From ba94a9cbe72ea8aeb7b1cf610eb5976add64b279 Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Fri, 6 Nov 2026 21:03:41 +0000
Subject: [PATCH 1/2] Prepare SDK 3.9.5 lease maintenance patch release

---
 CHANGELOG.md                  | 16 ++++++++++++++++
 composer.json                 |  2 +-
 docs/quickstart-contract.json |  4 ++--
 3 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8b2b4937..885e67fe 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,22 @@ project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [3.9.5] - 2026-11-06
+
+### Fixed
+
+- Reuse a Worker's activity lease helper across sequential activities after a
+  confirmed finish, instead of starting a process and rebuilding its Client for
+  each callback (#326). Every claim retains its own lease, business deadline and
+  heartbeat authority. Dead or unconfirmed helpers are replaced, forked callbacks
+  cannot use their parent's helper, and shutdown closes the idle process.
+- Skip the initial workflow-task renewal for a fresh, fully fenced poll grant
+  with a valid Server clock and sufficient remaining lease (#327). Request time,
+  payload loading and history paging consume that margin. Servers without a
+  qualifying clock and stale or short grants retain the existing renewal path.
+- Update the optional Laravel HTTP example's Symfony HTTP Client, HttpFoundation,
+  HttpKernel, Routing and YAML lock entries to their accepted security patches.
+
 ## [3.9.4] - 2026-11-04
 
 ### Fixed
diff --git a/composer.json b/composer.json
index 9d56b838..8c6e07fb 100644
--- a/composer.json
+++ b/composer.json
@@ -94,7 +94,7 @@
             }
         },
         "durable-workflow": {
-            "product-train": "3.9.4",
+            "product-train": "3.9.5",
             "supported-server-versions": "2.5.0",
             "supported-server-release-baselines": {
                 "2": "2.5.0",
diff --git a/docs/quickstart-contract.json b/docs/quickstart-contract.json
index 8e1fa7a5..50f39f59 100644
--- a/docs/quickstart-contract.json
+++ b/docs/quickstart-contract.json
@@ -3,8 +3,8 @@
   "schema_version": 2,
   "package": {
     "name": "durable-workflow/sdk",
-    "published_version": "3.9.4",
-    "composer_requirement": "3.9.4",
+    "published_version": "3.9.5",
+    "composer_requirement": "3.9.5",
     "onboarding_requirement": "^3.9"
   },
   "runtime_targets": {

From dbeae40fc931e2bab926fa6dcaef0a9873e01890 Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Sat, 7 Nov 2026 00:20:49 +0000
Subject: [PATCH 2/2] Date 3.9.5 release and document conservative activity
 grant timing

---
 CHANGELOG.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 885e67fe..4c0a9ef7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,7 +6,7 @@ project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
-## [3.9.5] - 2026-11-06
+## [3.9.5] - 2026-11-07
 
 ### Fixed
 
@@ -15,6 +15,8 @@ project follows [Semantic Versioning](https://semver.org/).
   each callback (#326). Every claim retains its own lease, business deadline and
   heartbeat authority. Dead or unconfirmed helpers are replaced, forked callbacks
   cannot use their parent's helper, and shutdown closes the idle process.
+  Poll transit consumes the fresh activity grant's margin; slow, unknown or short
+  grants require confirmation before another callback starts.
 - Skip the initial workflow-task renewal for a fresh, fully fenced poll grant
   with a valid Server clock and sufficient remaining lease (#327). Request time,
   payload loading and history paging consume that margin. Servers without a