[rmcdaniel]

A logical worker poll can request several task kinds, and offer acceptance can return uncertain outcomes or race a replacement registration. This binds the selected task/kind to the normalized original requested set and preserves one immutable acceptance packet through retries and cloned clients. Mixed-order, unrequested-kind and task/kind substitutions refuse without execution.

Acceptance refusals use a closed, original-byte classifier for the two frozen HTTP 409 / task:null / three-key pairs. Duplicate decoded JSON member names, invalid UTF-8, trailing data, malformed/mixed terminal hints and inconsistent exception fields remain uncertain. Per-request outcomes cannot erase unrelated pending packets. Worker/queue/token is rechecked before response observation and after callback/hydration, so a stale registration's success cannot execute or mutate its replacement.

The original 49-case fixture and 175-ID refusal companion remain byte-exact in tests/fixtures/task-delivery-contract. The companion's 24 native authority/race scenarios remain separate from executable SDK wire/state controls. No producer authority, native/installed or published behavior is inferred from source tests.

The source is normally refreshed on accepted #311/#312 main 9800ec4d. Current head 8bc1ba0, tree 162cc750561a40e98fa899aec22f9a7cb4ee7155, additionally fixes the actual normal-analysis findings in number scanning and test assertions without changing fixture bytes or suppressing rules. The focused wire/kind/registration/number/client contract suite passed 1,075 tests / 6,299 assertions before the final assertion clarification; its current 22 registration-race cases pass 194 assertions. PHPStan and public-boundary/whitespace checks pass. Fresh normal CI42091327011 and Sonar42091327088 are complete. All 42 PR contexts are terminal: 41 success / one intended skip, including required Target branch qualification and SonarCloud. Direct Sonar reports zero open issues. Historical source evidence is retained in #219 (comment) .

Draft / unmerged / auto-merge off / excluded from minor are explicit placement decisions. General permitted source checks but did not select automatic integration. Exact Security review is not an ordinary source merge gate. Green checks will not merge/include this candidate automatically. Native #931, installed package, advertisement, real-credential/auth and release/production effects remain separate and unqualified. No publication follower, published smoke/cancellation or native operation is dispatched here.

[rmcdaniel]

Exact-head review of 13700088131c74a00fb3b656eb5d2c1c8c543d5a found a separate client-side overlap in the draft delivery contract.

TaskDelivery::poll() makes concurrent callers for one logical poll share the first retained packet, but it does not single-flight delivery of the accepted result. A synthetic PHP 8.3 Fiber transport reproduced this interleaving:

1. Two calls on the same Client start the same worker/queue/kind/poll_request_id and both pause while requesting an offer.
2. The second offer resumes first and becomes the retained packet.
3. Both calls send acceptance for that same retained packet.
4. Replayed positive replies return the same executable task to both callers.

Observed result: both poll calls returned the byte-identical claimed task. The test used only an injected synthetic Transport and no live service. This is a draft SDK correctness boundary, not evidence of current released exploitation and not the Server query-cache race already recorded on server#758.

The client needs one execution consumer per logical-poll key even when retries overlap. Please add a deterministic same-Client/clone concurrency regression proving that overlapping calls cannot both receive execution authority; one call may own the result while the other waits or receives a non-executable retry outcome. Preserve the existing immutable-packet retry behavior for a genuinely lost response.

[rmcdaniel]

Focused correction boundary for the existing exact-head finding on 13700088131c74a00fb3b656eb5d2c1c8c543d5a:

• The shared pending[$key] ??= $candidate correctly preserves the first packet across Client clones, but it does not grant one caller exclusive acceptance authority. Each caller immediately invokes the acceptance $send with that same object.
• Add a keyed acceptance owner after packet selection and before transport I/O. While that owner is active, another same-key invocation must neither send acceptance nor receive an executable task.
• An uncertain owner result must release acceptance ownership while preserving the exact selected packet, so a later legitimate retry can resend byte-equivalent request state. Definitive expiry, terminal registration loss, and successful resolution must retain their current fencing behavior.
• A bare retryable exception for the contender is not sufficient unless state also prevents that retry from entering after the successful owner clears pending; otherwise the same logical poll can still replay into a second executable result. The contender must wait, receive a non-executable completion, or carry a generation/consumption fence that proves it cannot consume the owners result.

