2.10.0

Adds opt-in durable trace context for PHP Server and the first-party service SDKs. Enable it on an application image with OpenTelemetry API 1.10.1 or newer supported 1.x, the explicit feature flag, and the actual nullable carrier columns. Clients and workers discover the exact capability; earlier images and unsupported runtimes retain independent task traces.

Authentication, namespace, claim, receipt, routing and history checks precede telemetry. Valid caller origins persist outside business/history payloads. Actual commands and committed outcomes can provide bounded links without replacing the original parent. Baggage requires an explicit JSON-list allowlist and is empty by default. Links carry no baggage. The ordinary image keeps OpenTelemetry optional, and the application owns providers and bounded exporters.

This release adopts published Core 2.9.0. Run the normal Server bootstrap with a backup and the configured workflow connections. Disabling the feature omits carrier delivery and retains the nullable schema. See the trace-context and application-image guide and the owning acceptance record for the exact published tuple, migration and consumer results.

Native carrier support, native catalog conversion and Cloud deployment have separate qualification. The native owner's PHP layout acknowledgment is not an executed native adoption result. Activity lease renewal drafts are separate.

Protected publication and published-artifact acceptance are complete. The normal publisher passes image publication, first-run and source-free Compose, protocol convergence, published TLS and the matching Helm release. Both image registries resolve to index sha256:d69f9009d6bb3a4fb60c3516c7268a99c832937eacd24fe5a078564076b5f427. Helm 0.2.2 at oci://ghcr.io/durable-workflow/charts/durable-workflow has package digest sha256:f47d30a7e1748a5a92570a7cdc788189bee3db868a437c297aecb410c65c36cd; its clean-client anonymous pull and install pass.

Actual published PHP 3.1.0, Python 2.7.0 and Rust 4.1.0 consumers all pass durable caller/task/attempt propagation through independent workflow and activity workers. Additional Python consumers pass process replacement, real activity retry with distinct attempts and an independent signal linked to the original run. Stored caller origins, empty default baggage and business/history exclusions are checked against the real database. All 346 Server and 966 Core production files match the published image before and after execution. The configured application image adds API 1.10.1 while preserving every existing locked package record. The ordinary image has no forced OpenTelemetry dependency; API-absent and flag-disabled controls do not advertise the capability.

The Core performance report preserves the original disabled fan-out 5% failure and its uncertainty. The component release decision uses explicitly post-study 7.5% disabled / 15% enabled budgets, with no performance SLA. Normal Sample and website integration remain tracked in #773.