Preserve namespace when repairing missing runtime tasks

[rmcdaniel]

Customer outcome

When Native recreates a missing workflow, activity or timer task, keep it in
the original run's namespace so the correct Server workers can discover it.

Defect

All seven missing-task creation paths in src/V2/Support/TaskRepair.php omit
namespace. The original run remains namespaced, while the new task has NULL.
Server polling and queue visibility filter by the task's namespace. Redispatch
does not correct the missing namespace.

The defect exists on current main 70d4fe48efd7dd796c35c1078b3d5ac43f738f4f.
It was found while tracing the ready, unclaimed recovery task in
PHP connected cancellation.
That run retains one stop acknowledgement and no cancellation delivery, while
run diagnostics show a Ready task and the namespace queue shows zero Ready
tasks. Its raw capture lacks the task row's namespace, so the precise original
race still needs deterministic reproduction rather than inference alone.

Acceptance

• Recreated workflow, activity, timer, condition timeout and signal timeout
  tasks inherit the exact original namespace, including legacy NULL.
• Scoped polling finds the repaired workflow only in its original namespace.
• Cover repair before a cancellation stop acknowledgement without changing
  the original request, callback fence, delivery boundary or deadline.
• Run the owning quality and supported database gates, publish the ordinary
  runtime fix and verify affected published consumers. Cooperative protocol
  activation remains the separate acceptance gate in shared workflow run on browser #136.

[rmcdaniel]

Namespace repair reproduced and corrected

Workflow#605 is an independently shippable released-runtime defect, with
draft PR606 at
5a01b502a2cdc8e0f518a34c2341c569dcbf35c2. All seven missing task paths omitted
the run namespace. Namespace-scoped discovery could not see those tasks.
Eligible redispatch/recovery now also restores a missing namespace, preserving
existing namespaces and fresh tasks/current leases.

The new 35-case creation/recovery/guard inventory has twenty expected failures
against original main, then the full task-dispatch class passes 56 / 387,
zero errors/failures/skips. Original dependency lock and all 125 installed
tuples are unchanged. Static analysis and shard inventory pass locally.
Ordinary PR CI
passes. Full supported-database/quality CI
is running. Product-train is prepared for Workflow 2.3.4. No publication yet.

The cancellation candidate receives the same runtime correction plus a
deterministic test that forces the repair pass between Wait claim release
and the original stop acknowledgement. Original Native fails 1 / 7 at the
missing namespace. Corrected affected classes pass 135 / 1190. A final
additional before-deadline assertion passes in the exact case 1 / 24.
The request ID, deadline, callback ownership, original stop receipt, single
resume identity and stale publication fence are preserved. Candidate static
analysis passes with a 1 GiB analysis limit after the original 512 MiB analysis
process exhausted its configured memory. No container resource ceiling changed.

This reproduces the ready/unclaimed and queue/run visibility pattern from the
failed PHP connected run. That original artifact did not capture the task row's
namespace, so this deterministic proof does not fabricate that missing field.
Another connected run will use the corrected Native source, with the same PHP,
Server, Python, Rust and CLI inputs. The original failed run stays retained.
Shared #136 remains open and all cooperative source PRs remain drafts.

[rmcdaniel]

Runtime gates pass, final upload needs retry

Full run 37266143765
at 5a01b502a2cdc8e0f518a34c2341c569dcbf35c2 completed failure because the
Codecov uploader download hit a TLS handshake failure. Its required signature
file was unavailable, so verification refused the upload. The final build gate
correctly failed. No unsigned uploader or bypass is used.

All runtime/database/quality steps pass. Independently downloaded inventories
verify all 111 feature files / 1520 unique cases once per database. MySQL
passes 1520 / 14425, with three existing skips. PostgreSQL passes
1520 / 14366, with eight existing skips. Both execute the complete task
dispatch/namespace class 56 / 387, with the same identities and assertions
as the local pass and no skips in that class. MariaDB, Laravel 9–13 upgrade
checks, style, static analysis and corpus gates pass.

