[rmcdaniel]

A reused activity helper could treat a slow poll response as a new grant because its age started at receipt. A response delivered after lease expiry could therefore dispatch an application callback. This follow-up to #326 records the original activity poll start and charges the entire transit before allowing the fresh-grant shortcut.

ActivityLeaseAuthority captures conservative original bounds for a qualifying fast grant. Slow, unknown or short grants retain confirmation, and the helper requires an explicit freshness decision. The first helper still proves its client; healthy reuse retains one renewal across three activities. No public API, capability, dependency, protocol or Server implementation changes.

The regression runs the public Worker over inert loopback HTTP, covering an expired response and transit consuming the three-second safety margin. Its immutable official corpus fixture observes the actual callback count and retained completion RPC. Both parent and helper explicitly load the selected SDK source so the base comparison cannot use a cached candidate helper.

Validation: 94 focused activity/helper and authority tests with 340 assertions, PHPStan, public boundary and whitespace/secret review pass. The unchanged-policy corpus grows 75→76 and verifies actual base failure / candidate success; the separate base invocation fails specifically on callback count. Current-head ordinary corpus CI and main-targeted Sonar pass with base=target main, matching revision and zero findings. All 42 current-head checks are terminal: 41 successes and one intended skip. PHP 8.4 passes 8,288 tests / 85,495 assertions with 56 optional skips; PHP 8.1–8.3 and Carbon 2 cells also pass.

After main acceptance, sdk-php will backport the exact correction to 3.9.x before release PR #337 moves. The maintenance Sonar access/baseline restriction remains General-owned. #326 stays open until published-package acceptance; no tag, package publication, account or gate change is included.

[rmcdaniel]

The unchanged corpus policy passes against exact main base 9e7d89201fcdd2eddf11291bd74ba8c7e8727874 and candidate 878e0101285379a9978cc5316ecd35749dcf6b22: replay corpus 75→76, actual official-worker base fail / candidate pass, with all existing immutable fixtures retained. The selected-SDK bootstrap validates both parent and helper source identity.

A direct unchanged-base run independently fails on php-activity-poll-transit-consumes-grant.expected.activity_callback_count, rather than an autoload/process/environment error. The candidate official fixture passes. Focused source tests pass 27 tests / 215 assertions and PHPStan is clean. The initial new fixture used decode on an envelope; that test-harness type error was corrected to decodeEnvelope before these passing runs and is not product evidence.

The fix requires original poll timing for the shortcut, charges the full transit against all original bounds, and confirms unknown, slow or short grants. Existing fast reuse, fork, shutdown, attempt/deadline and old-Server controls remain in the normal suite. Current main PR CI is running; maintenance backport and draft release #337 remain held until source acceptance. No package has been published.

[rmcdaniel]

The first main-targeted Sonar analysis correctly failed php:S1448: adding grant capture made ActivityLeaseProcess exceed the existing method limit. The calculation now belongs to ActivityLeaseAuthority, which already owns all grant bounds; no threshold or gate was changed. The resulting activity/helper and authority controls pass 94 tests / 340 assertions and PHPStan. Normal current-head checks are rerunning on the incremental commit. Earlier corpus proof remains explicitly bound to 878e010; current-head corpus qualification is required again.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Source review and current-head qualification complete at 967c5670daf900792ef96bc46d41fd9d6d5f21e8, tree 47ac7e264b5219a7231b10fe4224f3a9c33f4692, against main 9e7d89201fcdd2eddf11291bd74ba8c7e8727874.

The 10-file change preserves ordinary confirmation for slow/unknown/short activity grants, first-client proof, normal renewal scheduling, attempt/deadline fencing, helper replacement and fork/shutdown behavior. Only a proven helper with original poll timing and sufficient conservative bounds can skip confirmation. The test transport, parent and helper are local and explicitly source-bound; no external Server is used.

All 42 current-head checks are terminal: 41 successes / one intended cooperative-qualification skip. CI passes every supported PHP/framework cell, static analysis, package/dependency checks, docs compatibility, unchanged corpus and target-branch qualification. PHP8.4 reports 8,288 tests / 85,495 assertions / 56 optional skips. The corpus proves 75→76, actual worker base-fail/candidate-pass. Sonar's final provider record is matching SHA with base=target main, gate OK and zero bugs/vulnerabilities/smells, superseding the retained first-head method-count failure.

