[rmcdaniel]

4.10.0 can overwrite a valid outer terminal workflow-failure message with a blank nested exception message, causing the published Server to reject the failure. This patch preserves supplied small fields and follows the Server’s PHP-blank fallback rule. It bounds ignored nested message/metadata without making it authoritative, and reduces a redundant outer copy only when the current budget requires it.

Compatible patch 4.10.1 retains the 62/128/64 KiB and complete 1 MiB/lower-known limits, original type/retry flags, exact claim identity and existing schemas. The 4.10.0 tag and crate remain immutable.

Validation at 45e5fc9bd61035dccc64945d9d17c67dfa4b5057:

• Rust 1.86: 745 active all-target/all-feature tests and 14 doc tests pass, with zero warnings. Ten internal limit controls and 11 public controls cover blank/distinct/omitted fallback, ignored blank metadata, nonblank large messages, final encoded caps and lower known limits. Original inputs and assertions are preserved through the helper refactor.
• All six isolated published PHP 2.11.0 cases pass, with all features and the default thread stack: large reports, retry/history/cold replay, empty/whitespace nested fallback and nonblank nested authority.
• Normal registry 4.10.0 actually returns HTTP422 and records no WorkflowFailed for the valid fallback fixture; it also fails the captured-wire equality control. Normal registry 4.9 returns HTTP413 and records no ActivityFailed for the original 3 MiB input. Both failed originals remain separate from corrected-source passes.
• Sonar found two valid complexity issues on the prior head. Extracted field-budget and command-discovery helpers; current Sonar 39992335172 passes, with direct review showing zero unresolved issues and zero hotspots. Public boundary passes. Fresh current-head CI39996227247 and CodeQL39996220189 are admitted and pending.

Protected publication, normal installed 4.10.1 acceptance and all eight Website401/403 guide deliveries remain pending. Shared225, Core915, other SDKs and adoption remain separate.

Refs #143 and #141.

Current head is fe70aa80343c1ae4ed0050531695913bc7efad7f, a metadata-only qualification commit with exactly the same whole tree b42868e0189f6c7d631355f8a4fde061272e82b3 as tested 45e5fc9b. The stopped owner canceled the original checks; normal rerun and close/reopen did not replace the canceled dynamic CodeQL scan. This unchanged-tree commit has now actually admitted a fresh default analysis. Superseded queued CI is canceled; original outcomes remain visible. No implementation, version, gate or acceptance criteria change, and no 4.10.1 tag yet.

[rmcdaniel]

General has taken over the operator-stopped session. Its candidate CI and default-setup CodeQL scans were canceled during handoff. GitHub refuses both full-run and individual-job reruns for that dynamic CodeQL workflow. I am reopening this same PR at the unchanged 45e5fc9 head to request ordinary fresh checks. Canceled originals remain preserved; no source, version, gate or acceptance criterion changes.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security release-artifact verification (2026-10-26 UTC): pass; no follow-up gate.

• The crates.io API reports durable-workflow 4.10.1 as non-yanked with SHA-256 84f511bfad4bf0d76aa1723766bdcc911bc912fd95d6d4a3354fcb70949013e8. An independent fresh download produced the same digest.
• crates.io trusted-publisher metadata binds the publication to GitHub repository durable-workflow/sdk-rust, workflow run 40001996911, and commit ebad5c1b729c4f4c728b03de4e7d7d3c915fd8e1.
• That run completed successfully on attempt 1. Its pinned release workflow checked out the immutable 4.10.1 tag, required the supplied tag and full commit to agree, obtained a short-lived crates.io token through GitHub OIDC, and published from the clean release checkout.
• The run's retained release evidence records the local package, registry, and downloaded archive with the same digest; the registry archive matches the release checkout; embedded VCS identity is the same commit with dirty: false; and a fresh exact-version Rust 1.86 consumer build passed. I independently confirmed the downloaded archive embeds the same VCS commit.
• GitHub reports the tag commit's signature as verified, and the source commit is the merge of this PR.

This receipt establishes registry trusted publishing, checksum integrity, exact release-checkout archive equality, and installed-consumer verification. It does not claim a separate SLSA provenance attestation. No release mutation or Rust Server/current-development gate was introduced.