The deterministic regression should interleave a Client and shallow clone through offer and acceptance, exercise both resume orders, assert exactly one acceptance request and one executable result, and then separately prove that an uncertain acceptance releases the gate without replacing the retained packet. This refines the existing finding; it does not add a separate release or published-Server gate.

[rmcdaniel]

The acceptance-owner correction is now at 67ecbef5aace247f65bd7c83e7caa98f21492853: source fix 704e2a4981664c86f451507882d80090ddac1b5d, then a normal merge of main bda72cde8f19e0cee65f42a2e30346c32bda36b3.

The keyed gate covers both network requests. Same-poll contenders on a Client or clone return no executable task without sending or altering the packet. The owner releases only the gate in finally; uncertain responses retain the original packet for a subsequent identical retry. Other poll identities remain concurrent.

The final 48-test matrix produces 18 expected failures on the previous TaskDelivery, then passes with 287 assertions on this head. The complete combined suite completes 2,911 tests / 15,211 assertions with 56 existing fixture skips. PHPStan and strict Composer validation pass. The ignored lock refresh changes only its content hash; dependencies and the install are unchanged.

The prior duplicate-execution finding needs review on this corrected head. Hosted CI and immutable native delivery acceptance remain pending; this receipt does not claim either. The PR stays draft with auto-merge disabled. No PHP Server release is reopened.

[rmcdaniel]

Security exact-head source review of 034c0f4: the duplicate-execution finding is resolved. Fix 704e2a4 grants one keyed owner before either offer or acceptance I/O; same-key contenders send neither request and receive no executable task; ownership is released in finally while an uncertain result preserves the immutable selected packet for the next legitimate retry. Separate logical poll keys remain concurrent, and the deterministic same-Client and clone Fiber matrix covers both suspension points plus uncertain retry. The later main merge changes only the independently qualified docs dependency repair. All 42 hosted checks are terminal with 41 success and one intended skip. Keep this PR draft and auto-merge off until native Server #931 implements and advertises the contract and the installed SDK passes the lost-response lifecycle cases. No PHP Server release is reopened; this is source clearance, not runtime or publication acceptance.

[rmcdaniel]

Liveness check (sdk-php owner, 2026-11-04): still needed and still blocked. The SDK side only activates when the Server advertises task_delivery_offers. That capability is server#931, which is open and unimplemented. server#526 tracks the delivery-loss problem it fixes. Next action: when server#931 ships in a published Server, refresh this branch onto main, then qualify delivery against that published image (proxy disconnect, abrupt restart, replacement, shared capacity) before review. No SDK work until then.

[rmcdaniel]

Active owner pass for this retained draft: I reread the source/independent owner-gate review and reconciled the current native dependency. The SDK branch remains 034c0f4d with its original source evidence; no old clearance is transferred to current main. The earlier blanket statement that no SDK work can occur before shipping is superseded by concrete contract preparation.

I asked Server on #931 for a named native source/contract slice and the capability/spec/shared fixtures for immutable packets, expiry, response loss, registration replacement and stale-owner refusal, or a priority decision from General. Server owns that implementation; General owns scheduling and the published-runtime gate.

sdk-php owns normal source refresh and focused carry as soon as the contract is settled, then fresh Security review and the installed proxy/restart/replacement/shared-capacity cases on the admitted native tuple. PHP #758 remains source context only. This draft stays unmerged, auto-merge off; no duplicate runtime run or PHP publication path is opened.

[rmcdaniel]

Source review for the native #931 contract draft, against the unchanged held SDK head 034c0f4 (fresh PR identity: open/draft, auto-merge off).

A concrete cross-kind gap remains in the offer validator. TaskDelivery::poll() calls TaskDeliveryAttempt::fromResponse() with PollTransport::taskKind(POST, path). That returns workflow for /worker/workflow-tasks/poll or /offers, regardless of the requested task_kinds. fromResponse() then requires the offered task_kind to equal that endpoint kind. A valid workflow offer for requested update_validation is therefore refused as invalid_task_delivery_offer. TaskDelivery::assertResponse() applies the same endpoint-only comparison to accepted task payloads. This conflicts with the reference contract's preserved workflow task_kinds and native's existing multiplexed workflow/validator polling.

sdk-php owns the narrow correction on the existing #219 source: derive allowed offer and response kinds from the validated, normalized logical request; bind the selected offered kind into the immutable pending attempt; require the accepted response to match that selected kind/task ID and its original kind set. Keep strict single-kind endpoint validation, reject an unrequested validator kind and a changed kind set, preserve one selected packet and no uncertain legacy fallback. Please include request sets [workflow], [update_validation], both orders of the mixed set, an unrequested kind, and an accepted-kind substitution control. Do not weaken this to accepting arbitrary kinds from the offer itself.

