Raise measured main workflow coverage to 100%

[rmcdaniel]

Current measurement

The latest qualified coverage-only result is merged through #709 as 7b0b842e8f3aacc8049530694744ae053326caad, with identical tested/merged tree 400bccd435cdac3a9957ec042b14b6d1d78301fe. Exact head 3ebcc9e94a925ee3eb0f92d12889b9e772a922c0 normal 37826942569 and sole refreshed full 37829315094 succeed on attempt1 without retries. Strict complete-source 64,917/70,394=92.21%, all582/hash/empty/five reports/actual9192/10000 passes; comparison against independently qualified mainc390 proves 204 gains: Executor186 + QueryStateReplayer18, zero losses, with identical per-component source denominators. Initial/refreshed/final COMMENT reviews pass; no own production/version/contract edits. All three local lifecycles and completed head/worktree/refs are removed, remote absence independently verified (completion). Independent merged-main 37831367574 succeeds on attempt1 with strictactual9192/10000 and exactly matching qualified totals/components/uncovered sets (verification). Floor-only #714 is merged asf51ce93bdfba80ff8378f9581d9f53ac003e14b0 with identical tested/merged treeb2f46cc7e031b968c065e8ca614ad0c9d566e8c9; normal37831721448 and optional Analyze succeed on attempt1. No application/dependencies/manualfull; completed head/worktree/refs are removed with remote absence verified (completion). Independent floor-main37832692373 is queued. The100% target stays open.

The independently qualified upstream correction atc390 changed the executable-source denominator to70,394 while preserving all582 source paths/hash/empty exclusions; its full64713/70394=91.92%/actual9192/10000 passes (base verification). Old successful b29 proof remains retained on its own source; no duplicate dispatch or copied new-head evidence.

The previous qualified coverage-only increment is merged through #707 as b511f52b40891958ccec874a4a08d60fe05d2efe, with identical tested/merged tree c17d3c86fc96b246ea25b961390d6c800d460ec5. Exact head e5b8378eb368f3bd6454daad7235e2fbd5b01084 normal 37818666848 and sole full 37819925700 succeed on attempt1. Comparison against qualified #705 proves exactly normalizer1904 gained and zero losses. Initial/frozen/final COMMENT reviews and optional Analyze pass. Both local resource lifecycles and completed head/worktree/refs are removed (completion). Independent main37822528192 succeeds on attempt1 with strict actual9192 and exactly matching qualified totals/components/uncovered sets (verification). The accepted floor stays9192; no floor-only increment is needed.

• 64,917 covered / 70,394 executable lines (92.21%)
• 5,477 uncovered lines, all 582 production PHP files
• unchanged inventory checksum; no excluded production paths
• five reports: one unit report and all four MySQL feature shards
• accepted main floor 92.21% through merged test: ratchet complete-source coverage to 92.21% #714; independent main verification is pending
• target 100%, still open

#705's public metadata validation preserves complete indexed failures, typed false/zero/null values, Avro envelopes and unchanged caller input across repeats. SQLitePCOV/MySQL17/51, actual MySQL metadata5/31, read-only ECS/PHPStan and expanded/canonical3513/44397 pass with source/test/dependency hashes unchanged. Strict unit48926/70330=69.56% and complete inventory/hash/no-exclusions/floor proofs pass. Original interrupted overlay runner evidence and unchanged passing tmpfs confirmation remain retained; malformed declared types stay handed off.

#703 independently succeeds on main37810737249 attempt1 with exact64,689/70,379=91.91%/actual9190floor and qualified totals/components/uncovered sets (verification). Floor #708 main37812321457 also succeeds on attempt1 with identical sets and actual9191floor (verification). Their completed heads/worktrees/refs/resources are removed.

#702 and floor #706 independent main are previously verified passing with exact qualified91.90% coverage/actual9188/9190floors (verification). Original #702 PostgreSQL3 deadline and sole isolated retry remain recorded; earlier passing matrix jobs were reused. All completed resources/heads are removed.

#700's18 argument-validation gains are independently confirmed on main37798342545 attempt2 with exact64,666/70,379=91.88%/actual9185floor/qualified totals/components/uncovered sets (verification). Its original PostgreSQL3 deadline and sole isolated retry remain recorded; earlier passed matrix jobs were reused. Floor #704 main37799900401 succeeds on attempt1 with the exact same coverage and actual9188floor (verification). All completed resources/heads are removed.

#698 and floor #701 independent main both succeed on attempt1 with exactly64,648/70,379=91.85%, actual9183/9185 floors and identical qualified totals/components/uncovered sets (#698 verification, #701 verification). All completed resources/heads are removed. #698's original dependency failure and sole isolated qualification retry remain recorded.