Coverage measurement and ratchet enforcement pass at 88.33% (55340/62650),
above the required 87.85%. The 100% target remains outstanding. Codecov
upload is the sole failing work step. I am rerunning the failed coverage/upload
and final gate only, preserving the passing database jobs and original failed
attempt. PR606 remains draft and publication waits for that gate.

[rmcdaniel]

Corrected connected source qualification

Run 37266432981
passes on the frozen source tuple PHP 92c0f05f, Server 92e9f128, Native
89f46d44, Python 3c77a010, Rust 08824f29, CLI 933c554f.
Only Native changed from the preceding retained failed tuple.

• Cancellation: 39 tests / 2157 assertions, zero errors/failures/skips.
  The preceding 39-case inventory is unchanged.
• Memo restart: 1 / 67, zero errors/failures/skips.
• Mixed PHP parent, Python child, Rust remote Activity and PHP local Activity:
  237 assertions / 24.347335 seconds, within the original 30-second budget.
• All eight remote stop evidence sets retain the original request/deadline,
  task/attempt/owner fence, actual callback stop and canonical acknowledgement.
  The lost-reply case now resumes and completes cleanup. Application heartbeat
  remains absent in its no-heartbeat cases.
• Hosted task stack and images were removed successfully.

The artifact is 11327325939,
retained until 2027-01-03 05:08:14 UTC. An independent verifier checked the exact
tuple, complete case inventory, receipts, worker diagnostics and cleanup.
Its initial assumption that the history API exposed event row IDs was corrected
against the actual response. IDs are verified through the accepted receipt and
worker diagnostic, with the canonical history payload independently matched.

The deterministic repair ordering reproduction and runtime correction are owned
by Workflow #605.
The original failed run remains retained. Candidate protocol 1.20 remains
unfrozen and unpublished, worker scope execution disabled, and shared #136 open.
The remaining scope model, inspection surfaces and exact published-artifact
qualification are still required before closing the customer outcome.

[rmcdaniel]

Coverage download correction

Both attempts of full run 37266143765
at 5a01b502 passed runtime checks and the 88.33% coverage threshold, then failed
TLS while downloading Codecov from cli.codecov.io. The signed checksum download
failed at the same host. The failure remains recorded and was not bypassed.

The official CLI release 11.3.1
asset codecovcli_linux, publisher asset ID 470877726, downloads successfully
from GitHub. Its SHA-256 is
ca1d64196d2d34771084afe76ea657d581bf628e31d993ff8e52ea09cc88a56d.
The downloaded bytes match the publisher metadata. The binary reports 11.3.1
in an isolated container after checksum verification.

Commit 826a3569c5128f044d2f468a5c670dc3975eca28 pins that exact version and
checksum in the existing coverage job, verifies it before execution, and gives
the verified path to the pinned Codecov action. This replaces the action's
dynamic GPG download with a committed, reviewed SHA-256 pin. Neither uploader
errors nor runtime coverage thresholds are made optional. No application runtime
bytes changed from the already tested namespace correction.

Full qualification 37267890798
is running at the new exact source. Publication remains pending its required
checks. The downstream Server API test independently reproduces the namespace
failure in four cases against 2.3.3 and passes the corrected complete class,
18 tests / 213 assertions, under a source-only TaskRepair overlay. Its published
package and image checks follow the qualified Workflow release.

[rmcdaniel]

Pinned consumer follow-through

Current source inspection and live release metadata establish:

