Prepare Native 3.3.1 and complete installed PHP condition-wait qualification

.github/workflows/phpunit-feature.yml

@@ -190,7 +190,7 @@ jobs:
         run: python3 -m unittest discover -s tests/Unit/Support -p 'single_region_failover*test.py'
 
       - name: Require all PHP replay runtime cells and exact artifact identity
-        run: python3 -m unittest tests/Unit/Support/php_replay_published_test.py
+        run: python3 -m unittest tests/Unit/Support/php_replay_published_test.py tests/Unit/Support/php_condition_wait_test.py
 
   feature:
     name: PHPUnit feature suite

.github/workflows/published-workflow-lifecycle.yml

@@ -4,11 +4,11 @@ on:
   workflow_dispatch:
     inputs:
       experiment:
-        description: Existing lifecycle aggregate or complete PHP replay matrix
+        description: Lifecycle aggregate, complete PHP replay, or replay plus installed condition-wait cases
         required: true
         default: lifecycle
         type: choice
-        options: [lifecycle, php-replay]
+        options: [lifecycle, php-replay, php-replay-conditions]
       php_runner_image:
         description: Published tooling image digest for php-replay (no product source)
         required: false
@@ -67,6 +67,7 @@ jobs:
       SERVER_PORT: '0'
       DW_CONFORMANCE_EXPERIMENT: ${{ inputs.experiment }}
       DW_REPLAY_PHP_RUNNER_IMAGE: ${{ inputs.php_runner_image }}
+      DW_PHP_SDK_CONFORMANCE_CONDITION_WAITS: ${{ inputs.experiment == 'php-replay-conditions' && '1' || '0' }}
       DW_WORKFLOW_LIFECYCLE_MYSQL_IMAGE: mysql@sha256:679e7e924f38a3cbb62a3d7df32924b83f7321a602d3f9f967c01b3df18495d6
       DW_WORKFLOW_LIFECYCLE_REDIS_IMAGE: redis@sha256:0637954999d01b7c9ce9167db2da50656e2590d3b884f1c600c5f63bb6e6773c
     steps:
@@ -84,7 +85,7 @@ jobs:
           done
           case "$DW_CONFORMANCE_EXPERIMENT" in
             lifecycle) ;;
-            php-replay)
+            php-replay|php-replay-conditions)
               [[ "$DW_REPLAY_PHP_RUNNER_IMAGE" =~ ^ghcr.io/durable-workflow/sample-app-devcontainer@sha256:[0-9a-f]{64}$ ]]
               ;;
             *) exit 2 ;;
@@ -94,13 +95,17 @@ jobs:
         if: ${{ always() && steps.validate.outcome == 'success' }}
         run: |
           mkdir -p "$RUNNER_TEMP/published-workflow-lifecycle"
-          if [[ "$DW_CONFORMANCE_EXPERIMENT" == php-replay ]]; then
-            bash scripts/conformance/replay-published-artifacts.sh --focus php \
-              --result-dir "$RUNNER_TEMP/published-workflow-lifecycle"
-          else
-            bash scripts/conformance/workflow-lifecycle-host-published-artifacts.sh \
-              --result-dir "$RUNNER_TEMP/published-workflow-lifecycle"
-          fi
+          case "$DW_CONFORMANCE_EXPERIMENT" in
+            php-replay|php-replay-conditions)
+              bash scripts/conformance/replay-published-artifacts.sh --focus php \
+                --result-dir "$RUNNER_TEMP/published-workflow-lifecycle"
+              ;;
+            lifecycle)
+              bash scripts/conformance/workflow-lifecycle-host-published-artifacts.sh \
+                --result-dir "$RUNNER_TEMP/published-workflow-lifecycle"
+              ;;
+            *) exit 2 ;;
+          esac
 
       - name: Remove job-owned lifecycle containers and network
         if: always()
@@ -114,7 +119,7 @@ jobs:
           docker compose -p "$COMPOSE_PROJECT_NAME" -f docker-compose.php.yml down --volumes --remove-orphans >/dev/null 2>&1 || true
 