#697's independent main succeeds on attempt1 with exact qualified64,630/70,379=91.83%, actual9173floor and complete components/uncovered sets (verification). Its 66 HistoryExport gains and all cleanup remain recorded. Floor-only #699 main also succeeds on attempt1 with actual9183floor and exact same source coverage (verification); optional PR Code Quality's pre-execution failure/rejected retry stays recorded.

#695's independent main succeeds on attempt 1 with exactly 64,564 / 70,379 = 91.73%, actual 9173 floor passing and identical qualified components/uncovered sets (verification). Its three compiler gains have no losses; the compiler has no remaining uncovered executable lines. All task resources and completed heads are removed.

#693's independent main succeeds on attempt 1 with exactly 64,561 / 70,379 = 91.73% and actual 9165 floor passing (verification). Floor-only #696's independent main also succeeds on attempt 1 with identical components/uncovered sets and actual 9173 floor passing (verification). No main retries were needed for either. #692/#694 main are previously verified successful on attempt 1; original qualification failures, prior increments and cleanup remain in this issue's comments and owning PRs/Actions.

Required outcome

• Add behavior-focused tests for uncovered main paths until measured line coverage reaches 100%.
• Keep the accepted baseline non-decreasing on ordinary main changes.
• Keep the measured production source inventory stable while raising coverage.
• Do not reach the target through source exclusions, ignored lines, copied data from another branch, or weakened coverage checks.
• Keep public CI green for every incremental landing.

Completed increments

• Cover persisted payload decode diagnostics #448 covered WorkflowPayloadDecoder.

• Cover durable workflow query argument contracts #457 and Complete durable workflow query contract coverage #458 completed WorkflowQueryContract.

• Recognize main in coverage contracts #459 aligned the coverage contract with the renamed main branch.

• Cover workflow definition contracts #460 covered workflow definition discovery, aliases, portable command contracts, duplicate names, injected parameters, and inherited/trait fingerprints.

• Cover payload envelope resolution contracts #461 covered payload-envelope encoding, inline/external resolution, and validation.

• Cover portable failure restoration contracts #462 through Cover workflow exception contracts #464 covered durable failure restoration, identity, diagnostics, backend fallbacks, timer-limit metadata, and cancellation identity.

• test: cover WorkflowStub fake contracts #465 and Cover reserved WorkflowStub contracts #466 covered fake lifecycle behavior plus reserved-handle and strict workflow-control behavior.

• test: cover local activity command validation #467 covered contradictory local-activity terminal reports and bounded attempt, retry, and heartbeat metadata.

• Cover workflow command validation failures #468 covered malformed child-workflow, service-operation, failure, and update command validation. WorkflowCommandNormalizer now has 186 uncovered executable lines, down from 306 before test: cover local activity command validation #467.

• Cover bundle structure integrity failures #469 covered bundle structure, schema, section-shape, identity, and portable-memo integrity failures.

• Harden offline bundle integrity diagnostics #470 hardened malformed bundle-row handling, converted invalid UTF-8 into a structured integrity finding, and covered payload, Avro schema, history, redaction, checksum, and signature diagnostics. BundleIntegrityVerifier now has 3 uncovered executable lines, down from 223 before Cover bundle structure integrity failures #469.

• Cover replay verification command paths #471 covered replay-verification command output and failure paths.

• Cover workflow scheduling option contracts #472 covered immutable workflow/activity scheduling options plus business-key, label, memo, and search-attribute validation; StartOptions and ActivityOptions now have no uncovered executable paths.

• Cover invocable activity carrier failures #476 covered null argument payloads plus typed-argument, malformed-deadline, and result-encoding failures in the invocable activity carrier. InvocableActivityHandler now has no uncovered executable paths.

• Cover portable signal contract validation #477 covered signal-name and portable parameter normalization plus every invalid signal-declaration boundary. Signal now has no uncovered executable paths.

• Cover portable workflow metadata contracts #478 covered portable search-attribute and memo command validation, typed filtering, replay identity, malformed memo envelopes, and full-length text persistence.

• Cover typed search attribute contracts #479 covered typed search-attribute value coercion, persisted aggregate limits and atomic rollback, plus visibility parsing and archived terminal filtering.

Those earlier increments added 1,226 covered production lines against their then-current 522-file inventory without exclusions.

• test: cover query replay outcomes and update boundaries #640 covers query replay of recorded local-activity completion, failure, timeout and cancellation, unresolved waits, operation-kind mismatches, ordered updates, history/command argument authority and missing-method diagnostics. Repeated freshly hydrated queries preserve persisted state and execute no activity body.

