[rmcdaniel]

Part of #325: migration and cutover.

Stacked on #793, which is in the merge queue. The first seven commits are #793's; once it merges, this PR's diff is only its own commits. This PR's CI tests its head merged into current main.

Native can now take over databases created by the current published release. Until now its inspection refused every Server 2.11.1 database with upgrade_source_catalog_unqualified, because it recognized only the frozen, 2.8.0 and 2.9.7 layouts. I confirmed this against a SQLite database the published 2.11.1 image bootstrapped.

Review tier: advisory (pre-RC native). It changes native takeover, the recorded source layouts, their tests and the parity cohorts. It touches no published PHP surface, credentials, production data or CI trust. Policy: #325 comment 6423232503.

What changed between 2.9.7 and 2.11.1

Core 2.10.2 (in Server 2.11.1) adds one nullable column, observability_context (Core's trace carrier), to workflow_runs, workflow_commands and workflow_tasks. Server's own migrations are unchanged.

Core's migrations run in file order, which gives two real physical layouts:

• Fresh 2.11.1 (or created at 2.8.x or earlier, then migrated): the task carrier comes before 2.9.7's queue_delivery_reference.
• 2.9.x migrated to 2.11.1: 2.9.7 had already added queue_delivery_reference, so the carrier follows it.

The change

• Recorded layouts. rust/upgrade/php-2.11.1 and rust/upgrade/php-2.11.1-from-2.9.7 record the deltas for SQLite, PostgreSQL 17, MySQL 8.0 and MariaDB 10.11. They were read from databases the published images created: fresh 2.11.1, and 2.9.7 then migrated by 2.11.1, where the 2.11.1 bootstrap ran exactly Core's three carrier migrations. The chain grows to four layouts. MariaDB through Laravel's mariadb connection adds +mariadb-driver to either name.

• Conversion, as decided on #325:

  • Takeover counts the carried values, reports them as observability_contexts_removed, and drops the three columns.
  • The rest converts as for 2.9.7: incarnations adopted, queue_delivery_reference dropped.
  • MySQL and MariaDB do this in journal step 9. It counts every carrier before dropping any column, so an interrupted takeover repeats it safely.
  • Native has no carrier, carriers are not business state or history, and the verified backup keeps them.

• Search attribute definitions. Takeover no longer refuses a source holding custom definitions, a guard from before native served them. Native reads PHP's rows as they are, to list them, type upsert_search_attributes values and filter visibility.

• Worker sessions. Takeover no longer refuses a source holding worker sessions.

  • Native serves sessions from PHP's own rows, but it also records which registration incarnation holds each one (dw_worker_session_holders). A session whose holder is no longer the worker's current registration is orphaned.
  • Takeover therefore records, for each active PHP session, the lease owner's current (adopted) incarnation as its holder, and reports session_holders_recorded. MySQL and MariaDB do this inside journal step 3, with the incarnations.
  • Without it, native reads the session as orphaned / worker_registration_replaced on first read. I checked this by removing the insert and watching the test fail.

• CodeQL. The variable rename promised on Rust #325: Nexus catalog administration, service-call execution, admission limits and call reads #793 clears CodeQL's two false-positive cleartext-logging alerts in rust/tests/execution/service_endpoints.rs. A test variable named billing becomes first_endpoint; no test data changes.

• CI. Each database job's upgrade cohorts gain a labeled run against the published 2.11.1 image, as 2.9.7 has: back up, inspect, fingerprint, take over and resume.

• Worker-sessions contract. Rust #325: Nexus catalog administration, service-call execution, admission limits and call reads #793's first merge group failed on reacquire_terminal with ttl_span 1799 against the recorded 1800. That is a race in the published PHP reference: it computes ttl_expires_at from its request clock, then Eloquent stamps created_at at insert. The contract now reads a span exactly one second short as the recorded one, and nothing else; its tests check that two seconds short and one second long still fail. Native stamps both from one clock reading.

• Docs. A checkpoint (docs/rust-server-port-checkpoints/2026-10-26-php-2111-takeover.md) and a corrected port-log paragraph. The earlier "refuse rows that carry trace context" text predated the Replace PHP Server with a compatible Rust runtime and safe in-place upgrade #325 decision.

• Service calls. Takeover no longer refuses a source holding Nexus service calls.

  • Native serves them from PHP's own rows, but it keeps each deadline in dw_service_call_deadlines. Takeover copies 2.8.0+'s call_deadline_at there before dropping the column, and reports service_call_deadlines_copied. MySQL and MariaDB copy in journal step 6, and only what is not copied yet.
  • PHP's shared admission counters live in its cache and don't carry over.

• Repair-pass deadline sweep. The pass reported its service-call timeout counters as zeros. It now enforces call deadlines as PHP's TaskWatchdog::runPass does:

  • up to 25 admitted open calls past their deadline, earliest first, within the pass's runs and instance;
  • a requested connection or queue matches the caller's or linked run exactly; a call with neither run matches any scope;
  • each call expires under the transition lock.

  Native still expires a call lazily when it is read; the sweep covers reads that don't, such as the catalog call list.

