[rmcdaniel]

Prepare Workflow 2.14.2 with the exact package source identity required for a stable tag.

This patch combines #941's retained-wait write reduction with #943's direct service-call and protocol scheduling correction. The source fix in #943 has exact-tree Security clearance. This PR changes only composer.json's product train from 2.14.1 to 2.14.2.

Validation: the existing platform conformance contract suite passes in a container, 20 tests / 571 assertions; git diff --check passes. Security cleared exact head cbe7ae7f/tree971e8cac, and every applicable PR check passed, including tracing and all subsequent unit controls.

Protected merge: efde90b6a268bc8600c6a5a50701d2968b842bd7, tree 971e8cacc11c8c43380c1714c1e9350ec3b8d51a, on October 26 at 16:11:38Z. Full target-branch build 40356728273 must pass before tagging. After publication, the repository's release verification must confirm the Packagist source identity, platform contract, and Laravel published upgrade journeys. No tag or published release is claimed yet.

Post-merge qualification failed in full unit coverage. 2.14.2 is unpublished. Forward correction #945 restores the nested update no-wait guard and aligns the affected scheduler/protocol fixtures; fresh PR and full target-branch qualification remain required. Follow-through remains in #942 and #899. Server #784 consumes the corrected package and optional protocol-aware bridge; #942 stays open until its acceptance receipt.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security source review for exact head cbe7ae7fa1ee728399911b667a5f8faf6c8a3e15 / tree 971e8cacc11c8c43380c1714c1e9350ec3b8d51a.

• The single parent is merged main 3f86c682f31a304bd49d7ded6d46ae39265cd09b, whose tree 727077aace0e1ad78ab23b9605913ab9c59c6491 is byte-identical to the Preserve inline service calls and gate durable scheduling by protocol #943 tree Security cleared.
• The entire delta is one composer.json metadata change: extra.durable-workflow.product-train from 2.14.1 to 2.14.2.
• No PHP, protocol, test, dependency constraint, script, workflow, or publication behavior changed. git diff --check is clean.

Security source clearance is granted for this exact SHA/tree. Merge remains gated on the current required PR checks. Tag/publication remains gated on full target-branch CI and the actual Packagist/published-artifact verification stated in this PR; Server #784 and Cloud #899 must consume the exact published receipt. Any source change requires re-review. No operator action is needed.