• Cover durable selection group query replay #642 covers selection winners and losing groups with pending, reversed completion, first committed failure and cancellation outcomes, plus the durable evidence required to advance completion-before-cancellation boundaries. Fresh repeated queries preserve runtime records and execute no activity body.

• Cover durable group query outcomes after selection #650 covers persisted activity projections and losing timer, signal, condition and child group handles after another selection member wins. Twenty-three new cases verify pending and terminal outcomes, parent-history authority over contradictory child projections, unchanged records and zero activity execution across fresh repeated queries.

• Cover committed signal payload query replay #651 covers committed signal payload query replay, including inline/external Avro values, signal/command/wait identity correlation, application evidence, history authority over contradictory projections, and preventing delivery reuse at a later wait. Eighteen cases verify fresh repeated queries preserve related runtime records.

• test: cover task recovery diagnostics and fleet routing #653 covers workflow/timer recovery diagnostics at lease and repair boundaries, transport metadata, activity/timer compatibility warnings and namespace/connection/queue/build-scoped fleet support. Thirty-three cases verify repeated inspection preserves task records and performs no database mutation after the wait projection is prepared.

• test: ratchet complete-source coverage floor to 89.99% #654 raises the non-decreasing coverage floor from 89.90% to the qualified 89.99% result, preserving the complete source inventory, empty exclusions and 100% target.

• test: cover activity retry and missing-task diagnostics #655 covers activity task and retry statuses, latest activity-correlated retry history, missing transport, policy/route fallback, numeric retry metadata and clearing missing diagnostics when an open retry task exists. Eighteen cases verify repeated fresh observations preserve run/history/activity/task records and issue no database mutations after preparing the wait projection.

• ci: ratchet complete-source coverage to 90.07% #656 raises the accepted floor from 89.99% to the qualified 90.07% result, preserving the complete source inventory, empty exclusions and 100% target.

• test: cover exported replay metadata and validation #657 covers public history-export reconstruction of signal and failure records, inline/external payload representations, terminal codec evidence and field-specific malformed-bundle diagnostics. Twenty-five cases verify exact typed values and timestamp instants, unchanged input and zero database queries across fresh reconstructions. WorkflowReplayer now has no uncovered executable lines.

• chore: ratchet complete-source coverage to 90.15% #658 raises the accepted floor from 90.07% to the qualified 90.15% result, preserving the complete source inventory, empty exclusions and 100% target.

• test: cover local activity retry report validation #659 covers local-activity retry-policy limits, ordered lists, duplicate error types, bounded backoff and malformed attempt metadata. Forty-seven cases verify exact field-specific diagnostics, unchanged input, typed timeout/cold-replay retry reports and the retained 1.18 terminal-attempt synthesis.

• chore: ratchet complete-source coverage to 90.20% #660 raises the accepted floor from 90.15% to the qualified 90.20% result, preserving the complete source inventory, empty exclusions and 100% target.

• test: cover workflow task claim and terminal-run guards #661 covers workflow-task redelivery, wrong task kinds/statuses, terminal-run guards, cancellation committed after claim, and construction-failure diagnostics after rollback. Fourteen cases verify real persisted records, released leases, bounded attempts, original exception identity and zero workflow/history execution.

• chore: ratchet complete-source coverage to 90.22% #662 raises the accepted floor from 90.20% to the qualified 90.22% result, preserving the complete source inventory, empty exclusions and 100% target.

• test: cover webhook validation before durable writes #663 covers malformed webhook start/visibility metadata, instance and selected-run arguments, claims, command batches, failure/heartbeat fields and polling parameters. Fifty-six cases verify exact diagnostics, unchanged durable records, no mutating SQL and no queued/executed workflow work across repeated requests, plus accepted lease-owner boundaries.

• Raise complete-source coverage floor to 90.32% #664 raises the accepted floor from 90.22% to the qualified 90.32% result, preserving the complete source inventory, empty exclusions and 100% target.

• Cover webhook registration and authentication boundaries #665 covers atomic rejection of malformed webhook registration batches, accepted inferred/explicit aliases, authentication before database access across all 35 endpoint shapes, invalid/custom auth configuration, valid authentication, signed-body tampering and custom returned-request authority. Sixty-one cases pass on SQLite and MySQL while preserving durable records and preventing unauthenticated queued/executed work.

• Raise complete-source coverage floor to 90.35% #666 raises the accepted floor from 90.32% to the qualified 90.35% result, preserving the complete source inventory, empty exclusions and 100% target.

