Inspect stored PHP state before native upgrade

.github/workflows/server-parity.yml

@@ -646,6 +646,13 @@ jobs:
           cmp parity-evidence/catalog-before.json parity-evidence/catalog-after.json
       - name: Compare separate configured role-token cohort
         run: bash scripts/conformance/server-parity/role-profile.sh mysql
+      - name: Inspect separate published PHP upgrade source without takeover
+        timeout-minutes: 8
+        run: bash scripts/conformance/server-parity/upgrade-source-profile.sh mysql
+      - name: Retire upgrade source cohort
+        if: always()
+        timeout-minutes: 3
+        run: bash scripts/conformance/server-parity/upgrade-source-cleanup.sh mysql
       - name: Compare corrected markers, ranges, clocks and activity expiry
         if: ${{ !cancelled() && steps.prepare_runtime_comparison.outcome == 'success' }}
         # The preceding process-loss case deliberately kills native-a.
@@ -1101,6 +1108,13 @@ jobs:
         env:
           POSTGRES_IMAGE: ${{ matrix.image }}
         run: bash scripts/conformance/server-parity/role-profile.sh pgsql
+      - name: Inspect separate published PHP upgrade source without takeover
+        timeout-minutes: 8
+        run: bash scripts/conformance/server-parity/upgrade-source-profile.sh pgsql
+      - name: Retire upgrade source cohort
+        if: always()
+        timeout-minutes: 3
+        run: bash scripts/conformance/server-parity/upgrade-source-cleanup.sh pgsql
       - name: Compare corrected markers, ranges, clocks and activity expiry
         if: ${{ !cancelled() && steps.prepare_runtime_comparison.outcome == 'success' }}
         env:
@@ -1308,6 +1322,7 @@ jobs:
           mkdir -p cargo-home rust-target parity-evidence
           docker run --rm --user="$(id -u):$(id -g)" --cpus=2 --memory=2g --memory-swap=2g \
             -e CARGO_HOME=/cargo -e CARGO_TARGET_DIR=/target -e CARGO_BUILD_JOBS=2 \
+            -e DW_UPGRADE_TEST_WRITABLE=/evidence -e DW_UPGRADE_TEST_READONLY=/source/parity-evidence \
             -v "$PWD:/source:ro" -v "$PWD/cargo-home:/cargo" -v "$PWD/rust-target:/target" \
             -v "$PWD/parity-evidence:/evidence" -w /source/rust --entrypoint bash \
             mirror.gcr.io/library/rust@sha256:ba81bc3eaa4422af576c0262515d96b0111a628a6ccc2c86557cf55c9a4bbee0 -c \
@@ -1546,6 +1561,17 @@ jobs:
         env:
           RESOURCE_SCOPE: dw-parity-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
         run: bash scripts/conformance/server-parity/role-profile.sh sqlite
+      - name: Inspect separate published PHP upgrade source without takeover
+        timeout-minutes: 8
+        env:
+          RESOURCE_SCOPE: dw-parity-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
+        run: bash scripts/conformance/server-parity/upgrade-source-profile.sh sqlite
+      - name: Retire upgrade source cohort
+        if: always()
+        timeout-minutes: 3
+        env:
+          RESOURCE_SCOPE: dw-parity-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
+        run: bash scripts/conformance/server-parity/upgrade-source-cleanup.sh sqlite
       - name: Compare corrected markers, ranges, clocks and activity expiry
         if: ${{ !cancelled() && steps.prepare_runtime_comparison.outcome == 'success' }}
         env:

.gitignore

@@ -33,5 +33,6 @@ yarn-error.log
 /corrected-marker-adapters/
 /parity-corrected-state/
 /parity-external-consumers-state/
+/parity-upgrade-source-state/
 /scripts/conformance/server-parity/corrected-markers/php/vendor/
 /scripts/conformance/server-parity/corrected-markers/rust/target/

docs/rust-server-port.md

@@ -35,6 +35,12 @@ Updated October 19, 2026.
   the projection corpus has a released-projector case for the pending row.
   Remaining listing gaps are the 413 read budget for long-heartbeat or wide
   runs, six-digit activity timestamps and NULL-row tolerance.
+- **#460 source.** Read-only inspection of an existing PHP database now refuses
+  PostgreSQL triggers and rules like other unknown catalog objects, measures
+  every SQLite queue text value before transfer and refuses values over 4 KiB,
+  bounds MySQL and MariaDB lock waits and statement time on the server, and
+  reports the published payload tables it does not scan yet. It still grants no
+  takeover, backup or quiescence claim.
 - **Diagnosed failure.** Shared run [39092116973](https://github.com/durable-workflow/server/actions/runs/39092116973)
   failed `execution-and-codec` step 9 with exit code 255. The same step
   reproduced locally at `543ed0485` with the exact published image and failed the

docs/rust-server-storage-audit.md

@@ -32,6 +32,44 @@ work can resume. Database-specific column types, collations, timestamps, JSON,
 transaction isolation, locking and migration history still need a complete
 mapping and executable tests.
 
+The published Workflow source at
+[`fbccb54b`](https://github.com/durable-workflow/workflow/blob/fbccb54b8f52e8724847296ee5b89d093b4a91d7/src/V2/Support/ExternalPayloads.php)
+stores provider references as `dw-external-payload:v1:` followed by base64 JSON
+containing `{codec, external_storage}`. The native development runtime instead
+stores `dw-native-external-payload-v1:` followed by JSON containing its opaque
+runtime reference. These formats are not interchangeable with inline Avro or
+with each other. Common HTTP envelopes do not establish storage compatibility.
+Preflight must identify both formats, bind provider and registry state, and
+preserve the original URI, reference identity, codec, size, hash and object
+bytes before a qualified read path or one-time conversion can be used. No such
+conversion or external backup/restore is qualified by the queue inspection.
+
+`runtime::upgrade::external_reference` now prepares a separate metadata reader
+for the canonical PHP v1 format. Its fixture uses released Workflow 2.5.20
+serializer classes whose loaded hashes also match 2.5.21. The locations are
+fictional; no external object was created or fetched. The reader preserves the
+URI, integer size and digest text, requires matching Avro codecs, and refuses
+unknown versions, native opaque references, duplicate/unknown fields, malformed
+base64/JSON, invalid digests and invalid integer sizes. It bounds the complete
+stored string to 64 KiB before decoding. Only canonical padded base64 and the
+tested object fields are supported; other representations refuse explicitly.
+
+The separate `upgrade-payload-inspect` command now scans only
+`workflow_runs.arguments/output` and `activity_executions.arguments/result`
+inside the same read-only snapshot as the schema inventory. It reports per-column
+counts and at most sixteen affected row IDs with static diagnostics. It never
+reports reference locations, hashes or payload contents. A malformed or unsupported
+reference produces an `unqualified` report and nonzero exit. The existing inventory
+and queue commands keep their behavior.
+
+The scan uses primary-key pages of 32 and bounds transferred values to 64 KiB
+before driver allocation. Large inline values remain explicitly unvalidated.
+The original 30-second inspection deadline covers the complete operation.
+No object is fetched. This does not establish nested history/command/memo
+compatibility, registry ownership, object availability, restored bytes,
+reclamation holds or takeover readiness. Every compatibility, backup, quiescence
+and takeover flag stays false.
+
 ## Backup-first, sequential upgrade gates
 
 1. Run a read-only preflight against a consistent PHP reference installation.