[rmcdaniel]

Release PR for Workflow 2.18.0. The scope and plan were accepted by Security on #864 (comment 6611627322).

Changes here, CHANGELOG and composer.json only:

• ## 2.18.0 - 2026-11-03 with the Unreleased entries: Let failed-run redrive recover ordinary workflows and document it #864 redrive A1 (Redrive failed runs that have start-time memos or search attributes #985), A1b (Report redrive eligibility in run detail and describe #990), A2a (Redrive failed runs whose completed steps include side effects or version markers #991), A2b (Redrive failed runs whose completed steps include a fired timer #992), and Retain keyed signal receipts and refuse key reuse with different intent #877 keyed signal receipts (including its intent_digest migration note, unchanged).
• Two entries that never landed with their PRs:
  • Name the Eloquent model when a V2 payload can't encode it #998 / Explain Eloquent model arguments that V2 cannot encode #997: Eloquent model refusal names the model class.
  • Record bounded diagnostic history for rejected late activity outcomes #901 / Long activities without heartbeats are re-run every 5 minutes and never complete #878: the payload-free ActivityOutcomeRejected audit, with the 2.13.0 rollback floor.
• extra.durable-workflow.product-train: 2.17.1 → 2.18.0.

Built from main e61d6e54 (#901 merged at its Security-accepted head a09fb02f).

After merge, held until Security clears this exact head:

1. Annotated tag 2.18.0 at the merge commit, and a GitHub Release with the upgrade notes from Let failed-run redrive recover ordinary workflows and document it #864. The notes cover Retain keyed signal receipts and refuse key reuse with different intent #877's nullable migration and writers upgrading together, Record bounded diagnostic history for rejected late activity outcomes #901's rollback floor, and the redrive successor keys with SDK/native parity tracked in sdk-python#232, sdk-php#240, sdk-rust#164 and server#980.
2. Read back the Release Verification run on the tag, Packagist 2.18.0, the tag object and the GitHub Release.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-head review: accepted for merge at ee56c38cf18fa2c6ab3f43975d93554b7051bc42, based on exact Workflow main e61d6e54c5f1db6613c6d788a7e194a26ff008b6.

The release cut changes only CHANGELOG.md and composer.json:

• product train moves 2.17.1 → 2.18.0;
• Unreleased is retained empty and the accepted release scope is moved under 2.18.0 - 2026-11-03;
• Retain keyed signal receipts and refuse key reuse with different intent #877's nullable intent_digest migration/upgrade note is preserved;
• Name the Eloquent model when a V2 payload can't encode it #998's serializer-boundary entry accurately describes the model/identifier/collection refusal;
• Record bounded diagnostic history for rejected late activity outcomes #901's entry is explicitly payload-free, grants no outcome, renews no lease, changes no retry behavior, and preserves the required rollback floor: do not roll back below 2.13.0 after an ActivityOutcomeRejected fact is written.

All hosted gates are green, including MySQL feature coverage, regression corpus, unit contracts, repository contracts, analysis, and the aggregate build.

This clears the merge of this exact head. After merge, stop for Security to read back the merge parents/tree and the 2.18.0 surfaces before creating the annotated tag. The subsequent Release/Packagist/tag verification and published GitHub Release must match that verified merge commit and the accepted #864 upgrade notes.

[rmcdaniel]

Security stop-1 merge readback: accepted.

• merge commit: 36dc304db1b0809e9960b69b129bdff23dd0d4b2;
• parents: prior main e61d6e54c5f1db6613c6d788a7e194a26ff008b6 + accepted release head ee56c38cf18fa2c6ab3f43975d93554b7051bc42;
• merge tree ac04492236f4512eb4aea52e05e7533d6c033598 exactly equals the accepted head's tree;
• origin/main resolves to the merge commit;
• composer product train is 2.18.0, and the dated CHANGELOG retains the accepted Retain keyed signal receipts and refuse key reuse with different intent #877 migration and Record bounded diagnostic history for rejected late activity outcomes #901 payload-free/rollback-floor language;
• tag 2.18.0 is absent at this readback.

Workflow may now create and push the annotated 2.18.0 tag at exactly 36dc304db1b0809e9960b69b129bdff23dd0d4b2, then publish the GitHub Release using the accepted #864 upgrade notes. Stop for Security to verify the annotated tag object/dereference, Release Verification, Packagist visibility, GitHub Release state/body, and latest-release pointer.

[rmcdaniel]

Security final publication readback: Workflow 2.18.0 is accepted.

• annotated tag object a0fdc99c27ccdb8921d8643c295782b037a7dd83 is 2.18.0 and dereferences to the verified merge 36dc304db1b0809e9960b69b129bdff23dd0d4b2;
• GitHub Release 2.18.0 is published, neither draft nor prerelease, and is the current latest release;
• the tag annotation and Release notes retain the Retain keyed signal receipts and refuse key reuse with different intent #877 nullable intent_digest migration, Record bounded diagnostic history for rejected late activity outcomes #901's payload-free ActivityOutcomeRejected statement, and the do-not-roll-back-below-2.13.0 floor;
• Packagist exposes durable-workflow/workflow 2.18.0 with both source and dist references bound to 36dc304db1b0809e9960b69b129bdff23dd0d4b2;
• Release Verification run 41693090509 is successful at that exact commit: the published-package identity job and all 12 supported Laravel/PHP published-upgrade cells passed.

The 2.18.0 release commitment is complete. The rollback floor remains operationally binding once an upgraded deployment writes an ActivityOutcomeRejected event.