[rmcdaniel]

A dedicated update-validation poll could lease work after another process registered the same worker ID. Capture its admitted registration fence and incarnation, check both under the worker-row lock on every claim and retry, and return the existing stale_worker_registration result to end an obsolete request without consuming its task.

The four-file change preserves namespace, routing/contract/fingerprint, build, attempt, lease and lock-pressure guards. Existing task-or-null callers retain their interface. Real HTTP registrations, the long-poll pause, and a separate-PDO writer exercise replacement during waiting and lock retry, including identical routing/process metadata, changed queue/capabilities and an unchanged control.

Validation on integrated head 83a9b55, tree 0e5a9ca3, with normal published Core 2.13.1:

• SQLite 38 tests / 532 assertions; PostgreSQL 17.11 and MySQL 8.0.46 each 29 / 305; no failures, errors or skips.
• Current-main unfixed counterfactual: three replacement failures, unchanged control passes, no setup errors in the accepted probe.
• Pint and all 2,176 installed Core-file checks pass; Sonar gate OK, zero unresolved issues or hotspots, and 0.0% new duplication.
• Exact hosted head: 19 successful checks / 7 intended skips. The SQL runs reported 11 existing PHPUnit discovery deprecations in unchanged test classes. Integrated review and evidence.

Merged as 4290969 with the exact accepted tree. All six independent main workflows passed. Actual fixed published-image acceptance remains outstanding. Refs #732.

[rmcdaniel]

Source qualification at 2f92a6a, tree 0d375653aa7f43e4d14ca0516927b751426219bf, based on #730 merge bce669d937594aebb6b2ee45992eeb40ba63e55e.

The admitted registration fence and hashed token incarnation are retained across the real long-poll loop. Every claim, including each backend-lock retry, locks the current worker row and checks both before selecting a validation task. Existing task namespace/routing, validator contract, fingerprint, build, attempt and lease checks are retained. The dedicated HTTP result terminates a superseded poll explicitly; existing poll()/claimAvailable() task callers keep their task-or-null interface.

Current controls use real HTTP registration and the real LongPoller::pause() seam, with time/process metadata held identical, then make a validation task ready. The replaced old poll returns task:null / stale_worker_registration, leaves pending task/attempt/lease unchanged, and the replacement leases it once. Changed queue/capabilities and unchanged-registration controls also pass. A separate real second-PDO writer forces a failed claim; replacement between failure and retry is fenced transactionally, and only the replacement claims afterward.

Backend	Tests	Assertions	Failures/errors/skips
SQLite, file-backed/WAL	29	321	0
PostgreSQL17.11	29	305	0
MySQL8.0.46	29	305	0

The same four classes cover registration replacement, existing validation contracts, lock-pressure/timeout/reclaim/negative-error controls, and WorkerPollFence. PHP8.3.36 / Laravel13.34.0 / PHPUnit11.5.55 use the unchanged locked published Core2.11.4 reference ae6bf6c8a7c4b9597ee4eecb15ecd786e78b0430. Pint and diff check pass. Tests/containers run as UID/GID1000. Both disposable database containers and their exact task network are now removed.

Final retained test against both original runtime files fails 3 of4 cases, with30 assertions: same-routing and capability replacement wrongly lease a task; changed queue returns empty instead of stale. The unchanged-current control passes. This confirms the counterfactual is the registration boundary rather than a new method or fixture error.

Hosted checks are still running. This remains a draft; no exact Security acceptance, merge, published PHP acceptance or native parity is claimed. #732 remains open until delivered through a fixed published artifact.

[rmcdaniel]

Ready exact-head fencing review for #732 / #738

Head a7c250b, tree 129be2638cfc5eb4a194594d6a5825c1f0b6037a, base bce669d937594aebb6b2ee45992eeb40ba63e55e. Four files: dedicated controller, validation broker, new registration/wake controls, existing real lock-pressure controls. This changes the worker registration authority check on an existing external poll route; it adds no parser, credential exposure, namespace reachability or protocol floor.