• Server main 7a592593 pins Workflow 2.3.3 at 70d4fe4. A rebuilt published
  Server 2.4.40 must install Workflow 2.3.4, preserve other locked dependency
  identities and publish both supported architectures. The four-case Server
  repair API regression is committed at 29bf6026. The source-overlay complete
  class passes 18 / 213 and all 118 original dependency tuples remain.
• Sample App main and microservice lock Workflow 2.3.2 at d8594a6 under ^2.0.
  Both locks need the published correction. Its PHP playground runtime uses
  only the framework-neutral SDK and needs no Native package update.
• The Sample App qualified tuple currently records Server 2.4.37 / Workflow
  2.3.2. Update that declaration only after verifying the new exact published
  tuple. Its prior recorded Rust 2.1.3 is distinct from current stable 2.1.5.
• Waterline's Native 2.0.1 pin is development-only. The application controls
  its embedded runtime dependency. Verify the embedded published consumer
  through Sample App and the remote Server inspection surface, without
  publishing an unchanged Waterline package merely to align versions.
• SDK runtime semantics and the worker protocol are unchanged. No SDK or CLI
  release is needed solely for this correction. The live stable versions for
  affected published conformance are PHP SDK 2.1.6, Python SDK 2.3.9,
  Rust SDK 2.1.5, CLI 2.1.3 and Waterline 2.0.9.

The selected checks are exact published Workflow installation/platform contract,
Server repair API discovery/claim/completion, its affected source suites and
published PHP/Python/Rust workflow lifecycle/recovery. Inspect the published
image's locked package source and source release identity rather than relying
on tag names. Sample App's two embedded consumers and public tuple follow the
verified artifacts. Managed Cloud image qualification and deployment decisions
remain in its private owning issue. No Cloud rollout is claimed by this record.

Current full Native gate: 37267890798 at 826a356. Publication and the above
consumer outcomes are pending. Keep #605 open until these are delivered.

[rmcdaniel]

External coverage reporting and required qualification

Run 37267890798
at 826a356 passes every runtime/database/Laravel/corpus check, the coverage
ratchet and the pinned uploader checksum. The Codecov upload subsequently
fails after its retries. A direct TLS probe of ingest.codecov.io reports an
expired public certificate, with notAfter October 4 23:59:59 UTC. This is
reported as observed endpoint evidence, not a claim about every Codecov user.

The required product qualification is actual passing tests and measured
coverage. Commit 6d4e3ac keeps those gates, the unchanged coverage floor and
the uploader checksum required. It makes the external reporting step best
effort, retains its actual failed outcome and emits an explicit CI warning.
Raw coverage summaries and feature artifacts are retained before reporting.
No TLS validation, checksum check, runtime test or coverage ratchet is disabled.
The upload is not claimed successful when it fails.

Full qualification 37268817058
is running on the new exact head. The preceding failed runs stay retained.
Publication waits for the required test and coverage gates. Application and
regression test bytes remain unchanged throughout the CI correction.

[rmcdaniel]

Workflow 2.3.4 published, downstream verification underway

PR606 is merged as
e66d224. Its tree exactly matches qualified
adaed276295728f641ac5b10f59be4ead878ec88. The merged remote branch is deleted
and verified absent. The immutable tag and release2.3.4
are published. Packagist advertises2.3.4 with source and distribution reference
e66d224.

The required full source run37268817058 passes. Independent verification
confirms complete1520-case MySQL and PostgreSQL inventories and exact56/387
dispatch classes. Coverage88.33% (55341/62650), unchanged87.85% floor.
External Codecov upload remains unavailable with an explicit warning and raw
coverage artifacts retained. It is not claimed successful.

Published package/Laravel verification37269932357
is starting at the exact published source. Server2.4.40 will install this
published package and run its affected API tests before reviewed image release.
The two Sample App embedded locks and affected published PHP/Python/Rust
recovery follow. #605 stays open until those consumer outcomes are complete.
Candidate protocol1.20 and shared136 are unchanged by this stable patch.

[rmcdaniel]

Workflow 2.3.4 is published at e66d224:
https://github.com/durable-workflow/workflow/releases/tag/2.3.4.

The published-package contract and all 16 supported Laravel/PHP upgrade cells
passed in https://github.com/durable-workflow/workflow/actions/runs/37269932357.

Server consumer work is in durable-workflow/server#299.
A fresh Composer installation of the actual published 2.3.4 package passed
all 50 affected cases and 392 assertions, including all 18 repair API cases
and 32 package API floor cases. The installed runtime source/dist reference
and repair bytes match the release. The other 117 installed dependency tuples
are unchanged. Server 2.4.40 source metadata is prepared and repository CI
is running.