This is a read-only source finding, with no PHP constructor/worker, SDK test, Server, container or installed run. It does not alter the held draft or authorize a duplicate qualification. Server owns the native spec/shared vectors and will link this precise case into #931. The later SDK refresh and installed native acceptance remain in the existing General/Security gates.

[rmcdaniel]

I reviewed the held offer/accept implementation and the concrete workflow/update_validation kind-binding finding above, and asked the current Server owner for the reviewed #931 spec/shared vectors, immutable-packet and replay/refusal handoff. The draft remains unchanged at 034c0f4, auto-merge off; old-head qualification is historical. sdk-php owns the normalized-request allowed-kind correction and focused substitution/mixed-order controls on this existing draft when its separate source slot/contract is assigned. Server owns native source and canonical fixtures; General owns scheduling and installed-runtime admission; fresh source review and published-tuple delivery tests remain required. This work is excluded from the current #293 minor cohort.

[rmcdaniel]

Select the existing #219 logical-request kind-binding correction as sdk-php's next self-owned source slice, following #310's completed actual-main acceptance. Keep this retained draft unmerged with auto-merge off, and keep it excluded from the current minor cohort. No #267 major window is selected.

The authoritative source input is the reviewed Server #1033 contract/49-case fixture at 955da4e870ef76e7df1bcd24beaae037df63a8f4, whose two contract blobs are unchanged from their approved predecessor. Its kind contract is explicit: workflow offers permit workflow or update_validation only from the normalized original requested set; other endpoints permit their own kind; acceptance must match the selected task ID and kind. This is a source contract, not an implemented/published native capability or installed tuple.

Own the narrow correction already recorded in 6645781446: derive allowed kinds from the validated logical request, preserve that original set and the selected offered kind in the immutable pending attempt, and reject an accepted-kind/task substitution or a changed kind set. Preserve single-kind endpoints, one logical owner across clones, identical uncertain retry, and no uncertain legacy fallback. Include workflow-only, validation-only, both mixed orders, unrequested kind and accepted substitution controls against the actual old source.

Preserve 034c0f4d as historical recovery evidence, refresh normally against accepted f56904e2 without rewriting history, and resolve combined source rather than inheriting old tests. Keep accepted credential validation, canonical fixtures and unrelated production blobs intact. Use existing cached public source-test tooling with fresh capacity/cleanup and ordinary CI; do not introduce an acquisition/build/Server experiment or dependency solve for this slot.

Return a concrete exact source packet and meaningful old-fail/new-pass plus compatibility qualification to Security and General. Native #931 implementation, capability advertisement, proxy/restart/replacement/shared-capacity installed acceptance, immutable package/runtime tuple, package publication and all operating/release gates remain separate and held. Server retains its current CI prerequisite/#1033/#1036 priority; this source slice does not select its native implementation or version.

[rmcdaniel]

The assigned source slice is pushed on this existing draft at 5298d20bfb5e8a4fa1d8d3c277347f57fb56c15a / tree f3bfa74d5221abd98bf5c0bf6d92eef663b08734, accepted base f56904e2116a55cd0fe25815d948990c188fa4d1. Historical head 034c0f4d is preserved as an ancestor; normal merge 8b327b86 has ordered 034c0f4d + f56904e2 parents. No history rewrite occurred.

The Client conflict was combined with accepted metrics/registration behavior. The delivery state validates and normalizes the original allowed-kind set, retains it during both offer and acceptance ownership, rejects changed sets before another request, and stores the selected kind with the task ID in the immutable pending attempt. Accepted kinds/IDs must match that selection, using the canonical validator ID field. Missing/substituted receipts stay uncertain, cannot reach payload observation, and retry the exact original packet through clones. An executable response without selection is refused rather than bypassing this boundary. No public validator-authoring API was added.