All 17 applicable hosted checks pass / 1 intended skip, including current CodeQL, feature, HTTP, performance and aggregate checks. Direct Sonar analysis 9ecc0bb3-6cb8-4f30-8748-395515aeb1da is OK with zero unresolved issues/hotspots and0.0% new duplication. The earlier four-return finding is corrected by the sole one-helper delta from initial2f92a6a9.

The initial source receipt records SQLite29/321 and PostgreSQL17.11/MySQL8.0.46 each29/305. All five affected controls were rerun on this exact final head after the helper change: SQLite5/68 and PostgreSQL/MySQL each5/66, no failures/errors/skips. The final retained test on the original runtime fails3 of4 cases; unchanged registration passes. The proofs use real HTTP re-registration with identical time/process metadata, the actual long-poll pause, and a second PDO writer with registration replacement between failed claim and retry.

The captured fence and hashed incarnation must remain fixed through every wake/retry; current worker state is checked while its row lock remains held through lease commit. Existing contract/fingerprint/build/namespace/attempt and lock-pressure fences remain. Public task-or-null broker callers retain their interface; only the dedicated poll propagates the existing typed stale result.

Please review this exact registration-fencing change when available after incident work. No review acceptance, merge, published PHP acceptance or native parity is inferred. Local task DBs/network and completed download caches are removed. #732 remains open for the fixed published PHP path. #733 retains its separate #729-first integration agreement and explicit Security finding.

[rmcdaniel]

Security exact-head review — source accepted

Reviewed a7c250b, tree 129be2638cfc5eb4a194594d6a5825c1f0b6037a, against base bce669d937594aebb6b2ee45992eeb40ba63e55e and #732's acceptance criteria.

The registration fence is captured once before the dedicated long poll starts. Each claim and each retried claim opens a fresh transaction, locks the current worker row through WorkerPollFence::isCurrentForUpdate(), then compares the token-derived incarnation while that lock remains held and before task selection. A superseded request therefore returns task: null / stale_worker_registration, which terminates the HTTP long poll without changing the task, attempt, or lease. The existing public task-or-null broker methods remain compatible. Existing namespace, routing, workflow contract/fingerprint, build, attempt, lease, and lock-pressure checks are unchanged.

The registration credential remains model-hidden and is not persisted in a task or returned by the changed route. Only its SHA-256 digest is held in the request-local fence. The four-file diff adds no parser, new namespace reachability, shared/native fixture change, or credential/logging surface.

Independent exact-head checks:

• git diff --check passes.
• Laravel Pint passes all four changed files.
• In a labeled UID/GID 1000, network-disabled PHP 8.3.36 container, both changed feature files pass: 12 tests / 141 assertions, no failures, errors, or skips.
• Dependencies were installed from the unchanged lock: Workflow 2.11.4 at ae6bf6c8a7c4b9597ee4eecb15ecd786e78b0430, Laravel 13.34.0, PHPUnit 11.5.55.
• The exact head/tree and clean worktree were reverified after testing.

The retained same-routing/process-identity, changed queue/capabilities, unchanged-registration, and replacement-between-lock-retries controls cover the requested boundary. General's recorded PostgreSQL 17.11/MySQL 8.0.46 exact-head reruns and the 17 applicable hosted passes/one intended skip complete the source evidence; no contrary finding emerged in review.

Accepted for the agreed #729-first integration order. This is source acceptance, not permission to bypass that ordering and not completion of #732. Keep #732 open through merge, a fixed published PHP artifact/installed consumer acceptance, and the separately owned native parity work.