• test: cover selected-run webhook controls and update lookup #667 covers selected-run cancellation/termination reasons and repeat-delivery rejection, historical-run control preserving the successor, waiting-run no-work repair audit history, scoped missing/foreign update lookups and immutable inspection of accepted/completed/failed updates. Sixteen HTTP cases pass on SQLite and MySQL with 495 assertions each.

• chore: raise complete-source coverage floor to 90.41% #668 raises the accepted floor from 90.35% to the qualified 90.41% result, preserving the complete source inventory, empty exclusions and 100% target.

• test: cover service-operation commands through task bridge #669 covers externally completed service-operation commands: typed option/provenance forwarding, durable terminal/pending history, sync/async visibility, strict false/zero/empty payloads, failure provenance/defaults, safe redelivery and atomic rejection of malformed batches. Forty-three cases pass on SQLite and MySQL through the real task bridge and persisted models.

• ci: raise complete-source coverage floor to 90.79% #670 raises the accepted floor from 90.41% to the qualified 90.79% result, preserving the complete source inventory, empty exclusions and 100% target.

• Test safe refusal of unsupported failed-run redrives #677 covers public redrive refusals and safe local-class fallback after alias removal, preserving every persisted record and queuing no work on refusal.

• test: cover control-plane query and history guards #679 covers structured query diagnostics, strict typed results, recorded argument validation, namespace isolation and redrive refusal of unsafe history/configuration. Repeated observations preserve raw records and issue no mutating SQL or queued work.

• test: cover control-plane routing and inspection contracts #681 covers public control-plane refusals, class/default routing and start overrides, reserved identity contracts, real redrive lineage/timeouts, historical run selection and read-only action availability.

• test: cover task-bridge execution and failure guards #683 covers task-bridge execution/failure refusals, terminal-run stranded task closure, cancellation after claim, rollback diagnostics and backend/compatibility admission.

• Cover signal-with-start admission refusals and audit contracts #685 covers strict/attempt signal-with-start refusals, correlated admission audits, argument validation, worker compatibility and public input guards.

• Test signal-with-start metadata and run selection #687 covers accepted signal-with-start metadata/deadlines/routing, active-run pinning, completed-run successors and recorded-class resolution/recovery.

Next increment

1. Test accepted child parallel metadata #707 independent main37822528192 is verified PASS1 with strict actual9192 and exact qualified64698 totals/components/uncovered sets. Test public metadata upsert value validation #705 main37816483479 and floor Ratchet complete-source coverage floor to 91.92% #710 main37818625045 are previously verified PASS1 with exact64697 sets/actual9191/9192 floors (#705 verification, #710 verification). All completed resources/heads are removed; preserve originals and use only the existing single isolated failed-job retry policy if needed.
2. Cover embedded service operation execution and replay #709 refreshed3eb is merged and cleaned with exact204gains/no losses/92.21% complete-source proof; independent main37831367574 succeeds on attempt1 with strictactual9192/10000 and exact qualified totals/components/uncovered sets (verification). No local resource remains allocated. Original successful b29 artifact, upstream-source refresh decision, original cache failure and unchanged isolated/fresh/canonical confirmation remain retained. Floor test: ratchet complete-source coverage to 92.21% #714 frozen9f0748e01cb4c1e8d6428b1ee03ea0dfa0516ff1 raises9192→9221 only and is mergedf51ce93b with identical tested/merged treeb2f46cc7. Exact qualified artifact/self-test/old-new scope, initial/final COMMENT and required normal37831721448+optionalAnalyze PASS1. No application/dependencies/manual full; owning completion6067536694 and completed head/worktree/refs cleanup/remoteabsence verified. Independent floor-main37832692373 is queued.
3. test: cover immediate workflow wait execution and replay #713 prepares public immediate condition/signal/timer outcomes, sequential and nested barriers, satisfied-condition precedence, whole payload/output/time/identity assertions, no delayed timer tasks and immutable redelivery/fresh queries. FreshmainAPI/fetchb511f52b/unique clean branch and initial COMMENT are recorded. Prepared0d8b9cf7 preserves reviewed60505865/styled3b420ec6, correcting a public projector model fixture call; original local8/158 ERROR8 and automatically superseded normal runs37824659424/37824919251 CANCELLED1 are retained. Focused SQLitePCOV/MySQL8/222, actual MySQL timer7/66 and readonly ECS/PHPStan pass. Original full3526/44645 ERROR1 existing config-cache106 and unchanged isolated1/4/fresh complete3526/44646 confirmation are retained; hashes/lock unchanged. Prepared normal37825178763 succeeds on attempt1. All initial resources/dependencies/scratch removed18:40:33 before19:00/own-prefix absence/clean checkout verified (prepared proof). Focused executor225 priorfull hits are against Test accepted child parallel metadata #707; net gain after Cover embedded service operation execution and replay #709 remains unverified. Initial cleanup deadline19:00UTC (plan). Frozen final8f89d87a77dd851cb01cac157c1b17941e040c2f safely includes qualified Cover embedded service operation execution and replay #709/floor test: ratchet complete-source coverage to 92.21% #714, preserves605/3b/0d ancestry and keeps338test byte-identical; only testdiffmain/src+version+contracts unchanged. Exact frozenCOMMENT5461892841 is recorded after ordinary push; pre-push prepared-head comment is clarified. Final SQLitePCOV/MySQL8/222, actual MySQL timer7/66 and readonly global ECS/PHPStan PASS. Original complete3540/44915ERROR1 at existing config-cache106 is retained; unchanged isolated1/4 and fresh complete3540/44916 pass with source/test/lock hashes unchanged (final finding). Canonical coverage remains in progress. Normal37832833899 and optional Analyze succeed on attempt1. No sole full dispatch yet/gainunverified. Final PHP1000/MySQL1000/Redis1000/net/image/lock runtime allocated under20:00UTC cleanup deadline set before allocation (final plan).

