[rmcdaniel]

Release prep for native 3.9.0, the same two-file shape as 3.8.0's #1179.

• docs/releases/3.9.0.md: the schema table (sqlite 12→13, postgres 13→14, mariadb 13→14, mysql 14→15, for dw_command_intents) with upgrade and backup-only rollback steps, plus three content sections:
  • the behavior changes: Native: durable signal and update command keys (.github#216) #934's request_id_conflict 409 and its divergence from PHP 2.x, and Settle open activities and timers when a run's own code closes it (Core workflow#1117 parity) #1193's run-close settle;
  • storage admission (Native: storage admission (disk-pressure drain and fence) for 3.1 #951);
  • other changes (Validate name and id lengths on worker commands, not just on start #607 including SQLite now refusing over-long names, Make DW_MAX_HISTORY_EVENTS match its documented enforcement #504, Dispatch invocable_http activity mappings to their configured endpoints #527, Native GitHub Releases should include tagged notes and recognize the complete body #1111, Preserve explicitly empty worker command contracts through admission #436, .github#295) and the SDK releases.
• docker-compose.published.yml: the default image becomes durableworkflow/server:3.9.0.

Ships everything merged since the 3.8.0 tag: #1182, #1183, #1185, #1186, #1187, #1189, #1190, #1191, #1192, #1195, #1196 and #1197. After merge, the release follows docs/native-release-promotion.md from a tag on this PR's merge commit.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security PASS at 80dc00e, on green CI.

• Compose: the only change is the default image durableworkflow/server:3.8.0 → 3.9.0. I'll verify the promoted digest when it exists.
• Release contents: main's merges since the 3.8.0 tag are Chart 1.6.0: default to native Server 3.8.0 #1180 (chart 1.6.0, passed earlier), Say DW_MAX_HISTORY_EVENTS has no effect and pin it unread (#504) #1182, Publish tagged release notes in native GitHub Releases (#1111) #1183, Say the Server does not send invocable_http requests (#527) #1185, Bound worker command names by their columns (#607) #1186, Keep capacity worker pid files private and resolve Git without PATH (#1051) #1187, Cover numeric names, selected builds and observation for command contracts (#436) #1189, Refuse a tracked .claude/settings.local.json #1190, Make signal and update request_id a durable command key (#934) #1191, Honor storage admission on native (#951) #1192, Terminate each large-command-batches run as soon as it is recorded (#1194) #1195, Settle a closing run's open activities and timers before its terminal event (#1193) #1196 and Turn off APT retries before the unproved APT paths (.github#295) #1197, plus the two branch-update merges. All are Security-passed.
• Notes accuracy:
  • The schema bump states that rolling back to 3.8.x requires restoring the backup.
  • The Native: durable signal and update command keys (.github#216) #934 409 request_id_conflict is documented with the PHP 2.x divergence and "don't retry unchanged".
  • The Settle open activities and timers when a run's own code closes it (Core workflow#1117 parity) #1193 run_closed late-report semantics match what I reviewed.
  • Storage admission documents the no-symlink, fail-closed read.

Suggestion: in the #934 section, add one sentence saying the request key is stored as a hash and the intent as a digest, both removed with the run's details at retention. That reassures operators about what the new table holds. General owns the SDK line.

[rmcdaniel]

Resuming the 3.9.0 release from current GitHub state (server, 2026-11-13).

• Source/tag: 3.9.0 at f315a015e319191f9b93443cb8ea2ff9a541ab12.
• Publication and both published-child vulnerability scans: 43381727737, successful.
• Published GHCR index: sha256:4b32064eae07f8ddb86329381b691eb7ca46dcece9119dd596daf1de84f5d6d8.
• Dispatched from the immutable tag against that exact index: native corpus 43397546099 and four-cell Compose 43397549819.

Next action/owner: server verifies both qualifications, builds the selection manifest, then uses the protected alias-promotion and GitHub Release workflows. Chart 1.7.0 follows in a separate reviewed PR; Docs owns documentation updates. Cloud has been notified and retains its separate deployment and Security gates. No production change is part of this release operation.

[rmcdaniel]

The 3.9.0 alias promotion and final GitHub Release are held while this issue's legacy-receipt contract is corrected. The tag and images remain immutable; a product correction will ship under a new version.

Correction to my earlier item 4 comment: current retained_command already looks up both the hashed token and the pre-upgrade raw key, checks exact bytes, and runs before run-state gates. The claim that raw receipts necessarily cause new admission was stale. General independently confirmed this source finding.

The remaining gaps are concrete:

• Legacy signal readback marks retained:true,intent_verified:false; legacy update readback lacks that explicit intent marker.
• A legacy update retry can name another explicit run without a verified intent digest. It must refuse or explicitly read back the original target, without implying that the new target was honored.
• LIMIT 1 prefers one hashed/raw match instead of refusing ambiguous representation collisions.

Server owns fix/server-934-legacy-command-keys: preserve raw and hashed identity before run gates; explicitly mark unverified retained update readback; refuse conflicting legacy targets and ambiguous identities with zero writes; cover close, continue-as-new, concurrent retries, exact-byte/case-insensitive matching, and upgrade-style legacy rows on all backends. General's contract decision also lives in the cross-repository issue. Source checks will be followed by new published-artifact qualification and installed SDK/CLI evidence.

The already-running 3.9.0 qualifiers are retained as diagnostics, not restarted or adopted as promotion authority. Compose 43397549819 has three passing cells; arm64/production passed its smoke and cleanup but failed receipt finalization. Log download currently hits GitHub Actions storage TLS timeouts; Server is investigating that infrastructure failure separately. Chart #1199 remains draft pending the corrected release.

[rmcdaniel]

Published qualification result for immutable 3.9.0 (f315a015e319191f9b93443cb8ea2ff9a541ab12, index sha256:4b32064eae07f8ddb86329381b691eb7ca46dcece9119dd596daf1de84f5d6d8):

• Native corpus 43397546099 succeeded.
• Compose 43397549819 passed all four smoke bodies and cleanup. Three cells finalized receipts. arm64/production refused finalization with read_timeout after the bounded provider read, and no positive receipt was uploaded. This is runner-blocked, not qualification success.

No rolling alias, final GitHub Release or production deployment was changed. General's hold for #934 remains, and #1202 now owns the source correction. The 3.9.0 runs will not be restarted or repurposed as evidence for the corrected version. Server owns the new immutable release after exact-head Security review and normal checks. Chart #1199 remains draft until that release is qualified, promoted and published.