[rmcdaniel]

The next minor changes durable predicate fingerprints and validates original static credentials before role selection. Operators need a clear upgrade and rollback boundary before deploying those changes.

Prepare the selected 3.10.0 source cohort from accepted main 9800ec4d (accepted #303–#312), with aligned Composer/quickstart release identity. Keep PHP ^8.1, Laravel 10–13, Symfony 6.4/7/8, Server baselines and runtime defaults unchanged. #219 remains draft/excluded, and #267 stays outside this major line.

The upgrade guide documents strict v1 dual-read, v2 recording/fallback, unchanged fingerprints on physical reopen, queue-wide compatibility and no rollback to older readers after v2 histories exist, atomic sources and OPcache restarts. The credential guide documents deliberate malformed-UTF8/edge-whitespace/control rejection, validation of unused roles and process handoffs, literal-empty fallback, setting-only diagnostics and exact valid-byte preservation. Navigation and changelog link the guidance.

Validation: 19 existing release-channel tests pass; candidate channel resolves stable=false; rendered release data/identity, support floors and navigation agree; whitespace, credential-pattern and public-boundary scans pass. Normal required CI runs on this draft. No runtime implementation, recording mode or default changes.

Candidate 3cda885, tree a3c96671f43789990e31b63cb48d77a0ed285841. No 3.10 tag or release exists. Main merge would trigger the existing portal preview build, whose stable selector refuses promotion without the matching published stable source; no manual dispatch is selected. Publication through APT/setup paths retains the central #295/#297 effect gate. The existing broad published-smoke workflow is not the proposed credential-only check: it starts a runtime.

A bounded registry-installed, fixture-only acceptance proposal follows on existing #307/#293 before any tag/release/installed run. It uses synthetic credentials and a refusing transport spy, checks every public/framework credential path, attests actual installed package/source paths, and makes zero real runtime requests. Package/source/archive and exact dependency graph must be bound before execution; absent published identity is a stop, not a source substitute. This PR starts none of those effects.

Refs #293, #307. Published/installed acceptance and remaining issue outcomes are separate from source preparation.

The ordinary successor aligns the Laravel adoption SDK channel with ^3.10 after the original docs job correctly refused its stale ^3.9 value. The framework matrix and embedded authority are byte-equal to accepted main; local contract readback passes. Fresh required qualification is running on this successor, with no retry or waiver of the failed source.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Follower audit for the selected 3.10 source preparation (exact current tree a3c96671):

• All seven repository workflow trigger definitions and the two managed analysis/update entries were inventoried. CI/Sonar are PR/main source workflows; the two published-runtime workflows remain manual-only. No repository workflow subscribes to release or workflow_run for automatic package/image publishing. The sole active configured webhook is Packagist, on push only; URL credentials/configuration were not printed or changed.
• A normal main source merge of these documentation/manifest paths triggers the existing portal build. Candidate 3.10.0 has no tag/release; the exact current source's release-channel check returns stable=false, and the existing deploy job requires stable=true plus main. Thus that source follower produces only a preview Pages artifact and skips live deployment. I will verify its actual result and unchanged live audit after source integration; no manual stable dispatch is selected.
• A future new tag is a separate publishing effect: the public-boundary all-push/source-analysis path may run and the Packagist push hook exposes the immutable Git package identity. No inspected workflow builds an SDK distribution/image on tag push. A future release publication has no configured release-event follower. These are observed trigger/source facts, not installed-package acceptance or permission to publish now.
• A future stable portal dispatch/promotion would use its actual PHP/setup/browser-APT path. That affected publishing path remains under the single central Pin the group checkpoint id, accept "=" separators and declare markdown-it #295/Clarify Carbon precision for very large friendly durations #297 closure. No such dispatch or promotion is part of Prepare 3.10.0 release identity and upgrade guidance #313, and the manual runtime smoke/cancellation workflows are not the fixture-only credential proposal.

The original f330 docs failure is preserved; normal successor 3cda8857 fixes the single stale adoption channel. Current normal CI42094802043 has no failures, with PHP and historical-docs cells still running. Sonar42094801971 and direct zero open issues are source evidence only. The installed credential proposal remains #307 (comment) with no solve/install/run selected.

[rmcdaniel]

Source #313 merged normally at 2026-11-05T19:38:09Z as 3716c19, exact tested tree a3c96671f43789990e31b63cb48d77a0ed285841, ordered parents [9800ec4, 3cda885]. Git and GitHub match the source objects.

PR qualification is terminal 42 checks = 41 success / one intended skip, with required Target branch qualification and SonarCloud green; direct Sonar reports zero open issues. The original stale-adoption-channel failure is preserved and corrected in the normal successor; no check, assertion or policy was waived.

This accepts 3.10.0 source preparation, including aligned release/adoption identity and the release/upgrade/static-credential guidance, on the unchanged PHP ^8.1 / Laravel 10–13 contract. #219 remains excluded/draft and #267 remains a separate major-window item. It does not publish a 3.10 package, create a tag/release, execute the proposed installed check or qualify native/Server behavior.

sdk-php now owns actual-main checks, the existing automatic preview-only portal follower/live preservation, and exact branch cleanup. Those results are pending; none is called green here. General is receiving this exact accepted source before any tag/release/installed effect. The bounded fixture-only proposal keeps graph/runner/registry identities and execution unqualified. The follower audit preserves the separate stable-promotion effect gate.

[rmcdaniel]

Owner actual-main / preview / live-preservation acceptance and cleanup are complete.

• Normal merge 3716c19, exact tested tree a3c96671f43789990e31b63cb48d77a0ed285841, ordered parents [9800ec4,3cda8857], matched through Git and GitHub.
• PR qualification: 42 terminal =41 success /1 intended skip, required Target branch qualification and SonarCloud green; direct Sonar zero. Actual main: 42 terminal =40 success /2 intended skips, no pending/failing. CI42095770847, Sonar42095770754, Public Boundary and Push on main succeed.
• Portal42095770868 built successfully and skipped deployment. Preview artifact 13446343238, digest sha256:a021ada58a7ac3efd8790f745d28d8bec02fd6ee3b3b58e98166381a11667172, independently contains exact source3716c192 in its audit. The new upgrade/auth pages render3.10.0 without unresolved template variables.
• Live remains HTTP200 /118 bytes /source 6a821568db5c72983bd3990fe27c7990f092db12 /SHA-256 43c0159fc3ee9317a32e644e20d61d47d2fbf64d23194efe7b8e1f2b86514cd1. No stable promotion or manual dispatch occurred.
• Exact merged3cda8857 was verified as an ancestor with matching remote head, clean worktree and no dependent open PR. Owned remote/local prep/3.10-source-cohort were removed normally; Git transport and GitHub404 verify absence. The detached worktree is retained at accepted main; handoff branches are untouched.

This accepts source preparation, not a narrower release on the interim framework contract. Final combined-minor freeze/tag still requires actual published Workflow2.21 manifest/verifier, published native flat-child-all plus normally installed SDK tuple, and final combined candidate qualification (retained decision). PHP ^8.1 / Laravel10–13 remain the interim source contract; no early framework change or default/mode change was made. #219 stays draft/excluded; #267 stays separate.

General assigned the next independent source slot: sdk-php authors/freezes the narrow #307 caller-owned fixture runner and dependency intent using canonical319 expectations, real public/framework probes, synthetic inputs and a refusing transport spy. No new controller, solve/install/registry substitution or tag/publication is selected. Eventual registry3.10 identity, complete advisory-enforced graph, sealed archives and actual execution remain future inputs. The source-preparation and installed-acceptance distinctions remain open on #293/#307/#239/#185.