[rmcdaniel]

The stable documentation preview renders the new portal but retains the old API header: phpDocumentor's implicit SDK-checkout overrides take precedence over the staged template argument. Keep the staged .phpdoc/template layout and run the renderer from that staging root, preserving the published SDK's API index, guide bodies, examples and source.

Require the shared identity controls on every themed page before browser acquisition. Normal CI retains its legacy render and adds the accepted-presentation/stable-source composition, including browser checks and screenshots, with both source revisions bound afterward.

Validation: the old stable render reproduces the missing-header refusal; the correction passes seven source-isolation controls, all 393 page/link/contract checks, analytics across 17 portal + 376 API pages, and 56 local browser theme/viewport cells. All 376 API page paths, normalized content text, content anchor IDs and links match the prior stable render. Twelve screenshots retain the 3.9 install contract and show the corrected API chrome. Shell syntax, ShellCheck, JavaScript syntax and public-boundary checks pass. Fresh hosted checks remain required.

Follow-up for #315 after build-only run 42130196926 failed with deployment skipped. This does not include #318's unqualified stock-browser proposal or lift publication/setup/browser gates. No tag, package release or deployment is selected.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Normal merge is independently verified as a53bc7c, reviewed tree 30b42328f751d01fc17074fde57bfa5cdadf9f94, ordered parents 260af3c8 + 1fd38c71. Product source, examples, resources, runtime configuration and Composer identity are unchanged. Exact owned branch cleanup is complete: remote transport is empty, GitHub returns 404 and the local branch is deleted; the accepted detached checkout is retained.

PR qualification is 42 terminal checks: 41 success + one intended skip, with zero open PR Sonar findings. Resulting-main CI, main Sonar/CodeQL and automatic portal preview passed. Automatic deployment was skipped. The combined commit inventory, including the separate build-only run below, is 44 terminal: 41 success + three intended skips. This does not claim the whole project's historical Sonar backlog is empty.

The stable build-only run 42133527775 is SUCCESS, build job 127616202486 at 2026-11-06 00:00:44–00:04:18Z, with deployment SKIPPED. It passed the 393-page contract/link checks, analytics, full browser checks and final artifact binding. Its downloaded/hash-verified artifacts are:

• Pages artifact 13464273399, SHA256 4a5b8cebea8dbb6e8875e5040ba12ddcf5559ed8115448cc87f7ad27ffdca659.
• Twelve visual screenshots 13464193512, SHA256 3517ef1b887b860948e489c4fd7383ed600b59af855089718b42df3e5bb2868e.

The extracted v2 audit exactly binds published SDK 3.9.4 / raw tag source 11085f0c624674a4b70d3a6fb3e83eaff3869fcb, unchanged-product SDK/docs source 6a821568db5c72983bd3990fe27c7990f092db12, presentation a4315bcdf62b4a8466c25bd007a9a9d6b06d1f45 and workflow a53bc7c010e92f419feaacaa6fb03545962dadec. The candidate has all 376 published API paths, the 3.9 badge/install constraint and no 3.10 onboarding. Original logo SHA256 and canonical shared status blob 2659eae6 are exact. The local fidelity comparison separately confirms identical normalized API content text, content anchor IDs and links across all 376 pages.

Rendering/source acceptance only. This artifact was built through the existing setup/browser path and cannot be promoted as publishing acceptance. CLI still owns the accepted central setup/shared-browser interface and exact caller qualification; sdk-php owns narrow adoption, fresh qualification and a new protected build/deployment handoff afterward. #318 remains draft/NONPASS on that concrete dependency. Both earlier failed stable runs are retained. No tag, package release, installed/native/runtime result or deployment was selected.

Live readback remains the previous v1 audit on 6a821568, SHA256 43c0159fc3ee9317a32e644e20d61d47d2fbf64d23194efe7b8e1f2b86514cd1; #315 remains open for actual publication and live acceptance.