[rmcdaniel]

Release follow-through

Prepare Server 2.9.9 and Helm 0.1.185 for the qualified PHP correction in #525, part of #518 and shared durable-workflow/.github#221.

The runtime prefers an eligible original workflow definition and permits current-code replay when that original is unavailable. Default changed-definition fallback requires an explicit corrected Worker capability; older SDKs do not gain the route implicitly. Canonical pre-entry argument refusals preserve the original task/input/history/deadlines for supported repair. Ordinary application errors remain business failures. Run/queue/repair diagnostics explain the routing decision.

Scope

This PR changes the source-release record and its generated Composer product-train/content-hash, Compose/Kubernetes/Helm defaults and current chart changelog. It contains no dependency resolution or package/reference change. The image retains qualified Core 2.7.2 / 64efa176; separately released Core2.7.3 is not adopted here. Native, shared fixtures, runner, OpenAPI and frozen actors are unchanged.

Evidence and remaining gates

• Initial release head 3a07c5585 passed all applicable normal checks. The required ordinary ancestry update incorporated main's separate Retry the PHP reference's lock-pressure refusals in parity probes #515 fixture change at b67864d1c; its exact tree 9a7fab7832d43eefaad33856073ae61c802d20d3 independently passes all 17 check results (16 successes, one conditional cancellation/prepared-local skip). Sonar API review is OK with zero unresolved issues and 0.0% new duplication. The normal merge is 6a3c67f015aaf4d5eee10073cc730126db66cc0f with that identical tree. Fresh-main checks are newly admitted and pending; no candidate pass is transferred to them.
• Exact implementation 85a81e67e passes every applicable normal candidate check, including feature, MySQL topology, bounded-growth, contracts, boundary and Sonar. Its independent main merge is 64c696884e467ea0230bdb201cd9860f7f60d2e3; fresh-main checks are separate.
• Independent Sonar API review reports gate OK, zero OPEN/CONFIRMED/REOPENED issues, 0.1% new duplication and 100% hotspot review. The valid return-count finding was fixed in source without tuning.
• Three genuine coordinated source originals pass pre-entry refusal/same-original repair, cold-replay refusal without activity re-execution, and ordinary terminal body failure. Original clocks, failed observations and full scope.
• The checked-in release generator writes and verifies all 24 consumers. Local full generator testing has two successful cases; the third is runner-blocked because the Node-only image lacks PHP. An earlier invocation also lacked the worktree Git mount. Those invocations are not full-test passes. Normal repository CI remains the exact release-source gate.
• Source SDK components are merged in PHP#196, Python#176 and Rust#106. Their corrected stable packages are not published yet. Published runtime/SDK installation, recovery and customer-facing diagnostics remain required before closing the parent issues.

No release tag or image is published by opening this PR. After exact source checks and independent main acceptance, publish through the protected immutable release workflow, verify the resulting image digest, then qualify normal installed SDK artifacts against it. Native adoption and Cloud deployment remain separate.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Server 2.9.9 source is independently qualified on exact main 6a3c67f015aaf4d5eee10073cc730126db66cc0f, whole tree 9a7fab7832d43eefaad33856073ae61c802d20d3. All 18 fresh-main check results are terminal: 17 pass and the existing conditional cancellation/prepared-local case is skipped. Independent Sonar analysis is OK on that exact revision. Candidate evidence remains separate.

The immutable 2.9.9 tag points to that commit. Protected release 39462331035 is terminal PASS, including both-platform image publication, bare first-run, source-free Compose, protocol catalog and matching immutable Helm publication.

Independent public-registry reads verify image index sha256:d45d197e9556292ec096531030717e43d69ea4ea9ab197170971492f14cc0869, amd64 child sha256:e0205e8020a313fed123caac764cd479912eca7d4218f74c4a170e88a1dae667 and arm64 child sha256:eecb98ba0f18d7bd690c6e50840848cec373ec130374d76988102bfa2bcd676a. The amd64 OCI configuration labels identify exact source 6a3c67f0, release 2.9.9, publisher 39462331035 and Core 2.7.2 / 64efa176. Independent chart-registry metadata verifies Helm 0.1.185, appVersion 2.9.9, digest sha256:ac3d36af50a0e23e78708097bc21278370aeaafaea4a974b57f48665c0068352.

Core remains locked to 2.7.2 / 64efa176; this is not adoption of Core 2.7.3, native runtime, frozen actors or Cloud. PHP 2.5.4 is published and independently visible on Packagist at exact cd8834a. Python 2.6.2 awaits P1 #177 / PR181's new source qualification; Rust 3.5.6 awaits its final main aggregate before protected publication. Normal installed same-original refusal/repair and customer-facing diagnostics remain required before closing #518/shared #221 or publishing their held documentation.