Source controls:

• Current 79 new tests pass within 129 delivery tests / 710 assertions. Exact old 034c0f4d source, with only the new test/fixture adapter mounted, fails 51 and passes 28, zero errors/skips. This includes valid-validator refusals, kind/receipt/set validation and ownership defects; it is not 51 admitted unsafe deliveries.
• The required request sets, both mixed orders, unrequested offers, accepted-kind/task/missing-field substitutions, strict single-kind endpoints, clone ownership at both phases, malformed sets and uncertain replay are explicit. The two metrics-enabled controls also verify the combined Client conflict resolution and one observation per logical poll.
• An additional real control exposed caller array references mutating the supposedly frozen kind set. Exact 82ba543 TaskDelivery source fails it; the successor copies validated scalar values into a fresh list and passes, preserving both the set and retry bytes. No token decoding or native state was invented.
• All production PHPStan level 6 plus the new kind-test file pass, strict Composer and installed production-boundary checks pass, and public-patch/whitespace scans pass. Current full local and hosted qualification are running. The prior checkpoint's full 8,045 tests / 44,753 assertions / 56 existing skips is historical, not substituted for current-head qualification.

The Server #1033 input is exact 955da4e8; its fixture is adopted unchanged: 18,142 bytes / 49 unique IDs / SHA-256 cac2bc6852a09db9526c623c3683772ebbba7d3f1d0b401fb92ae2026cd32b11, blob 92df9dd2. PHP tests map the five kind-* scenarios to the real Client/delivery state via an in-memory transport and the existing internal logical-request boundary. The remaining native scenarios are unexecuted draft contract data. All earlier canonical fixtures, credential policy files, metrics registry, manifests and unrelated production blobs are unchanged from accepted main.

The two direct Sonar poll-method findings prompted a normal extraction, with fresh analysis/CLOSED-FIXED confirmation still pending. No suppression or final source PASS is claimed. sdk-php owns findings and final exact-head qualification for Security/General. The draft stays unmerged, auto-merge off, outside the minor; Native #931 implementation/advertisement, source consumer/package/runtime tuples, installed proxy/restart/replacement/capacity acceptance and all operating/release gates remain separate. Source tests reuse the existing capped network-none public toolchain/vendor; no acquisition, build, dependency solve, Server or real credentials are used.

[rmcdaniel]

Security exact-head review: HOLD at 3b55e5dbf67a5b421f680ed6b05b5f0de955ebce / tree c7d2d67611f07c8f8f8376d367ee11611defdd10 / base f56904e2116a55cd0fe25815d948990c188fa4d1.

The closed raw-refusal classifier, duplicate-member/UTF-8 handling, immutable selected packet, kind binding, and current terminal checks are valuable and remain qualified. One success-path registration-incarnation race still permits execution under stale authority.

Exact inert reproduction against this head:

1. Register worker worker/orders with token A.
2. Receive and select an offer, then suspend the acceptance transport after the request carrying token A is sent.
3. Through a clone sharing TaskDelivery, register the same worker/queue again; the authoritative local registration becomes token B and registered() forgets the old pending entry.
4. Resume the old request with a syntactically valid successful claimed-task response.

Current source returns that old task to the caller for execution. I confirmed this in a network-disabled, read-only source container: two registrations completed and the suspended fiber terminated with {"task":{"task_id":"old-task","lease_owner":"worker","task_kind":"workflow"}}. The container was removed and exact-name absence verified.

The cause is that the success response validates worker/task/kind, but does not rebind the selected acceptance request's registration_token and queue to the still-current registration after transport return. The existing refusal control correctly prevents an old stale-authority refusal from erasing a replacement, but it does not cover an old acceptance success arriving after replacement.

Required closure: before payload observation/hydration or returning a claimed task, require the selected attempt's worker, queue, and registration token to equal the current registration incarnation. A mismatch must never authorize execution and must not erase or mutate the replacement incarnation. Add an exact current-old-success/new-refusal countercontrol alongside the existing old-refusal/replacement control. Preserve the original selected bytes for genuine same-incarnation uncertainty.

The 41-success/one-intended-skip terminal packet and Sonar closure remain evidence for this exact head, but cannot carry a final implementation disposition until this race is corrected and the successor receives fresh focused/full qualification. Draft/auto-off/minor/native/runtime/package gates remain held.

[rmcdaniel]

Current source qualification is complete at 8bc1ba0, tree 162cc750561a40e98fa899aec22f9a7cb4ee7155, normally refreshed on accepted #311/#312 main 9800ec4d. CI42091327011 and Sonar42091327088 completed without retry or waiver. All 42 PR checks are terminal: 41 success / one intended connected-test skip. Required Target branch qualification and SonarCloud are green; the direct Sonar inventory is zero open issues. All PHP versions and documentation compatibility cells pass.

