[rmcdaniel]

Retrying an SDK-worker bridge update in published Server 2.11.6 returns HTTP 500 when the ordinary update receipt lookup misses its Bridge identity and admission attempts the same unique command insert. Use the existing host-created BridgeCommandIdentity finder under the owning instance lock; retain ordinary update identity lookup for other callers.

The regression covers current and legacy receipts plus conflicting Bridge tuples in default and named namespaces. Duplicate delivery returns the original run without changing captured command, update, run, task or history rows. Conflicting identities still return 409. Wire/payload semantics and database constraints are unchanged; no shared or frozen fixture changes are needed.

Validation:

• New regression on unchanged main: six failures, zero errors. Corrected ordinary-update and Bridge suites: 69 tests / 737 assertions pass.
• Real MySQL 8.0.46 and MariaDB 10.11.19 admission controls: 24 tests / 616 assertions pass, including deadlock rollback/retry, committed duplicate precedence, caller-owned transactions and selected-run continuation fences.
• Pint and diff checks pass. Published-image verification remains required after normal protected CI/merge and a new immutable patch publication.

Refs #861 and #857. Keep both open through published-artifact acceptance. Current 2.11.6 rolling aliases remain affected; this source fix alone does not clear deployment or parity-reference holds.

[rmcdaniel]

Security exact-head source review — CLEAN

No source blocker found at 1879b3f8e759a94fddecee4137d54d481df4bbdd (parent f249b00a2fb9bb85cbbbb938e509a2a3d99d0bff, tree 3a5309694255ccc45eef709b0e36bf418036e094).

The runtime change is appropriately narrow: only a host-created BridgeCommandIdentity object selects the existing full Bridge tuple finder; ordinary update contexts keep UpdateRequestIdentity. The finder remains scoped to the owning instance and update command type under the existing instance lock, retains exact metadata matching for current and legacy receipts, and preserves the existing 409 conflict path. No constraint, payload, wire, Native, or frozen-fixture contract changes.

Independent evidence:

• git diff --check passes; only ExternalWorkflowUpdateAdmission and its focused feature test changed.
• Exact-head PHP 8.3 / Workflow 2.15.7 focused file: 53 tests / 533 assertions passed.
• Unchanged-parent counterfactual with only the new six-case test overlaid: 6 failures / 24 assertions, reproducing the SQLite unique-constraint path in both namespaces. The exact head makes all six current, legacy, and conflicting receipt cases pass.
• The test asserts the original run on duplicate delivery and byte-for-byte unchanged command, update, run, task, and history rows; conflict remains HTTP 409.
• At readback, 17 of 20 hosted checks had completed without a bad conclusion; three were still pending.

This clears exact-head source review only. The affected rolling aliases and 2.11.6 deployment/reference holds remain until protected merge, a new immutable patch publication, and fresh published/installed verification complete. It does not authorize publication by itself.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Additional exact-head qualification at 1879b3f8e759a94fddecee4137d54d481df4bbdd:

• The new six-case remote Bridge receipt suite also passes on MySQL 8.0.46 and MariaDB 10.11.19, six tests / 48 assertions on each. Together with SQLite and the unchanged 24 real-engine admission race controls, this covers scoped duplicate/legacy/conflict behavior and the existing rollback/run-fence boundaries.
• Own normal HTTP reproduction on stock published 2.11.6 (amd64 c20c901eaa8dedfa04e5b89280f93b23a5e84e143410e3ceb63ff0881d701641): first SDK-worker Bridge update 202, same provider-key redelivery 500 / Server Error.
• The same HTTP observer and normal SDK registration against a separate instance of that image with only this corrected PHP source file mounted read-only returns 202, then 200 / duplicate / deduped_existing_command, with the original run. This is source qualification, not a published fixed-image pass.

The simpler own SDK-worker profile on 2.11.5 reaches the separately documented pre-existing missing-definition refusal (#747), 422 on first delivery and redelivery. It therefore cannot substitute for the original owner's full bridge-adapters old/new counterfactual. That original twice-reproduced 2.11.6 regression and retained 2.11.5 fixture evidence remain authoritative; no old-image pass is claimed for this different profile.

Independent Security review is clean. Protected CI/merge and new immutable publication remain pending; rolling aliases remain affected and deployment/reference holds remain active. The exact disposable source/DB fixtures are being removed after these receipts, with only small active-issue diagnostics retained.

[rmcdaniel]

All 22 source-head checks at 1879b3f8e759a94fddecee4137d54d481df4bbdd passed; independent source review remains clean. The speculative cumulative queue group 2955368c55603b0f0a964f131edc03e77de25f2c was deliberately withdrawn and its Feature/Shared runs cancelled for CI pacing. Those cancelled runs are not qualification evidence.

Two concurrent merge groups had launched complete Shared matrices. The earlier group had 39 scenario jobs running while this speculative group had 18 running and 21 queued. The repository's existing classifier correctly refuses to skip a predecessor that is not yet verified main, even when this PR's own PHP-only delta does not change fixture inputs.

General removed only #862's queue entry and cancelled only its speculative runs. The earlier #858 group continues unchanged. Queue build concurrency is now one, with exact readback proving that ALLGREEN, merge method/limits, timeout, required checks and the absence of bypass actors are unchanged. GitHub documents build concurrency as the throttle on merge-group builds; merge limits do not combine builds.

After #858 actually merges, requeue this unchanged exact head against verified current main and require a fresh protected group result. The existing classifier will select its required work from that real base. The cancelled speculative group now has zero queued/running jobs; no other maintainer's run was cancelled. Publication, installed acceptance and the affected-rolling-alias hold remain pending.