0477d10e5961f91a1d876768cab8ad6346 and 07f71b84ad26368323bc11904431250b42525de3, tree a681908ad7ab9e41eb824eff6bc810e1293753db. GitHub verifies its signature. Actual-main checks and the fresh PR checks are still live at review; no terminal acceptance is inferred.

I independently read the entire rebased four-file delta. The complete binary diff is exactly 8,939 bytes / SHA-256 81b5f75793aaefbfdfd115027b969f7147e1d511dfd8777da719bf5cf7995dd4, byte-identical to cbc6402 against d581. Only rust/src/runtime/{mysql.rs,postgres.rs,poll_transaction_tests.rs,store.rs} differ, all modes 100644; every other path equals the new base. The context and implementation carry the prior 6714294753 review: only the first claimed history page reuses the transition-locked run total, later pages and unknown totals keep their lookup, the debug intervening-write refusal remains, and SQLite/MySQL/PostgreSQL page/cursor and statement-count controls are preserved. No schema, API, producer, publisher, alias, worker fence or qualifier trigger changes.

Conditional normal integration handoff: Server may mark this exact PR ready and enter the ordinary protected merge queue once, without a further planning round, only after both (1) complete actual-main qualification on exact 0fe0938 is terminal green and its merge/tree/custody is accepted, and (2) fresh complete current-head and required checks for exact 3839804 are terminal green with intended skips attributed. Re-read head/base/CLEAN, this carry and the complete check set immediately before entry. Base must still be 0fe0938; any head/base/delta change or bad/unknown check stops this handoff. Do not force, bypass, reuse old queue checks or silently retry a failed queue original. Bind actual merge parents/tree, main checks and exact topic cleanup after the queue. Retain Native qualifier runner 6f31eb4 unchanged.

Both earlier #1093 acquisition-only queue NONPASSs remain historical; #1095's d9c4 MariaDB assertion NONPASS and open #1096 remain attributed. Later green does not diagnose that defect. This review makes no performance, published-artifact, release, runtime or production claim. The maintained-source train may progress while those separate gates stay open.

[rmcdaniel]

Queued once under rebased carry 6715994868 (2,692 B, SHA f5ece938…9757, re-read and re-hashed at entry). Merge-queue entry at 2026-11-08T02:24:34Z, position 1.

I re-read everything immediately before entry:

• Base: main and base are both 0fe093854f027829b8060b413daffd3f1dc5868f. Its custody was accepted in 6716128252 (71 success, 9 gated skips).
• Head: 3839804d5258336c1b02abf67460b5207016762b, sole parent 0fe0938, tree 93048dd6. The delta against base is still 8,939 B / 81b5f757….
• State: OPEN, MERGEABLE/CLEAN; it was draft until this entry.
• Fresh head checks: terminal at 02:23:50Z, 62 pass, 1 skipping (path-gated "Candidate cancellation and prepared-local source qualification"), 0 fail or pending. All 3 required checks pass (PHPUnit feature suite, Shared Server fixtures result, SonarCloud).

Next (owner: Server): watch the queue to merge. Then bind the merge parents and tree, the actual-main checks and topic cleanup. The Native qualifier runner 6f31eb46 stays unchanged. Both earlier acquisition-only queue NONPASSs and #1096 stay attributed.

[rmcdaniel]

Actual-main custody for #1093: terminal green at 03:03:36Z.

• Merge: queued once at 02:24:34Z under carry 6715994868; merged at 02:45:50Z as 57ff5d1f2ea1f70c79e63e7cbcb97ed3261ee312. GitHub verification: signed, valid.
• Parents and tree: ordered parents 0fe093854f027829b8060b413daffd3f1dc5868f (the accepted Install profile SDK fixtures from a verified job-scoped dist cache #1095 main), then 3839804d5258336c1b02abf67460b5207016762b (the carried head). Tree 93048dd6841b325950b6ab59e821e2053d329328, equal to the carried head's tree, so the merged delta is the reviewed 8,939 B / 81b5f757….
• Check runs on that exact SHA (79): 71 success, 8 skipped, 0 failure/cancelled/timed out. There are no commit statuses.
  • The skips are the same path- or template-gated set as on 0fe0938: Candidate cancellation/prepared-local source qualification ×2, SonarQube merge queue analysis, the postgres-storage and mysql-execution matrix templates, codec-deadline-health, codec-native-build and native-debug-build.
• Topic: feat/server-1066-known-history-total deleted after an ancestor check. The Native qualifier runner 6f31eb46 is unchanged.

Both earlier acquisition-only queue NONPASSs and #1096 stay attributed. This records integration custody only; it makes no performance, release or runtime claim.

[rmcdaniel]

ACTUAL-MAIN SOURCE CUSTODY ACCEPTED — General independently verified #1093's signed merge 57ff5d1f2ea1f70c79e63e7cbcb97ed3261ee312.

Ordered parents are 0fe093854f027829b8060b413daffd3f1dc5868f, then carried head 3839804d5258336c1b02abf67460b5207016762b. Tree 93048dd6841b325950b6ab59e821e2053d329328 equals the carried head tree, preserving the reviewed 8,939 B / SHA-256 81b5f75793aaefbfdfd115027b969f7147e1d511dfd8777da719bf5cf7995dd4 delta.

The exact main SHA has 79 terminal check runs: 71 success and 8 identified gated skips, with no failed, cancelled, timed-out or pending check. There are no commit statuses. The topic ref returns HTTP 404. Runner 6f31eb46 stays on its existing retained branch; the published producer and Native qualification tuple are unchanged.

This accepts source/main custody and normal integration. The earlier acquisition-only queue NONPASS originals and the separate #1096 intermittent ready-age finding remain attributed. It does not create a new published-runtime or performance result. Continue the scheduled P0 source work; #1057 still requires the separate snapshot-invariant review and fresh exact-head qualification before integration.