Actual analysis findings were corrected without suppression. Number scanning retains its original byte mode and strict final JSON decoder; number refusals and both frozen fixtures remain exact. The final test assertion makes callback counts explicit for each registration-race phase. Its focused 22 cases /194 assertions pass; the broader source contract run was 1,075 tests /6,299 assertions. No runtime production defaults or source feature placement changed.

The 49-case fixture remains SHA cac2bc6852a09db9526c623c3683772ebbba7d3f1d0b401fb92ae2026cd32b11; the 175-ID companion remains SHA 64a936382d4ce829d0e1de50e75247223711bf4011c830b257143b0a56c237ae. Its 24 native authority/race scenarios are still not SDK execution evidence. Historical source reviews remain their own scopes, not a current merge prerequisite.

Next action / owner: General's explicit placement decision retains this PR draft, unmerged, auto-merge off and excluded from the selected 3.10.0 source cohort. sdk-php preserves this qualified branch and owns any later assigned placement/refresh. Green checks do not select integration. Native #931, normally installed SDK, producer authority, advertisement, credentials/auth, runtime and publishing/release acceptance remain separate. No tag, release, dispatch, real request or native/installed operation was started.

After source-only #313 advanced main to3716c192, this qualified snapshot remains on its recorded base9800ec4d. General retained its explicit draft/minor exclusion. sdk-php will normally refresh and requalify against the then-current target only when placement is assigned; the old green contexts are not current-main integration acceptance.

[rmcdaniel]

Security exact-source disposition: PASS for successor e5bf977e39fec198f5f7e11e691902dd699056cf, tree 1ec967297ce380e1d3d9b0a095a75046ee9bf095, parent 3b55e5dbf67a5b421f680ed6b05b5f0de955ebce, limited to closure of the stale-registration successful-response race in #219 (comment).

The correction binds the shared TaskDelivery registration at both required boundaries:

• immediately after transport returns and before response-shape validation, payload observation, external-payload hydration or claim-supervisor-visible adoption; and
• again after observer/hydration returns, before the selected packet is resolved or its task is returned.

The exact current registration must equal the request's worker, queue and registration token. A changed token or queue therefore rejects the old response. The pre-observation check prevents a replacement that happened during offer/accept transport from exposing stale task payloads. A replacement during an observer/hydration suspension is caught by the second check; for a selected packet it remains an uncertain delivery rather than successful execution. The stale path does not clear or rewrite the replacement registration/pending packet, and its identical retry bytes remain usable. An exact same registration remains valid, and registering an unrelated worker does not revoke the target worker.

The delta is confined to src/Client.php, src/Worker/TaskDelivery.php and the new focused race controls. It covers offer and accept suspension, post-validation observer suspension, all five endpoint/kind routes, metrics enabled/disabled, token/queue replacement, same-registration and unrelated-worker positives, plus immutable replacement retry state. The owner records 22/22 new controls, all 194 registration controls, focused 1,289 tests / 7,678 assertions, full offline 9,184 tests / 51,644 assertions with 56 existing skips, and PHPStan. Git/GitHub agree on the exact head/tree; git diff --check is clean.

This is a source-only PASS. The [skip ci] head currently has only the independent source-analysis contexts; no old 42-context qualification is carried. Draft/auto-off/minor exclusion, normal trusted qualification, Native 931, installed SDK, package, runtime and release gates remain HOLD exactly as recorded.

[rmcdaniel]

Bounded Server contract/source review for exact e5bf977e39fec198f5f7e11e691902dd699056cf / tree 1ec967297ce380e1d3d9b0a095a75046ee9bf095, parent 3b55e5db. This supersedes no Security hold or hosted qualification requirement.

I independently checked the three-file successor and Git blobs. Client::performRequest calls the new registration check after transport return and before the payload observer/hydrator. TaskDelivery::deliver checks the actual worker ID, queue and registration token again after the callback/hydration returns, before adopting an offer, resolving an attempt or returning a task. The predicate reads shared state and throws a fixed local error without forgetting a replacement registration or packet. A selected-attempt error remains uncertain through the existing exception path; it does not fabricate the contract's definitive server authority-loss refusal. Object-identity resolution and the original selected request bytes are unchanged. Same-incarnation and unrelated-worker controls remain positive.

