[rmcdaniel]

Backport the #326 delayed-response correction from main PR #338 / c87eae373325d0a5bc8529058984becf17c82793 onto maintenance 9f1487e9d8cd8bbb663856b7687081d227df3f67. A reused helper must charge the original activity poll transit before skipping confirmation, so an expired response cannot dispatch another callback. Slow, unknown and short grants retain confirmation; healthy reuse and first-client proof remain covered.

This is the exact 10-file source/test delta, including the immutable official-worker fixture. It introduces no combined 3.10 / Workflow2.21 / native3.2 contract, public API, dependency, capability, support declaration or workflow change. The source classes and regression bytes are compared to accepted main; the maintenance Worker and runner retain their existing source around those changes.

Main PR338 has 41 successful checks / one intended skip, 8,288 PHP8.4 tests / 85,495 assertions, zero main-targeted Sonar findings and finite Security Source/custody PASS. Maintenance-specific qualification passes 94 tests / 340 assertions and PHPStan; its unchanged-policy corpus proves 62→63 actual official-worker base-fail/candidate-pass. All 35 current-head reported PR checks are terminal: 34 successes and one intended skip. PHP8.4 passes 3,792 tests / 19,885 assertions with 56 optional skips, and every PHP8.1–8.3 / Carbon2 / framework cell passes. The reported Sonar result retains the separate base=main limitation below.

Finite Security source/custody review of this exact backport also passes at 6696521338, including identical complete patch ID versus accepted main. This remains draft while the maintenance quality decision is unresolved. PR335's observed green Sonar used base=main despite target=3.9.x; its actual merged non-main scan failed403. A similar provider result here must retain that scope and cannot qualify maintenance. General owns account/configuration disposition; no reroute, gate, plan, credential or private-project change is proposed.

After applicable source acceptance, refresh held release PR #337 onto the corrected maintenance source and follow normal publication/installed-artifact gates. #326/#327 remain open; no tag, registry publication or installed-Server acceptance is included.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Exact maintenance candidate 78f25360049071bafe1dc8e521a75b48fff4ec29, tree 7f2e3fa09d9b623c307415a9a29a56ed4fd0b601, passes 94 activity/helper and authority tests / 340 assertions, PHPStan, public boundary, whitespace and secret/private-path review. Against actual maintenance base 9f1487e9d8cd8bbb663856b7687081d227df3f67, the unchanged corpus policy proves 62→63 fixtures, actual official-worker base fail / candidate pass. All changed helper/authority classes and new regression bytes equal accepted main c87eae3. No combined-minor contracts or guards were changed.

The provider's PR339 row already binds this SHA and target 3.9.x but reports analysis base main, gate OK / zero findings. This observed result has that exact scope; it is not maintenance quality acceptance. The existing merged non-main NONPASS/403 remains unresolved. General owns the legitimate quality route and final qualified release execution; this PR and release337 remain draft/held pending that disposition and remaining ordinary checks.

For the local run record: the first assembly command targeted the already-fixed topic worktree and was empty; it was aborted before the correct maintenance cherry-pick. The first container start could not create a missing writable build mount beneath the read-only source mount; creating the ignored mountpoint corrected the harness before any test ran. Neither is product or installed evidence. The passing bounded container has been removed. Security has the exact finite source/custody review request for this backport.

[rmcdaniel]

Current-head PR checks are terminal at 78f25360049071bafe1dc8e521a75b48fff4ec29, tree 7f2e3fa09d9b623c307415a9a29a56ed4fd0b601: 34 reported successes / one intended skip. Ordinary maintenance CI passes every PHP8.1–8.4 / Carbon2 / framework cell, static analysis, package/dependency checks, docs compatibility and target-branch qualification. PHP8.4 reports 3,792 tests / 19,885 assertions / 56 optional skips. Its unchanged-policy corpus verifies 62→63, actual official-worker base-fail/candidate-pass.

The reported successes include the observed Sonar result, whose provider record binds this exact head but uses analysis base main / target3.9.x, not a maintenance baseline. The existing actual merged maintenance NONPASS/403 remains open; this terminal PR aggregate does not cure it. General owns the legitimate quality route and final qualified release execution. Finite Security backport source/custody review has been requested and is still pending. This PR remains draft and release337 remains held; no merge, tag, package publication, deployment or installed acceptance is claimed.

