[dzdidi]

Summary

• Bump only locks-server from workspace version 0.1.0 to 0.1.1-rc1; update its matching Cargo.lock package entry.
• Remove process-global PUBKY_LOCK_DATABASE_URL mutation from config-loading tests while preserving production environment lookup.
• Make PKDNS shutdown win over already-ready periodic retry ticks; strengthen regression with 20 simultaneous-ready iterations.
• Narrow RustSec remediation: update only Cargo.lock; no source, manifest, workflow, or audit-policy changes.
• No Paykit Rust or paykit-server dependency/source/version changes.

RustSec remediation

• RUSTSEC-2026-0382: rustls-webpki 0.103.15 -> 0.103.16 (fixed resolution).
• RUSTSEC-2026-0383: webpki-root-certs 1.0.9 -> 1.0.10 (fixed resolution).
• RUSTSEC-2026-0381: webpki-roots 1.0.9 -> 1.0.10 (fixed resolution).
• cargo audit --file Cargo.lock: passed with 0 vulnerabilities (advisory DB: 1348 advisories).
• Three pre-existing allowed warnings remain: RUSTSEC-2023-0089 (atomic-polyfill, unmaintained), RUSTSEC-2026-0253 (lru, unsound), and yanked chacha20 0.10.1.

Root causes fixed

• Three config-loading tests concurrently mutated/read same process-global database URL, causing default-parallel equality failures.
• Unbiased tokio::select! could choose ready interval tick after shutdown became ready, causing extra publish attempt.
• New RustSec advisories made hosted security audit fail at prior PR head; patched target-inclusive lockfile resolutions remove all three vulnerable versions.

RED evidence

• cargo test -p locks-server --locked --lib -- --test-threads=64: failed on first stress run, 364 passed / 1 failed; generated config database equality mismatch.
• Strengthened PKDNS exact regression before shutdown-first selection: failed with attempts 3 vs expected 2.
• Hosted RustSec at prior head 1087ee57b544dcf28a589d7853877663a3506858: failed on RUSTSEC-2026-0382, RUSTSEC-2026-0383, and RUSTSEC-2026-0381.

GREEN evidence

• Config loading tests: 3 passed under 64 test threads.
• PKDNS exact regression: 1 passed; each invocation contains 20 simultaneous-ready iterations.
• High-parallel library suite repeated 30 times: each run 365 passed, 0 failed.
• Default-parallel package suite repeated 3 times by implementation plus 5 more times by independent review: each run passed 365 library + 1 binary + 3 integration + 0 doc tests.
• cargo metadata --locked --format-version 1 >/dev/null: passed.
• cargo fmt --all -- --check: passed.
• cargo check --workspace --all-targets --all-features --locked: passed.
• cargo test -p locks-server --locked: passed; 365 library + 1 binary + 3 startup lifecycle + 0 doc tests, 0 failures.
• git diff --check ac8e893b4cb9d21b7736a431b511acd3efdfb83a..8f99a4313df00ec525aa1d6de878598caa195f24: passed.

Review

Independently approved exact commit 8f99a4313df00ec525aa1d6de878598caa195f24 (tree 694c7e6aa524e0f5df97ba7c543580e2321e05fa) as a clean fast-forward from prior PR head 1087ee57b544dcf28a589d7853877663a3506858, against master at ac8e893b4cb9d21b7736a431b511acd3efdfb83a.

Residual risk

• PostgreSQL/E2E/JS/WASM hosted suites were not duplicated locally for lockfile-only remediation; prior PR-head Checks succeeded, while approved head received full workspace all-target/all-feature checking plus locks-server tests locally.
• Hosted CI on exact approved head is required before merge.