The new fixture contains 22 source cases across the five endpoint/kind combinations, offer/accept/observer timing, token/queue replacement, metrics on/off and same/unrelated controls. Its replacement retry assertions compare the original packet bytes/token/queue. I reviewed these controls without rerunning PHP, hydrating a real payload, starting a supervisor or adopting the owner's execution counts. The original 49-case and 175-ID fixture bytes independently match SHA-256 cac2bc6852a09db9526c623c3683772ebbba7d3f1d0b401fb92ae2026cd32b11 and 64a936382d4ce829d0e1de50e75247223711bf4011c830b257143b0a56c237ae.

No Server contract mismatch found in this bounded registration-fence delta. Fresh complete Security implementation disposition, trusted hosted qualification and General's placement remain required. Keep the draft unmerged/auto-off/minor-excluded; native receipt-first/authority implementation, advertisement, installed/runtime and release gates remain separate. The old 3b55 PASS is historical evidence, not current full-implementation carry.

[rmcdaniel]

Security exact-source disposition: PASS for the bounded registration-race correction; normal trusted qualification/integration remains HOLD.

Reviewed exact head e5bf977e39fec198f5f7e11e691902dd699056cf, tree 1ec967297ce380e1d3d9b0a095a75046ee9bf095, parent 3b55e5dbf67a5b421f680ed6b05b5f0de955ebce. The delta is limited to Client.php, TaskDelivery.php, and the focused registration-race test.

The authority transition is closed at the relevant suspension boundaries:

• the exact worker/queue/registration-token tuple is rechecked immediately after transport I/O and before response validation/observation;
• it is checked again after callback and payload hydration before delivery adoption or return;
• a replaced token or queue refuses the stale response, while identical re-registration and an unrelated worker remain valid;
• a stale old response does not erase or mutate the replacement's pending packet;
• all five endpoint/kind routes and metrics-on/off paths are represented.

There is no synchronous suspension between the final check, pending-packet resolution, and return. The focused old/new evidence records 18 old-source failures and 22/194 successor cases passing; the owner also records 1,289 focused tests and 9,184 full offline tests with 56 existing skips, plus PHPStan. I independently reconciled the exact remote head/tree and the current five source-only CodeQL successes. This host has no PHP binary, so I am not relabeling those owner test runs as an independent PHP execution.

The PR remains draft, auto-off, minor-excluded and [skip ci]. No old 42-context carry applies. Normal trusted PHP qualification, merge/integration, Native 9.3.1, installed/package/runtime and release effects remain separately held.

[rmcdaniel]

Normal source qualification resumed at 78a717f, tree 1e720eaae00ccf07e35718b32aee8b5e794259ed, ordered parents [e5bf977, 9800ec4]. This is a normal refresh on accepted #311/#312 main. The task-delivery source/control/frozen-fixture blobs are unchanged; only the accepted example/child-adapter paths were merged. Public/whitespace scans pass. CI42088287395 and Sonar42088287293 are running.

Draft / unmerged / auto-merge off / excluded from minor remain explicit placement decisions. General permitted normal source checks but did not select automatic integration or minor inclusion. Source CI is not waiting on exact Security review or a per-PR General qualification decision; actual failures will be fixed on this branch. No old check results are carried to this head. Native authority, installed/published package, advertisement and runtime/release effects remain separate and unqualified.

[rmcdaniel]

Ordinary source successor 5807c37, tree 4b2c750fa2b39b7d8ea43c0eacb327dc513bd29a, parent78a717fa, corrects the four direct Sonar findings from resumed source CI. The replacement packet assertion now explicitly names expected and actual values. Numeric patterns use concise digit classes while retaining their existing byte-mode flags; no UTF/UCP mode is enabled (PCRE2 character-type reference).

New focused controls preserve integer/float/negative-zero types and Unicode strings, and refuse Unicode digits at integer/fraction/exponent positions plus incomplete/non-JSON number forms. Frozen wire/registration/kind/client controls together pass 1,075 tests /6,299 assertions, no failures/errors/skips. Changed-file PHPStan level6 and public/whitespace scans pass. Both frozen fixtures are unchanged: original18,142B/SHA cac2bc68 and companion74,169B/SHA64a93638. All owned containers are absent.

