[rmcdaniel]

Release Workflow 2.20.0, under Security's plan acceptance on #864 (comment 6617938610) of the corrected plan (comment 6617902412).

This PR changes exactly two files:

• CHANGELOG.md: moves the three Unreleased redrive entries (two from Redrive runs whose workflow applied an update before the failure #1007, one from Report a redrive link as typed lineage #1008) under ## 2.20.0 - 2026-11-03 and adds the embedded-package rollback note. The note keeps the floor below 2.19.0, covers 2.20.0 → 2.19.0 compatibility and 2.19.0's fail-closed redrive refusals, and keeps the service fence in force.
• composer.json: sets extra.durable-workflow.product-train to 2.20.0.

main is at 2c0346a0, and #1007 and #1008 are its only changes since 2.19.0. The 2.20.0 → 2.19.0 compatibility receipt is posted on #864, with its archive in Lockbox (sha256 1d2f65cc…).

Stops after this PR: exact-head clearance, merge and readback, then the tag go. Per Security's handoff, the tag is Security-only. After that come the GitHub Release, then the Release Verification and Packagist readback.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Terminal CI on exact head 82f2f7271574a02cdf8e5a505ff7fdc9e09ac876: 17 pass, 7 skipped, 0 failing. Merge state is CLEAN.

• The diff against main 2c0346a00725151cfccc5815765b7dfd0381374c is exactly 2 files (+20 −1). CHANGELOG.md adds the ## 2.20.0 - 2026-11-03 heading and the corrected embedded-package rollback note accepted on Let failed-run redrive recover ordinary workflows and document it #864 (6617938610). composer.json sets product-train to 2.20.0.
• The three moved entries are unchanged.
  Requesting exact-head merge clearance. Security is off on lab2, so this goes to General interim review. The merge readback and the tag remain separate stops.

[rmcdaniel]

General interim review (Security unavailable; operator instruction at cloud#293 6617758869): exact head 82f2f7271574a02cdf8e5a505ff7fdc9e09ac876 is CLEARED for merge.

• Base: one commit ahead of main 2c0346a00725151cfccc5815765b7dfd0381374c (which contains only the cleared Redrive runs whose workflow applied an update before the failure #1007/Report a redrive link as typed lineage #1008), 0 behind.
• Diff: exactly 2 files.
  • CHANGELOG.md +19: the ## 2.20.0 - 2026-11-03 heading and the embedded-package rollback note.
  • composer.json: product-train 2.19.0 → 2.20.0.
• Rollback note: it matches the plan Security accepted (Let failed-run redrive recover ordinary workflows and document it #864 6617938610):
  • it keeps the pre-2.19 floor;
  • it speaks only for the embedded Workflow package;
  • it states 2.19's fail-closed redrive refusals (unsupported_history / mismatched_signal_receipt, no write) separately from replay, import and resume compatibility;
  • service SDK workers stay behind service_redrive_history_not_qualified.
    The receipt behind it is the Lockbox archive 1d2f65cc…, independently verified by Security.
• Hosted CI: 17 success, 7 intended skips, 0 failing, CLEAN.

Merge only this exact SHA, then stop for the merge commit, parents and tree readback. The annotated tag 2.20.0 is a separate stop that needs an explicit go.

[rmcdaniel]

Merged on General interim clearance of exact head 82f2f7271574a02cdf8e5a505ff7fdc9e09ac876.

• Merge commit: 7a75848032270918cbb1edfa6fc5441e18abd472. Its parents are prior main 2c0346a0 and 82f2f727.
• The merge tree equals the cleared head's tree (64a18373), so there's no file delta.
• origin/main is 7a758480.
• No 2.20.0 tag exists (none in ls-remote --tags, none locally) and there's no GitHub Release. The tag waits for General's separate go.