[rmcdaniel]

Problem

Service-SDK counterpart of durable-workflow/.github#221 and Workflow#866. Normally installed PHP SDK 2.5.3 reproduces terminal failure when a redeployment adds a required entry argument before the first task or after a committed condition wait, and when the recorded integer is no longer accepted by a string parameter. A genuine body TypeError still fails, and a compatible optional addition completes with exact typed output.

The isolated target is the already candidate-qualified PHP Server525 source, not a published routing fix or native runtime. The five published-SDK business originals and the two unsuccessful fixture setup attempts remain separate.

Source correction

Candidate 729b7151c76ca78337ba479eae4a051f064d1f9a, whole tree 3ee1474ea2ee452f9b3034196358449472a5f60b, validates the real discovered callable's entry inputs before entering application code. It reports a typed nonterminal workflow-task replay refusal with safe binding metadata, preserving claim/input/history/deadlines. Genuine body failures retain business failure semantics, including a body that deliberately throws the new internal exception. PHP's compatible optional, nullable, union, variadic, integer-to-float and trailing-argument rules remain explicit controls. The first variadic context parameter is also checked against recorded input.

Verification and remaining delivery

• Tests-first 802072bc has nine actual failures and seven passing controls. Its first mock omitted a later activity poll; that unsuccessful fixture attempt remains distinct from the corrected counterfactual.
• Full local PHP 8.3 suite: 2,516 tests, 12,471 assertions, 56 skips, no failures. Final focused entry/corpus selection: 23 tests, 66 assertions. Five changed PHP source/test files pass PHPStan with its existing level 6. An earlier 128 MiB analysis ran out of memory; the explicit 768 MiB process succeeds. Missing generic/array annotations were corrected without suppressions.
• The minimized actual post-wait input history is retained in the official replay corpus. All 41 PHP fixtures pass through the official Worker consumer. The new fixture fails against the normally installed published producer with expected.type does not match, rather than passing because the test runner cannot load.
• Five published originals, five initial source originals and six final-runtime originals remain separate. Final originals prove three typed nonterminal refusals followed by compatible cold code and supported repair of those exact runs, a genuine body TypeError, a deliberately thrown internal exception remaining a business failure, and a compatible optional addition. Every business worker exits 0. Nine separate normally installed cold clients preserve integer maximum/null/Unicode results.
• Stopped read-only SQL verifies 16 business runs, 26 tasks, 104 events, six intentional repairs, 38 worker exits 0 and zero registrations. Original microsecond starts plus 30-second run / 60-second execution deadlines, exact history prefixes and database/WAL hashes are preserved. One earlier selected-run observer setup admitted a separate waiting run; it is not counted as a passing original. The earlier registration observer missed the actual /worker/register route before any business admission. Neither fixture mistake is called a product defect.
• API shutdown required 137 with no OOM after the business controls finished. Graceful API shutdown is not qualified.

The last source follow-up addresses valid Sonar S1142 with separate union/intersection helpers and a match dispatcher, without a threshold change or suppression. The final focused 23 tests / 66 assertions, 41 official fixtures and changed-file PHPStan pass. The actual HTTP final-runtime cohort belongs to 7321bcf9; the later dispatcher refactor is separately checked by these tests and the normal CI.

All applicable exact 729b7151 candidate checks now pass, including PHP 8.1–8.4, Laravel 9–13, Symfony 6.4/7/8, official replay corpus, package/portal, target qualification, analysis and public boundary. Connected cooperative cancellation remains conditional SKIP. Exact Sonar workflow/app passes and the PR API has zero unresolved findings. Source merge/fresh main, stable publication and installed artifact/API/Waterline acceptance remain pending. No SDK major, protocol floor, Server runtime, dependency or frozen actor change. The independently reproduced Python counterpart remains SDK Python #170; Rust's typed-input adapter is still open in .github#221. Server#518 release remains held until the relevant client safety is qualified.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud