[saurabhjain1592]

Scope

Rebased onto merged fix #255 (d26450de221abd42886a2d4d2ab5a8034aac749b). Current prep head a9feeaa aligns pom.xml, the README install coordinates, and the first versioned CHANGELOG section at 9.5.1, unpublished release candidate. The old trailing-dot alias source was byte-identical to merged main; its test-only formatting conflict was resolved by keeping the pinned formatted assertion already on main. Changing the eventual publication date requires a new final-head review and artifact verification.

Artifacts and checks

• Rebuilt unpublished artifacts from the rebased head in /private/tmp/oc4487-prep-rebase-20261104/java/: binary JAR SHA-256 e142f2ad1e12598f99b66801b8c25977591c374f751e77eb035762116cf59251.
• Sources JAR SHA-256 d2200555d82973a93b1b418f5b9ae6948adff2410dfcad2d4d17d6f6f6e86d3d; Javadoc JAR SHA-256 54759b2d5e062522af330525d5492a0a50b020592b0a6403bb8a7fb19550d09a.
• Maven Central com.getaxonflow:axonflow-sdk:9.5.1 POM returned HTTP 404 on 2026-11-03; published latest is 9.5.0.
• At this rebased head, version alignment, the pinned formatter, the full offline suite (1,629 passing tests), package build, JaCoCo check, 125-pair wire-shape validation, OpenAPI snapshot checks, and no-mocks lint passed.
• A fresh Java 11-targeted consumer compiled with the rebuilt binary JAR first on the classpath and asserted the class source was exactly that JAR. It passed Portal guidance, linked Basic auth/200, terminal Hosted 402, terminal monthly 429 with truncated body, ordinary 429 retry, and legacy Community 402. Consumer source and logs are in /private/tmp/oc4487-prep-rebase-20261104/java/consumer/ and java-consumer.log.

Hold

The exact linked-client staging proof passed on the earlier sealed prep candidate as recorded below. Keep this PR draft with do-not-merge until independent reassessment confirms the dated client release plan below satisfies the playbook. Independent hostile exact-head review passed for the rebased source and rebuilt artifact: /private/tmp/oc4487-private-registry-release-20261103/FOUR-SDK-PREP-HOSTILE-R3-20261104.md (SHA-256 02cf53d2cdd469eb359d0014d35f8b90c827791f6ff0f264a87233dcc462e3a2). The scoped local CI-down board passed. Rebuild from actual merge source before publication. No tag or Maven Central publication from this PR.

• Earlier signed-off prep head 7cefb81ca5f18df55c9154a89e8f212f3813e9dc and its JAR hashes are historical. Its consumer refused a trailing-dot Hosted registration before HTTP; the same source is in merged main and the full rebased-head suite passed above.

4 November staging attempt (no live SDK verdict)

The disposable exact stack axonflow-community-saas-staging-20261103-235701 reached UPDATE_COMPLETE with the five active image digest parameters and running images matching the recorded freeze; paid gate remained off/0. A independently approved the policy-only probe harness. Synthetic Portal signup returned HTTP 503 during AppRoleProvisioned=false bootstrap, before any TypeScript or Java linked-client probe. No 200/402/429/401 live SDK result is claimed. We stopped before the longer role/enforce updates and deleted the exact stack and RDS at 01:01:45 UTC, restoring both prior shared DSN secret versions; no manual snapshots were deleted. Local evidence: /private/tmp/oc4487-ts-java-staging-20261103-235701/pin-stack-evidence.json and teardown-evidence.json. SECOND-RUN-PLAN.md is an unexecuted plan pending independent review. Registry publication, release tag, and merge remain on hold.

