[rmcdaniel]

Part of #325. Pre-RC native Rust (tier C).

Independent commits, batched to share one CI cycle:

1. Native runs the repair pass from its own maintenance loop (a2b07b07d)

The published image's scheduler loops every 10 s through the repair pass, schedule evaluation, timeout enforcement, payload cleanup and history pruning. Native already fired timers and schedules every 250 ms, but ran the repair pass only when someone called POST /api/system/repair/pass. So an idle run past its execution or run deadline never got the task that closes it.

The ticker can now run the repair pass with PHP's loop throttle: at most once per 5 s, shared with requested passes that respect it.

• Opt-in: the loop runs only with DW_RUST_MAINTENANCE_LOOP=1, which the native image will set. A PHP server container never repairs on its own; PHP's separate scheduler container does.
• Why not on by default: on this PR's first full run, the loop changed corrected-marker, deadline-health and repair-status results that compare native against a bare PHP server.
• DW_V2_MATCHING_ROLE_QUEUE_WAKE=false (or 0) still turns it off, as it does PHP's.
• Test: the_maintenance_loop_gives_an_overdue_idle_run_its_deadline_task.
• With the loop off by default the execution suite passes (558). With it on, it passed too, and native passed the 11 shared fixtures most exposed to background repair.
• Checkpoint: docs/rust-server-port-checkpoints/2026-10-26-maintenance-repair.md.

2. Takeover keeps PHP runtime credentials (fe2090bc8)

Native serves runtime credentials from PHP's own runtime_credentials table and looks tokens up by the same SHA-256 digest PHP stores (hash('sha256', $token)). So the rows need no conversion, and PHP-issued worker tokens keep working after cutover. Takeover no longer refuses them.

• Shared PHP rows are checked on SQLite, PostgreSQL, MySQL and MariaDB: the live token authenticates with its subject, roles, tenant and claims, and the revoked one stays refused.

Update validation tasks also carry over (717445543). Native validates updates in the same workflow_update_validation_tasks rows and keeps no state of its own. A pending task whose caller was waiting on PHP is then what a PHP restart leaves: a validator may still claim it, and a caller's retry with the same request reads its recorded outcome. takeover_keeps_php_update_validation_tasks covers this. Takeover still refuses message streams and external payloads.

3. Takeover of published Server 2.11.3 (84c5085e4)

Server 2.11.3 (Core 2.14.2) was published today, and native refused every 2.11.3 database as unqualified.

• Each recorded layout now names its parent, so 2.11.3 descends from both 2.11.1 variants.
• Deltas were captured from real published-image databases on four engines along five upgrade paths: fresh; 2.11.1→; 2.8.0→; 2.9.7→; 2.9.7→2.11.1→. All gave the same delta from their parent.
• The recipe:
  • copies PHP's recorded session holders (PHP and native use the same SHA-256 of the holder token);
  • counts and drops full failure messages (native reads the labelled preview, as PHP's older readers do; history keeps the full message);
  • counts and drops completed dispatches;
  • drops the idempotency digest and the stream reclaim deadline;
  • refuses with upgrade_source_service_call_dispatches_pending while a dispatch is scheduled or claimed, since native cannot resume one.
• MySQL and MariaDB run it as resumable journal step 10.
• Tests: SQLite 57/57 upgrade tests; PostgreSQL 7, MySQL 8 and MariaDB 8 takeover qualification tests, including a 2.11.3 takeover killed before step 10 and resumed. The native binary took over all five real published SQLite databases.
• CI: a php2113 cohort takes over a published 2.11.3 source end to end on SQLite, PostgreSQL and MySQL. The cohort expects 51 PHP tables for 2.11.3, which adds the dispatch outbox, and 50 otherwise.
• Checkpoint: docs/rust-server-port-checkpoints/2026-10-26-php-2113-takeover.md.

4. CI adapter cache: added, then reverted in this PR (53fd36beb, reverted by 037a97d10)

The organization's central action policy requires every cache key in a pull-request workflow to include ${{ github.event_name }}. So a cache that only pushes to main save could never be read by pull request or merge group runs, the runs it was meant to speed up. The Docker workflow isolation policy also refused the inline key step. The cache is out of this PR until the design is settled with the policy owners. The PR's net workflow change is only the php2113 cohort.

Not in this PR

The parity reference is still published 2.11.1. Core 2.14's behavior changes are native work for the reference move to 2.11.3:

• full failure-message storage on write;
• service-call scheduling through the dispatch outbox;
• the new idempotency scope.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.2% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Merged through the merge queue at 2026-10-27T01:57:08Z, 23 minutes after enqueue (01:34:25Z, pinned to head d0108c708846da5961d0575e3a30f19200994276).

• Merge commit: 8b84670c3b59a54b989a31cf298abd3a52c766f2
• Tree: 7f63789e8a62417be2001b00e6509b5192d7476a, identical to the head's tree
• Parents: b4bdf82663af909cbc78a8787b0d9a1bac07356f (main) and d0108c708846da5961d0575e3a30f19200994276 (head)

Follow-ups:

• Cache the fixture adapters' Cargo registry and build tree from main #799 re-lands the adapter cache under Allow an exact shared cache key written only by protected pushes .github#269.
• DW_RUST_MAINTENANCE_LOOP was missing from the config audit's native-only names. Setting it logged "Unknown DW_ variables", which the local native-image smoke test showed. The fix rides in the stream-retention PR.