Next: qualify and publish the exact multiarch Server 2.4.40 image, verify its
package contents and repair behavior, run the affected published PHP/Python/Rust
lifecycle/recovery, then update and qualify both embedded Sample App consumers.
This issue remains open for that downstream delivery. No unchanged SDK release
or Cloud rollout is implied.

[rmcdaniel]

Server 2.4.40 is published and its exact image is verified:
https://github.com/durable-workflow/server/releases/tag/2.4.40.

Immutable digest:
sha256:1f34d9dc4bfcfff281a35a6e6f0490be313ef481952a5d56755b4fa10e576116,
amd64 and arm64. Source e478c8e0bb694725a9d6753aab67d3a9619665e7,
with Workflow 2.3.4 from e66d224.
PR299 is merged, its remote branch is absent, and tag2.4.40 is immutable.

Protected publication, bare first-run readiness, source-free Compose,
protocol catalog convergence and Helm0.1.136 anonymous installation pass:
https://github.com/durable-workflow/server/actions/runs/37271564195.

All12 published lifecycle cells pass, with no missing cell/evidence or runner
blocker. The exact tuple is Server2.4.40, Workflow2.3.4, PHP2.1.6, Python2.3.9,
Rust2.1.5, CLI2.1.3 and Waterline2.0.9. PHP's14 conformance scenarios also pass:
https://github.com/durable-workflow/server/actions/runs/37272048053.

A separate real HTTP drill in the unchanged published amd64 image passes
all four default/custom namespace and missing/orphan task combinations.
Each task becomes visible in its original namespace, remains excluded from
another namespace, is claimed and completes. Independent verification checks
all38 raw HTTP responses, four distinct runs/tasks, OCI identity, provenance
and installed repair bytes.

Raw evidence is retained as release assets and was independently downloaded
and byte compared after upload:

• Published HTTP repair evidence,
  119360bytes, SHA-256 b375f4119393256130f888d6b21ad21ca25c5fe587ae4d2f1e36aab560c0f8e6.
• Original published lifecycle artifact,
  2719671bytes, SHA-256 4b082c24faed897df9ed971c4d8bacb5c4c0ad661a93ddddfd414c79bd256c5c,
  matching the original GitHub artifact digest.

The downstream example update is
durable-workflow/sample-app#137. Its microservice MySQL
jobs pass on PHP8.4/8.5, while both main application jobs currently fail and
are being investigated. Required polyglot/Compose/image checks are still
running. Workflow605 stays open until that consumer update is qualified and
landed. This publishes the stable1.19 repair fix. Cooperative1.20 candidate
publication and the stronger cancellation acceptance remain separate work.

[rmcdaniel]

Sample App PR137 is merged:
durable-workflow/sample-app#137.
Target commit5a3ee547bc4b84733c79d6a0e4612176d1eea7be has the exact qualified
tree97423a537b6eb50f0ed499212436a30f7116864c. The merged remote branch is deleted
and verified absent.

Both Laravel application locks install published Workflow2.3.4. The polyglot
and prepared playground consumers select Server2.4.40 and the verified published
PHP2.1.6/Python2.3.9/Rust2.1.5 tuple. Both Rust locks now match that tuple,
including SDK2.1.5's required exactuuid1.26.1 dependency. Other installed packages,
Cargo manifests and behavioral tests remain unchanged.

All11 candidate checks pass. Normal PHP8.4/8.5 MySQL tests, published polyglot
workflow, Compose embedded workflow samples and candidate Codespaces startup
qualification are recorded on the PR. The candidate image completes startup
qualification in41seconds, including locked offline Rust compilation and
prepared SDK doctor checks.

Protected main publication is now running for both development image
architectures on that merged commit:
https://github.com/durable-workflow/sample-app/actions/runs/37273979941.
This issue remains open until published image qualification/promotion and the
target-branch consumer checks finish. Stable runtime namespace repair is already
published and verified in Workflow2.3.4 and Server2.4.40. Cooperative1.20 remains
separate and unpublished.