       - name: Require PHP replay cleanup receipt
-        if: ${{ always() && steps.validate.outcome == 'success' && inputs.experiment == 'php-replay' }}
+        if: ${{ always() && steps.validate.outcome == 'success' && (inputs.experiment == 'php-replay' || inputs.experiment == 'php-replay-conditions') }}
         run: test "$(<"$RUNNER_TEMP/published-workflow-lifecycle/php-replay-cleanup.txt")" = 'cleanup=0'
 
       - name: Make lifecycle evidence readable
@@ -140,6 +145,7 @@ jobs:
             ${{ runner.temp }}/published-workflow-lifecycle/*.txt
             ${{ runner.temp }}/published-workflow-lifecycle/*.csv
             ${{ runner.temp }}/published-workflow-lifecycle/*.tsv
+            ${{ runner.temp }}/published-workflow-lifecycle/*.sql
             ${{ runner.temp }}/published-workflow-lifecycle/*.sqlite
           if-no-files-found: error
           retention-days: 30

.github/workflows/server-parity.yml

@@ -14,6 +14,9 @@ on:
       - Cargo.lock
       - scripts/conformance/**
       - scripts/ci/**
+      # Publication identity is checked by Native promotion contracts. The
+      # fixture jobs do not read it; every other CI helper stays selected.
+      - '!scripts/ci/native-qualification-subject.json'
       - tests/Unit/ServerParity*.mjs
       - tests/Support/ServerParity*.mjs
       - scripts/conformance/server-parity*

docker-compose.published.yml

@@ -16,7 +16,7 @@ name: durable-workflow-server
 # release whose default names another image). Set DW_SERVER_IMAGE to run
 # any other native image, by tag or digest; pin a digest for production
 # change control.
-x-server-image: &server-image ${DW_SERVER_IMAGE:-durableworkflow/server:3.3.0}
+x-server-image: &server-image ${DW_SERVER_IMAGE:-durableworkflow/server:3.3.1}
 
 services:
   server:

docs/releases/3.3.1.md

@@ -0,0 +1,51 @@
+# Durable Workflow Server 3.3.1 (native)
+
+Server 3.3.1 is a patch release of the native (Rust) Server, published as
+`durableworkflow/server:3.3.1` and `ghcr.io/durable-workflow/server:3.3.1`.
+The published Compose file defaults to it. Rolling tags move in the separate
+promotion step after qualification.
+
+## Upgrade
+
+There is no schema upgrade from 3.3.0. MySQL, MariaDB and PostgreSQL remain
+at native schema 11; SQLite remains at schema 10. The worker protocol stays
+at `1.20`, the control plane at version `2`, and the capabilities are unchanged.
+Existing clients need no SDK release for these internal query reductions.
+
+For upgrades from 3.2.x or earlier, follow the
+[3.3.0 upgrade and rollback instructions](3.3.0.md#upgrade), including the
+backup, explicit `schema-upgrade` and condition-wait rollback constraints.
+This patch does not relax those constraints or repair a mixed condition-wait
+chain.
+
+## Changes
+
+[PR #1099](https://github.com/durable-workflow/server/pull/1099) reduces
+database statements on workflow transitions while retaining the existing
+answers, transaction boundaries and lease authority:
+
+- Upsert a run summary instead of checking its existence before writing it.
+- Read a workflow poll's cached binding and result together.
+- Aggregate the projection census in one query.
+- Read the authored sequence counters together, retaining integer types on
+  MariaDB and zero for missing rows.
+- Reuse the waiting-status result already read in the transition.
+- Reuse fenced worker registration within the transaction.
+- Keep run tags within the existing transaction context.
+
+The paired poll-cache writer proposed in
+[issue #1063](https://github.com/durable-workflow/server/issues/1063) is
+deferred. Binding and result writes retain their separate expiry-time origins.
+The other items in the performance report remain tracked individually.
+No benchmark speedup or latency improvement is claimed for this release.
+
+The qualification tooling also verifies the published PHP replay matrix
+under a read-only root, dropped capabilities and `no-new-privileges`. A private,
+byte-identical PHP executable copy avoids inheriting the tooling image's file
+capability; Server and SDK product bytes are not patched for the experiment.
+
+## Known limitations
+
+The [3.3.0 known limitations](3.3.0.md#known-limitations) still apply.
+Source/backend query-count controls and published-artifact compatibility are
+separate evidence; passing them does not reproduce the reporter's benchmark.