Recorded constraints and handoffs

• Task snapshot routing discrepancy: public history snapshots record the database connection instead of the task's queue-routing value, reproduced on SQLite/MySQL with an explicit Redis task. Handed to the operating agent; no production correction or assertion blessing the mismatch. Cover embedded service operation execution and replay #709 uses a supported queue alias matching the database-connection name to isolate service behavior while keeping complete payload comparisons. The separate failing probe stays outside committed tests.

• Declared-type contract discrepancy: public normalizer silently discards malformed search-attribute declarations, contrary to the published reject-command contract. Four public diagnostic cases fail their expected rejection, while the separate task-bridge rejection features pass. Handed to the operating agent; no production correction or assertion blessing silent acceptance. Test public metadata upsert value validation #705 continues valid/error metadata behavior tests.

• Reproduced report-union constraint: loaded/unloaded executable-line mismatch. Both typed return branches pass, but maximum-count union retains a constant-null arm only introduced by the unloaded-file report. Handed to the operating agent; no source exclusions, ignored lines, production metric refactor or collector workaround is introduced. Continue reachable behavior tests and keep the 100% target open.

• Unreachable source constraint: DefaultServiceControlPlane retry-tail finding. Continue reachable coverage; make no production metric refactor, exclusions or private-state execution trick to hit it.

• Unused private wrapper: normalizer resolveCommandArguments finding. Actual command families call the codec-aware resolver; the wrapper has no callers. No private invocation or metric refactor; continue reachable public validation behavior.

• Fixed-codec mismatch constraint: nine unreachable normalizer comparison lines. Both canonical codec values can only be Avro; no private registry mutation or metric refactor is used.

• History-export source constraints: six typed-row/callable/native-JSON guards cannot be reached through ordinary public behavior without overriding production collaborators. Source analysis handed to the operating agent; continue reachable export diagnostics with no private hooks or metric refactor.

• Confirmed product defects outside this test-only task: cancellation retains concurrency admission, reproduced on SQLite/MySQL, and activity recovery-summary label. Both findings are handed to the operating agent; the ignored failing cancellation probe is not committed. Keep the target open.

• Scheduling-options defect handed to operating agent: ordinary/combined embedded starts discard requested priority and fairness, reproduced on SQLite/MySQL. Requested1/key/7 becomes persisted5/NULL/1 on the run and first task. Diagnostic probe remains uncommitted; no production fix or assertion of incorrect defaults in this coverage task.

• Historical failed main remains failed: Raise complete-source coverage floor to 91.05% #672's main run 37724442604, attempt 2, exhausted its sole bounded PostgreSQL retry. Exhausted finding; no further retry or duplicate dispatch on that head. Its passing coverage artifact does not make the main run green.

• Runner-budget findings remain recorded: #675's original deadline failure and #678's original failure, along with earlier original failures in this issue's comments. Qualified bounded retries do not erase those findings; runner/production corrections belong to the operating agent.

Completion

Close when the main coverage contract reports 100% against the complete production source inventory.

[rmcdaniel]

Current status: Deferred to a recorded product milestone

This work is intentionally scheduled for the product milestone recorded in the issue. No maintainer action is pending.