[rmcdaniel]

Activity workers start a fresh lease helper for every callback, and workflow workers renew even a task just leased by the Server. Backport the accepted #333/#334 internals onto published 3.9.4 so this correction can qualify independently of the combined 3.10 feature cohort.

Each Worker owns and reuses its helper only after a matching, drained finish acknowledgment. Every activity rebuilds its authority; helper death, uncertain finish, forked callbacks and shutdown preserve fencing and cleanup. A workflow poll skips its initial renewal only with the exact original fence, a valid Server clock, a response under one second old and at least ten seconds remaining after request/loading time. Missing or stale clocks retain renewal. The positive optimization still requires a published Server carrying #1070's additive clock.

Production changes are confined to Worker and its private helper/grant classes. Root dependencies, public APIs, framework support, Client, Replayer, capability declarations and protocol versions remain at 3.9.4. The inherited example-lock audit failed on known Symfony advisories, so the example lock also takes the already-accepted five Symfony 7.4.21 to 7.4.23 patch updates from 8ea13dc; package names, requirements and content hash are unchanged. All stable corpus guards remain, with the grant guards and one worker fixture added. CI and Sonar gain only the 3.9.x branch routing needed to qualify the merged maintenance source; documentation and manual publisher triggers are unchanged. The maintenance base was selected in #326, comment 6694918746.

Validation on PHP 8.4.27:

• Focused helper/grant/fallback/fencing controls: 65 tests, 349 assertions.
• Full stable-source suite: 3,790 tests, 19,875 assertions, 56 optional skips.
• PHPStan, Composer validation, whitespace and public-boundary checks pass.
• Same-consumer unchanged-3.9.4 controls fail on three helper PIDs versus one and on the extra workflow renewal. Candidate passes both.
• Official corpus policy passes with 61 to 62 replay fixtures and the immutable-base worker fail/candidate pass. No guard was weakened.

Refs #326 and #327. Both stay open for their actual published-package/Server acceptance. This PR selects no tag, version, installed tuple or publisher run, and leaves #293's combined-minor gates intact.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Reviewed exact maintenance head b389182db2b1878a78306a9935fb88a8fe7da6c5, tree 7438c819b9361311d1220841f2d249e9059c7c43, over selected published base 11085f0c624674a4b70d3a6fb3e83eaff3869fcb.

The helper and grant classes match their accepted main implementations byte-for-byte. Worker integration retains the stable Client/Replayer/public API/support graph, original claim and completion fences, first-helper proof and later fresh-grant bounds. All stable guards are retained; the new official worker fixture proves the actual old extra renewal, rather than a test-only implementation model. CI/Sonar routing adds only the selected maintenance branch; no manual publisher/docs trigger changes. The example lock is exactly the already accepted 8ea13dc correction: five Symfony patch entries, unchanged package set/requirements/content hash and root Composer graph.

Final source qualification is terminal: 34 successes and one intended connected-test skip, including Target branch qualification, the normal PHP8.1–8.4/Carbon2/framework/transition/docs/package checks and SonarCloud. Direct Sonar is gate OK with zero unresolved findings. The original f250aae example-lock advisory failure remains attributed; b389182 fixes its cause without any audit exclusion, guard waiver or rerun.

This satisfies the selected maintenance SOURCE cut. Actual merged-branch checks and cleanup follow normal integration. #326/#327 remain open for published-package/Server acceptance; no tag, version, installed tuple or publisher invocation is selected. The combined #293 and held #219/#267 boundaries remain unchanged.

[rmcdaniel]

Actual maintenance acceptance is incomplete after normal merge 9f1487e9d8cd8bbb663856b7687081d227df3f67 (reviewed tree 7438c819, ordered parents 11085f0c and b389182).

The first maintenance Sonar run uploads its report for that exact commit, then fails with the provider response: Organization is not allowed to access data from non main branches. A direct quality-gate API read for branch 3.9.x returns HTTP403. The 335 PR gate remains independently OK with zero unresolved findings; it is not represented as a passing post-merge branch gate. No source defect or upstream compromise is inferred from this account/access restriction.

I immediately escalated this infrastructure gap to General. General/account owners must return an authorized supported analysis route or account/configuration disposition. sdk-php owns the resulting source correction and actual branch verification. No paid resource/account change, credential read/change, branch-as-main substitution, disabled wait, gate waiver or rerun was performed. Ordinary maintenance CI is still running and remains my ownership. No tag, published-package result or release follows this partial acceptance.

