[rmcdaniel]

Part of #325: the backup-first in-place upgrade gate. Stacked on #538, the top of the takeover stack; review those first.

A PHP-accepted signal resumed under native

The design asks for an upgrade fixture with an acknowledged signal. The upgrade source author now writes a third original through the raw protocol:

1. It registers its worker with a declared go signal contract, as an SDK worker would.
2. It starts a workflow and completes its first task with open_signal_wait.
3. It sends the signal through the control plane.

Published PHP accepts the signal (SignalWaitOpened, SignalReceived) and makes the resume task, which stays unclaimed.

After the takeover, the resume script accepts the three originals' tasks in any order. For the signal original it checks four things:

• native delivers that task from PHP's rows;
• the claimed history keeps PHP's events;
• its SignalReceived carries PHP's arguments, compared without key order;
• the workflow completes on its original history.

Native's history then reads StartAccepted, WorkflowStarted, SignalWaitOpened, SignalReceived, MessageCursorAdvanced, SignalApplied, WorkflowCompleted, as the embedded host records it.

A PHP lease that expires after the takeover

A fourth original claims its first workflow task under PHP, and its worker then stops. PHP's 60-second workflow task lease is still live at the takeover and expires afterwards. The resume script then checks three things:

• native redelivers the same task as attempt 2 only after PHP's recorded expiry, with PHP's history;
• the expired PHP attempt's completion is refused (409 workflow_task_attempt_mismatch) while attempt 2 is live;
• the workflow completes on its original history.

The author claims it before the signal original, so its poll can't pick up the signal's ready resume task.

Payload inspection

upgrade-payload-inspect also checks the codec-tagged payloads of:

• workflow_commands.payload;
• workflow_signal_records.arguments;
• workflow_updates.arguments and workflow_updates.result.

Each must be an Avro inline value or a qualified reference. The remaining codec-tagged tables (stream items and update validation tasks) are listed as unscanned, and takeover refuses any source that has rows in them (below).

Unsupported features are refused

Some published PHP features have no native implementation yet. Takeover now refuses a source holding rows of any of them, before any write, rather than leaving those rows unread. Each feature has its own reason:

PHP feature	Refusal reason
Runtime credentials	upgrade_source_runtime_credentials_unsupported
Message streams	upgrade_source_message_streams_unsupported
Service definitions	upgrade_source_services_unsupported
Update validation tasks	upgrade_source_update_validation_unsupported
Worker sessions	upgrade_source_worker_sessions_unsupported
Build ID rollouts	upgrade_source_build_id_rollouts_unsupported
Search attribute definitions	upgrade_source_search_attribute_definitions_unsupported

Service calls and external payloads were already refused.

Some PHP tables stay as they are: derived projections (timeline, timer and lineage entries) and PHP's own queue and poll bookkeeping. Native does not read them.

The published source fills none of the refused tables by default. This was checked on a fresh published PHP installation with the three originals.

Checks

• Unit tests:
  • The takeover refusal test now also refuses a runtime credential and a message stream row, each with the file unchanged.
  • The payload scan test expects the new unscanned list.
  • All 44 upgrade tests pass.
• Upgrade source cohort:
  • The cohort now pins the new counts: 4 runs, 7 tasks and 13 history events, plus 8 payload columns holding 11 validated Avro values.
  • The SQLite representations reader accepts the four originals.
  • Locally, the cohort passed with the default source (PHP 2.8.0 layout) on SQLite, PostgreSQL and MySQL, and with the PHP 2.9.7 source on SQLite. In each run the signal workflow completed under native with PHP's arguments, and native redelivered the expired lease as attempt 2 between 0.02 and 2.5 seconds after PHP's recorded expiry. It refused the PHP attempt, and all four workflows completed.

CI

This branch contains the whole takeover stack, so its Shared Server fixtures run qualifies the stack. That run is deferred until #515's lock-pressure retries are on main.

Not covered yet

• Takeover with external payloads, service calls or the refused features.
• Multi-node qualification.

🤖 Generated with Claude Code

[rmcdaniel]

Pushed 6978d60b1: the upgrade fixture now adds a PHP workflow-task lease that expires after the takeover (described above). I cancelled its parity and PHPUnit runs. This branch runs parity once #515 is on main and merged here, so one run qualifies the whole stack.

[rmcdaniel]

Merged main (with #515's probe retries) as 3dab83ea7. The SQLite library (136) and execution (282) suites pass locally on it. This branch's parity run now qualifies the whole takeover stack, #523 through #539.

[rmcdaniel]

Parity run failures so far are infrastructure, not code. Around 16:39–16:40 UTC, mirror.gcr.io refused image pulls with toomanyrequests: Quota exceeded for the pinned Rust, MariaDB and MySQL images. That failed "Fetch locked Rust dependencies" and the codec-deadline-health binary checks before any test ran. I'll rerun the failed jobs once the run completes.

[rmcdaniel]

Run 39454020872 failed in three jobs (execution-and-codec, postgres-storage existing-php-matrix and pg17) for one reason. restart.php compares the recovered terminal resumption's worker task history with the public history recorded before the kill. Since def78ff7e (#532), public history events carry principal and worker task history events do not, so the comparison failed on the field count. The probe now compares the fields both views share (70f610bef).

The SQLite Retire PHP 2.9.7 upgrade source cohort step also failed: it and its profile step lacked RESOURCE_SCOPE, which the other SQLite cohort steps set per step. Both now set it. The profile step had been skipped after the earlier failure, so it would have failed on an otherwise passing run.

The two codec-deadline-health failures (mariadb-10.11, mysql-8.4) were mirror.gcr.io toomanyrequests quota errors at image pull.

I cancelled the rest of the run and pushed ffeccc9a3, which merges main (ef7283006; no Rust changes). The new run qualifies the stack top.