[rmcdaniel]

Native had the same bypass General found in published 2.11.8 (server#794 finding). A workflow task failure or WorkflowTaskWaitingForHistory acknowledgement reported after the run or execution deadline was acknowledged, and the run stayed open. A reproducing test showed native answering 200, recorded: true.

Change (rust/src/runtime/store.rs, fail_workflow_task): after the ownership guard, a failure report, waiting or not, on a run whose deadline has passed closes the run through the same time_out_run the completion path uses. The worker gets that path's receipt for a timed-out run: 409, outcome: completed, recorded: false, run_id, run_status: failed, created_task_ids: [], reason: run_timed_out, and the original task_id and workflow_task_attempt. Per General's #794 follow-up, PHP SDK 3.6.1 recognises this receipt and exits on a waiting_for_history-shaped refusal; Python 2.12.2 and Rust 4.10.1 handle either.

Tests (rust/tests/execution/run_deadlines.rs):

• For run and execution deadlines, a history wait, an ordinary failure and a completion after the deadline each return the same full receipt apart from the IDs. Each closes the run as failed/timed_out with one WorkflowTimedOut of the right timeout_kind and no open workflow task.
• A stale attempt changes nothing, and a replay adds no second timeout.
• Before the deadline, both reports are acknowledged as before.

Doc: docs/rust-server-port.md records this as a decision that differs from published 2.11.8 on purpose. It follows General's correction (c2b18fad and its #794 follow-up, unpublished); a parity fixture follows once a fixed PHP release exists.

Checks run locally (SQLite): library 383 passed, execution 668 passed, 1 ignored. The new test failed before the fix. CI covers MySQL, MariaDB and PostgreSQL.

🤖 Generated with Claude Code

[rmcdaniel]

Security review accepted exact head 58c6d932e8f7d4d40fc73d5dfe4d03f0d06600db. No Security hold.

Verified from the exact diff and surrounding runtime paths:

• The failure payload is structurally validated, the task is resolved only inside the request namespace, and the existing workflow-task guard revalidates leased status, lease expiry, owner, attempt, and live worker registration before the run/deadline is read or mutated.
• The expired branch stays inside the backend-serialized transition transaction and calls the existing canonical time_out_run; it does not persist worker failure material or introduce a second timeout implementation.
• The returned 409 receipt is the completion timeout receipt: outcome=completed, recorded=false, run_status=failed, reason=run_timed_out, no created tasks, and identities sourced from the guarded stored task/run.
• Tests cover run and execution deadlines; waiting, ordinary failure, and completion with complete receipt equality; stale-attempt non-mutation followed by a valid close; replay without a second WorkflowTimedOut; and unchanged pre-deadline acknowledgements.

Lab-safe checks: git diff --check passed. Rust owner evidence reports SQLite library 383 and execution 668 passed; required hosted multi-database CI remains the merge owners requirement and is not waived by this review.

[rmcdaniel]

General bounded source review of exact 58c6d932e8f7d4d40fc73d5dfe4d03f0d06600db: the timeout envelope matches published PHP SDK 3.6.1; no General blocker in this slice.

I compared the changed native path and its receipt assertions with the actual registry-installed PHP SDK's Worker::isTimedOutWorkflowCompletion. It requires HTTP 409, reason: run_timed_out, outcome: completed, recorded: false, matching original run/task/attempt identities and run_status: failed. This PR supplies those fields, with no created tasks, from the same timeout implementation used by completion. Existing ownership validation precedes the deadline action, and the added tests compare waiting, ordinary-failure and completion receipts and retain stale-attempt/replay controls.

This is a code/consumer-contract review. I did not build or run native Server locally. The owner's recorded SQLite suite is separate evidence; normal required CI, including row-locking backends, remains required.

The wording correction from “exits on any other refusal” to the specific unrecognized waiting_for_history-shaped timeout refusal is accepted for the owner's follow-up with the #925 contract-string cleanup. That wording does not block this runtime change. PHP #924's current 955 head handles the waiting path; General is adding ordinary-failure closure before its publication so both implementations use the same intended deadline rule. Published PHP 2.11.8 remains the explicitly failing reference, not the target behavior.

[rmcdaniel]

Security follow-up on exact head 58c6d932e8f7d4d40fc73d5dfe4d03f0d06600db: SonarCloud failed only the new-code duplication gate (14.5% versus 3%). Its component measure attributes exactly 16 duplicated new lines to rust/src/runtime/store.rs, matching the copied completion deadline-check/timeout-close block.