[rmcdaniel]

The merged maintenance commit is exactly 9f1487e9d8cd8bbb663856b7687081d227df3f67, with reviewed tree 7438c819b9361311d1220841f2d249e9059c7c43 and ordered parents [11085f0c624674a4b70d3a6fb3e83eaff3869fcb, b389182db2b1878a78306a9935fb88a8fe7da6c5]. Git and GitHub agree, and its tree is byte-identical to the reviewed head.

Actual maintenance CI42291035933 and Public Boundary42291035904 are terminal success. The original ordinary jobs retain all tests, framework/platform checks, corpus policy, example audit and target qualification. The docs/manual publisher paths are unchanged and no Pages publisher ran for the maintenance branch.

The separately escalated Sonar branch-access failure remains a real external qualification gap. PR335 is independently green at its exact reviewed tree, but actual maintenance qualification is not represented as all-pass. General/account owners owe an authorized supported analysis route or disposition; sdk-php owns the resulting correction and verification. No disabled gate, paid/account/credential change or retry was made. The owned head/worktree are retained for this active follow-up; all source containers are removed. Package version, tag, installed tuple and publication remain unselected, with #326/#327 open.

[rmcdaniel]

Provider-documented disposition for the external branch-analysis gap:

• SonarQube Cloud branch analysis limits the ordinary Free plan to its main branch. A push to a maintained release branch is the documented branch-analysis use case, so treating 3.9.x as a short-lived name does not resolve the entitlement.
• The provider also documents a no-cost OSS plan with unlimited public-repository branch/PR analysis and no private projects. See Subscription plans, OSS section. Organization eligibility, current configuration and any plan transition require the account owner's disposition; this is a supported option to assess, not an account change or a promise that this organization qualifies.
• PR analysis reports new issues in the change; it does not replace whole-branch qualification. The observed passing PR335 analysis binds reviewed head b389182/tree 7438c819. Actual merge 9f1487e9 has that exact same tree and the expected ordered parents. This preserves the precise source-delta evidence while leaving the actual branch NONPASS/403 visible.

I found no provider-documented, unchanged-account route that yields an accepted whole-maintenance-branch gate under the observed restriction. General owns the account/configuration decision. No project/plan/credential/main-label change, alternate analysis, retry, fee or gate waiver has been selected. Actual maintenance CI/Public Boundary passed; the existing Sonar failure remains the open post-merge qualification gap.

[rmcdaniel]

Correction to the scope of the observed green PR335 Sonar result after inspecting the scanner and provider metadata:

• Final PR scanner log requests PR335 into 3.9.x, computes Git merge base 11085f0c624674a4b70d3a6fb3e83eaff3869fcb, records revision b389182db2b1878a78306a9935fb88a8fe7da6c5, and receives a PASSED response.
• The provider's current api/project_pull_requests/list metadata for key335 binds the same commit and target 3.9.x, but its analysis base is main, not 3.9.x. The component metadata reports the matching 2026-11-06T20:39:40+0000 analysis. PR336 separately shows both base and target as main.
• Therefore the green check/zero findings are preserved as an observed provider result with a main analysis baseline. I withdraw the earlier interpretation that it independently qualifies the maintenance change against 3.9.x. Matching the head/merge tree proves source identity, not the missing analysis-baseline authority.

Actual merge 9f1487e9 still has exact reviewed tree 7438c819 and the expected ordered parents. Ordinary maintenance CI and Public Boundary passed; merged non-main Sonar remains NONPASS/403. The official Free-plan PR/main restriction and this actual metadata agree that maintenance Sonar acceptance is still missing.

I immediately returned this precise base/target distinction to General, who owns the account/configuration disposition. No branch/project/provider reroute, main-label/account/plan/credential change, private-project change, fee, retry, release or gate waiver is selected. #326/#327 remain open through real qualification and published delivery.

[rmcdaniel]

Merged maintenance source and follow-through are recorded in #339, including actual green maintenance CI, the operator-selected CI plus Security quality contract, preserved Sonar NONPASS attribution and nonblocking #342. I removed only the clean owned #335/#339 topic worktrees and remote/local branches after verifying both heads are ancestors of063e5af6; all exact refs/paths are absent. The active release #337 has refreshed green checks and exact Security Source PASS. General owns publication; sdk-php owns the normal-registry installed verification. No published-artifact result is claimed by this cleanup.