Still refused at takeover, each a separate conversion to come: runtime credentials, message streams, update validation tasks (pending ones need a decision once their waiting caller is gone) and external payloads.

Qualification

• Real published databases: native prepared, fingerprinted and took over a SQLite database bootstrapped by the published 2.11.1 image (php-2.11.1) and one bootstrapped by 2.9.7 and migrated by 2.11.1 (php-2.11.1-from-2.9.7), each taken_over.
• SQLite: all 53 upgrade tests pass, including:
  • takeover_converts_php_2111_databases_and_drops_their_trace_carriers, which builds both variants, seeds a run and a task carrying a trace context, and checks the layout name, observability_contexts_removed: 2, the dropped columns and that native opens the database;
  • takeover_keeps_php_search_attribute_definitions_that_native_then_lists;
  • takeover_keeps_php_worker_sessions_held_by_their_current_registration;
  • takeover_keeps_php_service_calls_and_their_deadlines, which also checks that the repair pass then times the due call out;
  • the extended chain unit test.
• PostgreSQL 17, MySQL 8.0, MariaDB 10.11: qualification_takeover_converts_php_2111_and_native_opens_it passes for both variants, including a held worker session and its recorded holder, and a service call and its copied deadline. Every other takeover qualification test passes too: PostgreSQL 6, MySQL 7, MariaDB 7, including the MySQL journal kill-at-each-step test.
• Execution: the_repair_pass_times_out_calls_past_their_deadline, with the service-call and repair-pass tests (23).
• Full native suite on SQLite at c8b87bd16 (cargo test --all-targets): lib 332, execution 557, upgrade_inspect 2, all passing.
• No PHP app/ changes.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Requeued pinned to c8b87bd16 at 23:41Z after the first merge-queue group failed.

The group's execution-and-codec (corpus) job (run 40418397301) failed on the published PHP 2.11.1 record, not the native one. The artifact's php.failure-excerpt.txt reads service-calls (product-fail): rated[0]. PHP answered 429 to the first call of the fixture's rate-limited operation, whose per-minute window should still have been empty.

This PR does not touch service calls' admission, the service-calls fixture or PHP. The same fixture passed on this head's own PR run and in #793's queue group. The retained PHP logs only cover the last two minutes of the job, so they show the job's later SQLite database is locked errors but not the 23:26 call. I'm handing the reference flake to General with this evidence.

[rmcdaniel]

Source diagnosis for the published PHP rated[0] failure: Server 2.11.1 contains a direct mechanism matching the observation; this is not a Rust #795 source regression.

SharedServiceBoundaryPolicy::admitWithLock() increments the per-minute cache counter before ServiceCallBoundary::admitFor() writes the durable service-call audit row. If that insert throws under SQLite lock pressure, the boundary catch calls release(), but the shared policy tracks and releases only concurrency keys. The consumed rate key remains for the minute bucket. The fixture's bounded lock-pressure middleware then correctly retries the original 503, and that retry sees the already-consumed one-call budget and becomes the observed 429. The same ordering and rollback gap remain at this PR head.

This source path explains the evidence but has not yet been replay-reproduced with an injected lock at the audit insert. Classification is admission-accounting/availability: the limiter fails closed and can overcount a request that never became durable. I found no authentication bypass, cross-tenant access, or reason to hold the native change.

The PHP repair should use a distinct failed-admission rollback, not ordinary completion release. Store the exact boundary/namespace rate and concurrency keys reserved during evaluation; on audit-record failure, decrement all of those keys under the existing lock. After a durable admission succeeds, normal completion must continue to release only concurrency and must not refund rate capacity. The exact stored keys matter if the rollback crosses a minute boundary.

Focused acceptance: force the audit insert to fail after a one-request rate reservation, verify a retry is accepted and the next fresh request is limited; preserve normal post-success rate consumption and concurrency release; cover rollback across a minute boundary; then rerun the published SQLite fixture with the one-second maintenance loop. The existing PR requeue can proceed independently.

[rmcdaniel]

Requeued again pinned to c8b87bd16 at 00:05Z. Group run 40421521721 failed the same way: on the published PHP 2.11.1 record of service-calls, not native's. The PHP record's php.failure-excerpt.txt reads service-calls (product-fail): catalog handler failures[1].data: length (5 !== 4), one extra handler-failure call in PHP's own catalog list. General tracks the PHP defect as #796.

[rmcdaniel]

Merged through the merge queue at 00:29Z as b4bdf82663af909cbc78a8787b0d9a1bac07356f (tree 1a96ef625504db786d934450e6cbf456f29973ef, parents eec4251a9eb57c8fdb249b8b7ae1e00781ddd3ca and the tested head c8b87bd16c2badd0d7e7ac7d2f743414cfec6a22). The third group run passed. The two earlier groups failed only on the published PHP 2.11.1 record of service-calls, which General tracks as #796. Follow-ups (maintenance loop, runtime credentials and update validation kept at takeover, 2.11.3 takeover, CI adapter cache) go up next as one PR.