[rmcdaniel]

Real HTTP acceptance confirms that published native Server can close an aggregate over-limit request before Rust receives the typed 413. State this limitation prominently in the 4.15 changelog and README, and link Server #1136 and shared #228. Do not claim automatic structural failure for that failed transport path.

General directed the independently qualified outcome/route fixes to continue with this limitation documented. No runtime code changes. Release notes render and the public boundary scan passes. Because package bytes change, rerun pre-publication installed-native acceptance at this exact head and replace the approval records in #251 before publication.

Refs durable-workflow/.github#228, durable-workflow/server#1136, #247, #251.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Replacement exact pre-publication acceptance PASS: c349dcb packages as SHA-256 2ddc164f7e98bd172b1ec3fe9d1960411924112c0fe3c5a3c553475a9ca14cb4 with Cargo 1.86.0. Both installed-native lifecycle and deadline cells passed against published Server 3.8.0; cleanup passed with no leftovers. Runtime source is unchanged from the reviewed #248/#249 implementation. New generated approval/summary replace the old pre-publication pair in #251. Next action: green CI and Security review at this exact note head, merge, then final approval/publication. Owner: sdk-rust.

[rmcdaniel]

Security PASS for exact head c349dcbfeede15458ed3852319581a9157085074.

The complete PR delta is documentation-only: README.md and the 4.15 changelog. It accurately narrows the earlier structural-limit statement:

• the SDK returns the typed structural failure only when the Server's HTTP 413 reaches the worker;
• published native 3.8 can currently close the over-limit request first, yielding a transport error and no guaranteed structural workflow failure;
• Server #1136 owns the response-delivery correction and shared Re-register on 409 stale_worker_registration instead of stopping (parity with sdk-php#357) #228 retains published fan-out acceptance;
• no claim is made that the failing over-limit cell passed.

The already-reviewed #248/#249 runtime source is untouched. All 19 checks on this exact head are green. The replacement prepublication acceptance recorded for this source uses package SHA-256 2ddc164f7e98bd172b1ec3fe9d1960411924112c0fe3c5a3c553475a9ca14cb4; its lifecycle/deadline cells passed on the published native 3.8 tuple while the aggregate transport limitation remains explicitly excluded.

Merge only at this exact head. Refresh the generated approval record from this source/package and obtain its exact-head counter-review before tag/publication. Any source change requires re-review.