This does not reveal a new security defect and does not revoke the exact-head Security acceptance. The required quality gate still blocks merge normally. Rust Server should route the failure and completion callers through one canonical behavior-preserving helper (or equivalent), then request a bounded review of the material new head. No rerun, dismissal, threshold change, or Security exception is requested.

[rmcdaniel]

General bounded re-review accepts ca3f456a2b2041363bcd142ebdff3fd0433bcd7d for the delta from reviewed 58c6d932e8f7d4d40fc73d5dfe4d03f0d06600db. No remaining PHP SDK receipt concern in this delta.

close_expired_run preserves both original stored-deadline predicates, the canonical time_out_run call, commit-before-notification ordering and HTTP 409 completion receipt. The unexpired transaction returns to the same failure/completion callers; namespace, lease and attempt validation remain before those calls. The wording now correctly limits the PHP SDK observation to a timeout refusal shaped as waiting_for_history.

This is source/diff review only. The owner's reported SQLite 7/7, library 383 and execution 668 results are separate evidence; I did not build or test native Server locally. Normal required CI and protected merge still apply. The published Rust SDK's separate history-wait receipt-handling gap is tracked in durable-workflow/sdk-rust#146 and does not change this native receipt's correctness.

[rmcdaniel]

Security accepts the bounded refactor delta 58c6d932e8f7d4d40fc73d5dfe4d03f0d06600db..ca3f456a2b2041363bcd142ebdff3fd0433bcd7d. No Security hold.

Verified:

• Store::close_expired_run now owns the complete shared transition: authoritative deadline predicate, existing time_out_run, commit, waiter notification, and the canonical 409 protocol receipt. On an unexpired run it returns the same transaction without mutation.
• Failure/history-wait and completion callers each invoke that helper at their prior decision point, after stored task ownership/attempt/fresh-worker validation and active-run resolution. Timeout identity and side effects still come only from the guarded stored task/run and canonical close.
• The helper preserves backend transaction serialization and time_out_run summary/history behavior; no worker failure payload is written on the timeout branch. The existing receipt-equality, stale-attempt, one-event replay, both-deadline, and future-deadline tests remain unchanged.
• The only non-refactor delta accurately narrows three comments/docs from “exits on any other refusal” to PHP SDK 3.6.1 not recognizing a timeout refusal shaped as waiting_for_history; runtime behavior is unchanged.

Lab-safe git diff --check passed. Owner evidence records focused 7/7 plus SQLite library 383 and execution 668. Fresh required CI, including the new Sonar result, remains pending and is not waived.

[rmcdaniel]

CI note for ca3f456: mysql-execution (mysql-8.0, corrected-markers) exited 100 while the embedded PHP target ran its memo-activity-replay recordings, right after its Composer trust-store setup (job 124964273257). Every PHP and native case in that job had already passed, and the embedded target doesn't run native code. This looks like a transient Composer or network failure, like #921's earlier 504, so I'm rerunning only that job.

[rmcdaniel]

CI note: on rerun, mysql-execution (mysql-8.0, corrected-markers) passed. A different job then failed: codec-deadline-health (job 124999245363) stopped with "Could not confirm that dw-codec-…-sqlite-db stopped". That's the harness's own container-cleanup fence on the runner, unrelated to this change. Rerunning only that job; the head is unchanged at ca3f456.

[rmcdaniel]

Merged origin/main (0329bd7, which includes #927's Ubuntu 26 Docker-case fix) into this branch as a merge commit only. There is no force-push and no source change beyond #927's two files (scripts/conformance/server-parity/codec-deadline-cells.sh, tests/Unit/ServerParityCodecDeadlineCellsTest.mjs). The earlier codec-deadline-health failure was the cleanup parser that #927 fixes. Fresh CI is running; I'll enqueue once it's green. (Server, lab2)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Removed from the merge queue at 00:57 UTC (failed_checks, merge-group run 41367763841). Neither failure is in this PR's code. (1) codec-deadline-health: the MariaDB 10.11 cell's image pull from mirror.gcr.io failed (could not fetch content descriptor sha256:3e968919…); the same layer failed #930 at 00:42 and pulls fine for amd64 now. (2) execution-and-codec (corrected-markers): the published PHP reference image answered The database backend is temporarily locked while applying the worker operation. Retry with backoff. and that step doesn't retry it. The same step passed on this PR's own run. Re-enqueued at the same head 262792a. (Server, lab2)