Whitespace, public boundary and secret/private-path review pass. Normal merge is the next source action, followed by the exact maintenance backport. #326 and release337 remain open/held for that backport and independent publication/maintenance-quality gates; this does not claim installed or release acceptance.

[rmcdaniel]

Security finite source/custody review — PASS for exact head 967c5670daf900792ef96bc46d41fd9d6d5f21e8, tree 47ac7e264b5219a7231b10fe4224f3a9c33f4692, against main 9e7d89201fcdd2eddf11291bd74ba8c7e8727874.

The correction closes the confirmed delayed-grant authorization path without widening helper authority:

• Worker::observePoll captures the activity poll monotonic start before transport and passes it only with the resulting leased task; the next activity poll overwrites stale state and the consumed task clears it.
• ActivityLeaseAuthority::capturePollGrant marks a grant fresh only when the captured start is numeric and finite, 0 <= started <= received, total poll transit is below one second, and authority reconstructed at that original start still has at least three seconds remaining.
• Every unknown, slow, expired, or short case retains fresh_poll_grant=false. ActivityLeaseMaintainer::maintainInitialGrant therefore performs the existing identity/session/deadline-bound renewal and acknowledgement before responding to the parent; no application callback is authorized from receipt-time alone.
• The reusable-helper, first-client proof, owner/queue/attempt/session identity, fixed business/heartbeat bounds, fork/shutdown, terminal publication, and renewal error classification remain unchanged. No public API, capability, protocol, dependency, Server, credential, or release effect is added.

The official regression path is meaningful rather than fixture-only: it exercises the public Worker and isolated local helper over loopback, binds both parent and helper to the selected SDK source, and retains completion RPC evidence. Current-head CI 42297246153 is terminal with 41 successes and one intended cooperative-cancellation skip. The unchanged corpus reports replay 75→76 with actual worker base fail / candidate pass; target-branch qualification, PHP 8.1–8.4, framework cells, PHPStan, package/docs compatibility, central policy, public-boundary, CodeQL, and final matching-SHA Sonar gate all pass. The earlier method-count Sonar failure remains correctly attributed to the predecessor and no threshold was changed.

Disposition is Source PASS only. Normal merge/main acceptance, exact 3.9.x backport, maintenance-quality/Sonar resolution, published-package identity, and release PR 337 remain separate required gates. This review does not authorize a tag, package publication, deployment, or installed/release acceptance. No unresolved finite source finding.

[rmcdaniel]

Actual main qualification is terminal at merge c87eae373325d0a5bc8529058984becf17c82793: 40 successful checks / two intended skips, exact tree 47ac7e264b5219a7231b10fe4224f3a9c33f4692 from reviewed head 967c5670daf900792ef96bc46d41fd9d6d5f21e8, with ordered parents main9e7d892 + reviewed967c567. CI, Sonar, CodeQL, boundary and portal preview all pass. Finite Security Source/custody PASS is retained at 6696289023.

Preview artifact 13542877462 has SHA-256 e87e29eea00fdc2f914dd4112ddf7fad771530ff7d3f034f2b3e9136eeebfbe1. Its bounded ZIP/TAR checks pass: 14,090,240 tar bytes, 455 regular files, no path traversal or special/link members. All four deployment-audit revisions bind c87eae3. Live docs remain at source6a821568 (audit SHA-256 43c0159fc3ee9317a32e644e20d61d47d2fbf64d23194efe7b8e1f2b86514cd1); deploy remains skipped.

Exact maintenance follow-up #339 is draft at78f25360, with local94 tests340 assertions, PHPStan and unchanged-policy62→63 worker base-fail/candidate-pass. Ordinary maintenance PR checks are running. The observed provider base=main / target3.9.x remains outside maintenance quality acceptance. General owns that route and qualified release337 execution; no publication, deployment or installed acceptance is claimed. The merged338 topic branch/worktree are no longer needed and are being removed; the active339 and337 branches are retained.