4 November exact linked-client staging proof

A second disposable, digest-pinned stack axonflow-community-saas-staging-20261104-010500 passed a real Portal signup and device link after app/admin DB role provision, then policy-only mcpCheckInput(postgres, SELECT 1) from the sealed unpublished TypeScript and Java 9.5.1 candidates. Each client passed paid allow, answered 429 hosted_monthly_limit_reached after a synthetic 1000-month/0-minute fixture, answered 402 hosted_payment_required after synthetic cancellation, and rejected the revoked credential with a raw same-route HTTP 401 confirmation. Independent reviewer A checked the eight results and exact package/runner hashes. There was no provider Send, Checkout, charge, public DNS mutation, release tag, or registry upload. The stack was captured at gate off/0 and deleted at 02:41:10 UTC with both shared DSN secret versions restored, RDS/ALB/ECS/security groups and access bucket absent, local credentials removed, and no manual snapshots deleted.

Evidence: /private/tmp/oc4487-ts-java-staging-20261104-010500/sdk-live-evidence.json SHA-256 5adc21229b65087225e55f33f4e1185fac78401a972de6766dfcfe63464d92f5; safeoff-stack-evidence.json SHA-256 cb7f85f5ee7f94958a4773545c65d699f5edbd95fe01168823fb221d7b7fe01a; teardown-evidence.json SHA-256 ac243a52cabc299ea5259a288ed346379f8044dcaabd705444967f52dc3b4dd2. The older /private/tmp/oc4487-sdk-prep-r3/MANIFEST.json identifies pre-rebase package bytes and a pre-fix probe harness; the live evidence records the amended Java proxy selector/probe/runner SHA-256 values. Final PR/merge-source review, remote CI, and publication remain held.

Skip-runtime-e2e justification

The operator explicitly authorized this narrow workflow-presence exemption for the unpublished Hosted client candidate. The actual user-facing path was exercised outside this repository on a digest-pinned disposable Enterprise staging stack using the sealed TypeScript 9.5.1 tarball and Java 9.5.1 JAR: real Portal one-use signup and owner-approved device link, followed by mcpCheckInput(postgres, SELECT 1) from each linked SDK. Both clients passed allow 200, synthetic monthly-cap 429, canceled-subscription 402, and revoked-credential 401 (with raw same-route status confirmation). Evidence: /private/tmp/oc4487-ts-java-staging-20261104-010500/sdk-live-evidence.json SHA-256 5adc21229b65087225e55f33f4e1185fac78401a972de6766dfcfe63464d92f5. Paid enforcement was returned to off/0 and the disposable stack was deleted; teardown receipt SHA-256 ac243a52cabc299ea5259a288ed346379f8044dcaabd705444967f52dc3b4dd2. No provider Send or live charge occurred. The AWS tenant/DB-role/cap/cancellation/revocation fixture and target-locked TLS transport are sealed in that separate staging harness. This exemption affects only the repository workflow's runtime-e2e/ file-presence check; it does not claim that a repo-local runtime suite ran or waive merge-source rebuild, final review, or publication gates.

Client release target and stop conditions

The user's 3 November instruction started the Flip-first Hosted 11.4.0 release train; platform and website stages are already released. Our team target for this client wave is 4–5 November 2026 (Europe/Amsterdam), ending 5 November 23:59 CET. This is a dated plan within 48 hours of its 4 November 05:33 CET recording, not a user commitment to a publication hour or authorization for a registry upload. The private release packet records the full dependency order.

Prep merge order is Go #248 → Rust #115 → TypeScript #296 → Java #256. Before this PR merges, require independent confirmation that the dated plan satisfies the playbook, exact head/base and DCO readback, its signed CI-down local board, and a scoped protection snapshot. Restore protection after the guarded squash, compare the merged tree to the reviewed head, then rebuild/hash/cold-test from that merge source. Stop if any gate changes or protection cannot be restored. The user owns tags and registry publication; a tag-triggered workflow must not race a manual upload. If the manual 4–5 November publication handoff slips, leave merged source unpublished, record a new dated window, and repeat collision, tag, workflow-race, build, digest, and cold-install checks. No automatic publication occurs at the window end.