Continue release verification without rebuilding published immutable images #857

Completed: the immutable-image recovery path was verified by successful 2.11.6 continuation 40885194236. The later #861 regression is corrected and accepted in normal published Server 2.11.7/chart 0.3.7: final receipt, Security acceptance, successful publisher 40919882321.

#861, Workflow #953 and Workflow #956 are completed. General's #825 MariaDB qualification and Rust's #863 reference/Native follow-through remain in their owning records. No old immutable artifact was replaced and the two failed recovery runs remain terminal. Historical recovery and earlier follow-through evidence follows.

The existing-image recovery is implemented and its protected publication completed successfully. A newly discovered published bridge-update regression, #861, remains an explicit installed-consumer blocker.

PR #859 merged as b34ef0b56feaf24bb94198676d4385634a6a3ffd. Its first continuation verified the exact immutable image but stopped before arm64 execution on Docker's same-index cross-platform cannot overwrite digest collision. PR #860 fixed platform selection and merged through protected checks as f249b00a2fb9bb85cbbbb938e509a2a3d99d0bff.

The subsequent Release run 40885194236 completed successfully, including its chart job. It skipped image production and preserved the original artifacts:

• Server tag 2.11.6 / source d13ebdb5eccc3d33b9d3c0e1ebc9ab0cb116e121, Core 2.15.7 / 3aa98b8473b130dbc141457f76ccc32e4aa58062.
• Dual-registry index sha256:28e1ddeea655760e99748c48f2fa9bbecda37d3924864f6ee9011764144f2c2b; amd64 child c20c901eaa8dedfa04e5b89280f93b23a5e84e143410e3ceb63ff0881d701641, arm64 child f799cf5ca1b4276a1ac9293dd66e85c624cf91289a1b1b8086eeb10c3082a98a.
• Chart 0.3.6 / OCI sha256:6db267406162cb2c5c34532d369f626a7c72b144519f266e4e9e91061cdce471, app/image 2.11.6.

Both platform trust gates, bare-image first run, source-free Compose, database TLS and certificate refusals, protocol convergence, final identity recheck, rolling aliases, GitHub Release and anonymous clean-client chart installation passed. General additionally pulled both platform children anonymously from both registries. Final release and installed-consumer receipt records the exact scope, package-byte checks, Mime controls, maximum closes and selected SDK checks.

The two earlier failed runs remain terminal and must not be rerun. No immutable tag or image was replaced. Server 2.11.5 / chart 0.3.5 rollback remains retained.

Remaining follow-through:

• Published 2.11.6 answers a repeated bridge-adapter update with 500 #861: General accepted Rust's twice-reproduced published-2.11.6 duplicate bridge-update HTTP 500 versus the same 2.11.5 duplicate success. Source correction Reuse scoped Bridge receipts during external update admission #862 is qualified and merged; complete Prepare Server 2.11.7 and Helm chart 0.3.7 #864's normal publication and published duplicate acceptance. Rust's parity-reference move remains held.
• Cloud retains Message stream appends are accepted on read-only Waterline v1 projections #769/Waterline v1 projection import has no event or history byte limit #770 installed acceptance and its exact receipts. General retains Investigate intermittent approved-update HTTP 500 in published PHP MariaDB corpus #825's full MariaDB follow-through. Workflow Native: online-backup hold endpoints, with PHP's deletion fence #953 completed its specific published endpoint and PHP/Python/Rust acceptance: Update-ending scope checkpoints return a next sequence that subsequent calls refuse workflow#953 (comment) . That completion does not lift Published 2.11.6 answers a repeated bridge-adapter update with 500 #861's hold.
• Python replay defect Signal during condition-reopen completion makes replay skip a durable wait sdk-python#223 is delivered in normal published SDK 2.12.1 and closed after eight installed timing/cold-process checks: Signal during condition-reopen completion makes replay skip a durable wait sdk-python#223 (comment) . Workflow Compose: default to native 3.0.1 #956 retains its distinct locally available named-wait/ordinary-ACK acceptance scope.

This recovery record is closed after accepted 2.11.7 publication and #861 resolution. Independent #825 and #863 follow-through remains in its owning records. No publisher rerun or redispatch is authorized by this issue.