[rmcdaniel]

Part of #325. This follows #865, closing one of the cases its review noted as unobserved.

What changed

Published PHP 2.11.5 describes an open activity ahead of open children, in either order, as it does a timer. Native's child summary kept an already chosen timer wait but gave up beside an activity, so such a parent was described with no wait. An already chosen activity wait now stays the run's wait while every child is open (child_summary.rs).

Evidence

• child-descriptions fixture: three new cases.
  • child_then_activity and activity_then_child: both described as "Waiting for activity …".
  • cancelling_child: a try_cancel child from a worker that doesn't declare cooperative cancellation. Published PHP and native both refuse it with 409 child_cancellation_policy_not_supported.
• Recorded locally at this head: published 2.11.5 and native (an image built from it) pass all eight cases.
• Tests: child_descriptions.rs covers the activity cases; on the previous source the parent had a null wait.
• Full native suites, run locally: execution 634 passed, lib 359 passed. Contract unit test: 7 pass.

Not covered

A child with a retry or timeout policy, or a non-abandon cancellation policy under a worker that declares cooperative cancellation, is still described without its wait.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security risk-tiered review of exact head d42050b2c7bbbdad6a456a128d827390d85479a6: no security finding or separate Security hold.

The runtime change is confined to wait-summary precedence after child identity/status matching has already succeeded. It preserves an existing timer or activity summary only when every child wait is open and the retained task type is absent or matches that wait kind. It does not change endpoint authorization, namespace/principal selection, child identity validation, persistence queries, command admission, or cancellation capability enforcement.

Showing the retained activity wait beside open children does not introduce a new data class: the same activity type/reason is already the run summary when no child overrides it. The new try_cancel case is fixture-only and confirms the existing fail-closed 409 child_cancellation_policy_not_supported response for a worker without cooperative cancellation.

This review does not claim the separately documented retry/timeout/cooperative-cancellation description gaps are complete. Normal semantic review and the already-running CI remain required; no additional Security CI or production test is requested.