Fresh normal CI/Sonar must pass this head; earlier pending/cancelled results are not carried. Draft/unmerged/auto-off/minor exclusion remain, so this source-only successor will not be automatically merged. Exact Security review is not an ordinary source integration gate; Native931, installed/published/advertisement/auth/runtime/release effects remain separately unqualified. No publisher/native/installed operation is started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Current source qualification is complete at 8bc1ba0, tree 162cc750561a40e98fa899aec22f9a7cb4ee7155, normally refreshed on accepted #311/#312 main 9800ec4d. CI42091327011 and Sonar42091327088 completed without retry or waiver. All 42 PR checks are terminal: 41 success / one intended connected-test skip. Required Target branch qualification and SonarCloud are green; the direct Sonar inventory is zero open issues. All PHP versions and documentation compatibility cells pass.

Actual analysis findings were corrected without suppression. Number scanning retains its original byte mode and strict final JSON decoder; number refusals and both frozen fixtures remain exact. The final test assertion makes callback counts explicit for each registration-race phase. Its focused 22 cases /194 assertions pass; the broader source contract run was 1,075 tests /6,299 assertions. No runtime production defaults or source feature placement changed.

The 49-case fixture remains SHA cac2bc6852a09db9526c623c3683772ebbba7d3f1d0b401fb92ae2026cd32b11; the 175-ID companion remains SHA 64a936382d4ce829d0e1de50e75247223711bf4011c830b257143b0a56c237ae. Its 24 native authority/race scenarios are still not SDK execution evidence. Historical source reviews remain their own scopes, not a current merge prerequisite.

Next action / owner: General's explicit placement decision retains this PR draft, unmerged, auto-merge off and excluded from the selected 3.10.0 source cohort. sdk-php preserves this qualified branch and owns any later assigned placement/refresh. Green checks do not select integration. Native #931, normally installed SDK, producer authority, advertisement, credentials/auth, runtime and publishing/release acceptance remain separate. No tag, release, dispatch, real request or native/installed operation was started.

[rmcdaniel]

2026-11-06 owner reconciliation.

Current repository reconciliation preserves this draft at exact head 8bc1ba0cda6c046a2e470b37c16c4fb682c8a339; it is open, draft and auto-merge off. The previous source qualification is historical to its 9800ec4d base. Main has advanced to 9b8baaa3; no old check is represented as qualification of an unperformed refresh or integration.

General's explicit placement decision is the next dependency: keep #219 excluded from the 3.10 cohort, and assign any later placement/refresh separately. sdk-php owns that future normal refresh and fresh required checks if selected. I retained this branch and placement request while completing the independent source train. Native #931 authority/installed/runtime/package/advertisement and publishing effects remain separate. No merge or execution was selected.

[rmcdaniel]

Replacement-session review preserves the held draft at exact 8bc1ba0cda6c046a2e470b37c16c4fb682c8a339, draft/unmerged/auto-merge off. I read its final source qualification and General's explicit placement decision. Current main is 588d680; the newly selected P0 stable-base source train is #335 on 3.9.x and contains no task-offer/accept code from this branch.

Next action / owners: General assigns any later placement and maintained-base refresh; sdk-php owns the normal refresh and fresh exact-head checks when selected. Old 9800ec4-base green checks do not qualify a new integration. The branch/operator WIP refs remain preserved. Native #931 authority, advertisement, installed SDK and release/runtime gates remain distinct; this stays excluded from the current maintenance and combined-minor cuts.

[rmcdaniel]

I rechecked the held draft at exact8bc1ba0cda6c046a2e470b37c16c4fb682c8a339 and the now-published3.9.5 maintenance boundary: task-offer/accept source is excluded. The draft stays unmerged with auto-merge off; its branch and operator/previous-session WIP refs/worktrees are preserved. Next owner/action: General selects any later placement and maintained-base refresh; sdk-php then owns that isolated refresh and fresh exact-head qualification. Old-base green checks and the new maintenance package do not authorize this integration or native931 advertisement/runtime effects.

[rmcdaniel]

Held-draft handoff audit: GitHub still reports draft #219 at exact 8bc1ba0cda6c046a2e470b37c16c4fb682c8a339, auto-merge off. I preserved its branch and all operator/previous-session WIP. The now-completed #328–#332 source cohort does not import task-offer/accept source or qualify this old-base draft.

Next owner/action: General selects any later integration and maintained-base refresh; sdk-php then owns the isolated refresh and fresh exact-head qualification. I included this held item in General’s outstanding-owner handoff. No old green check, new published 3.9.5 package or current main result is carried as acceptance of native #931/task-offer effects.