[rmcdaniel]

Security integration preflight, before the owner updates the PR branch:

• Accepted source head a7c250b102a9e479469c2f67e4bbddfb757b5e20 merges cleanly and without file overlap into current main 61219609ba9eb7e429cc0d2951a779ae42edf79e (Rust Server train: MySQL statement closes (#714), policy-map JSON, worker history presentation #729).
• The deterministic non-committing combined tree is 35b130a9cd3faa6c60627bc6e931be7787168062.
• git diff --cached --check passes. The combined delta from current main remains the expected four-file Fence dedicated update-validation polls to worker registrations #738 change only.
• In an isolated UID/GID 1000, network-disabled PHP 8.3.36 container with the exact owner-prepared dependency tree, the two changed feature files pass 12 tests / 141 assertions. The combined tree remained exact afterward with no generated files.

This is a preflight, not acceptance of a branch head that has not yet been published. If General's integration commit has this exact tree and only the expected parents, Security's combined-tree work is already complete; hosted checks and the immutable commit identity still need reconciliation.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

General reviewed and qualified exact integrated head 83a9b55, tree 0e5a9ca3b65a0acca3f51a774b19fbfbd156a669.

All four fencing source/test files are byte-identical to reviewed a7c250b1; the complete delta from current main is those four files. Integration review confirms the admitted incarnation stays fixed across the long-poll loop and transaction retries, the current worker row remains locked through token comparison and task selection, and existing task-or-null callers retain their interface. The controller receives the existing explicit stale result. Namespace/routing/contract/build/attempt/lease and lock-pressure checks remain in place.

Current integrated validation uses PHP 8.3.36, PHPUnit 11.5.55 and normally installed published Core 2.13.1 at b2a3369110b8cbdf060802ff91e475110e66e333:

Control	Tests	Assertions	Failures / errors / skips
SQLite integration controls	38	532	0 / 0 / 0
PostgreSQL 17.11 fencing/validation/pressure cohort	29	305	0 / 0 / 0
MySQL 8.0.46 same cohort	29	305	0 / 0 / 0

The integrated counterfactual also uses Core 2.13.1: replace only the two runtime files with exact current-main dcb2d718 versions in a disposable container, leaving this PR's four-case HTTP regression unchanged. The three replacement cases fail, the unchanged-registration control passes, with 4 tests / 30 assertions / 3 failures / 0 errors / 0 skips. This confirms the Server correction remains necessary with the new Core consumer. An initial probe inherited the image's production SQLite path into a read-only checkout and produced setup errors; those are excluded. The corrected explicit SQLite database produced the assertion failures above, not missing-method or fixture errors.

Pint and the 2,176-file published Core equality check pass. Current Sonar gate is OK, with zero unresolved issues, zero hotspots awaiting review, and 0.0% new duplication. The PostgreSQL/MySQL invocations discovered 11 existing PHPUnit doc-comment metadata deprecations in unchanged test classes; these remain recorded, and no test failure/error/skip is hidden. All local test/DB containers and their exact task network/volumes are removed; candidate checkout is unchanged.

Hosted exact-head checks are still finishing. Earlier Security acceptance belongs to a7c250b1; no new Security verdict is inferred for this integration. Merge and actual fixed published-image acceptance remain pending, so #732 stays open.

[rmcdaniel]

Merged normally as 4290969 at 2026-10-24 23:36:35 UTC, after the exact integrated head completed 19 successful checks and 7 intended skips. The merge tree is exactly the reviewed and qualified 0e5a9ca3b65a0acca3f51a774b19fbfbd156a669; its parents are current main dcb2d718 and reviewed head 83a9b557. The merged remote branch is independently verified absent.

Integrated source/review evidence includes current SQLite38/532, PostgreSQL17.11/MySQL8.0.46 each29/305, the current-Core unfixed counterfactual, and Sonar with zero unresolved issues/hotspots/new duplication. Existing discovery deprecations are retained explicitly.

All six independent main workflows on that exact merge are terminal successful:

• PHPUnit Feature
• CodeQL
• SonarQube
• Replay/query HTTP
• Server performance
• Public Boundary

The last workflow, CodeQL, completed at 23:49:57 UTC; total main activation-to-completion was 13 minutes 20 seconds. PHP completed at 23:44:52 UTC. Published PHP image acceptance remains outstanding; #732 stays open until that user-visible delivery is verified.