Main338 is independently complete at c87eae3 with exact reviewed tree47ac, 40 successful automatic-main checks / two intended skips, source-bound preview and unchanged live docs. Its topic branch/worktree were removed and remote absence verified. Active339/337 and operator WIP refs are preserved; local test containers are absent. After the applicable quality/source disposition, sdk-php owns refreshing release337 onto the corrected maintenance tree. General executes the release; sdk-php then verifies exact registry/source/dist/package identity and the published consumer evidence before closing #326/#327.

[rmcdaniel]

Security source/custody review — exact 3.9.x backport

PASS for exact head 78f25360049071bafe1dc8e521a75b48fff4ec29, tree 7f2e3fa09d9b623c307415a9a29a56ed4fd0b601, on maintenance base 9f1487e9d8cd8bbb663856b7687081d227df3f67. This is source acceptance only. It is not maintenance quality acceptance, release selection, publication, or installed-artifact acceptance.

I independently compared the complete ten-file first-parent delta with accepted main merge c87eae373325d0a5bc8529058984becf17c82793. Both produce the same stable patch ID, dd8941094760986bbb9cf076f80a75ffc380012d. Seven changed helper/test/fixture blobs are byte-identical to accepted main. The maintenance Worker, corpus runner, and replay-support whole files correctly differ because 3.9.x lacks later main-only source, but their added/changed hunks and line counts are the same. There is no workflow, dependency, public API, protocol-version, capability, or support-matrix delta.

The authority path remains conservative:

• the Worker records the monotonic start immediately before each activity poll and carries it only into that delivered activity's helper start;
• capturePollGrant accepts an original poll timestamp only when it is numeric, finite, nonnegative, not later than receipt, and under one second old. It reconstructs lease, business, heartbeat, session, and fixed bounds from that original instant and grants the shortcut only with at least three seconds still remaining;
• unknown, malformed, slow, expired, or short deliveries retain receipt-time parsing but set fresh_poll_grant=false;
• the reusable maintainer skips confirmation only when both the existing proof and that explicit fresh-grant bit are true. Every other case performs the existing identity/session/deadline-bound lease renewal before application callback dispatch. Existing finish acknowledgement, helper replacement, parent/fork guards, publication checks, and shutdown behavior are unchanged.

The regression exercises a real loopback-delivery delay through the public Worker and binds the loaded SDK source. The expired second activity produces no second callback or completion; the short remaining grant requires confirmation. The shared corpus fixture is present in both repository and standalone consumers. The retained maintenance qualification reports 94 focused tests / 340 assertions plus PHPStan and an unchanged-policy corpus increase 62→63 with actual maintenance base failure and candidate success. GitHub now shows 35 terminal checks: 34 success and the one intended cooperative-cancellation skip, including regression corpus, PHP 8.1–8.4, supported framework matrices, analysis, package smoke, public boundary, policy preflight, and the aggregate target-branch qualification.

The Sonar result is not maintenance quality evidence: its PR row reports analysis base main despite target 3.9.x, and it reports 0.0% new-code coverage. The prior non-main 403 remains unresolved. Keep this PR draft/held for General's supported maintenance-quality disposition, then rebind release PR #337 and complete the normal published-package and installed-artifact gates. I found no source or custody finding in this exact backport.

[rmcdaniel]

Operator decision: Sonar's 3.9.x analysis does not block this backport. See #337 for the release order. Mark ready and merge.

[rmcdaniel]

Maintenance integration and ordinary qualification are complete: General normally merged #339 as 063e5af, exact reviewed tree 7f2e3fa09d9b623c307415a9a29a56ed4fd0b601, ordered parents9f1487e9 +78f25360. Actual maintenance CI and boundary checks passed. The maintenance Sonar failure remains attributed; the operator explicitly made it nonrequired under green CI plus Security Source evidence, with nonblocking #342 owning follow-up.

The refreshed release #337 qualification and exact release Security review both pass. General retains actual merge/publication; sdk-php owns installed verification.

I verified both owned merged topic heads are ancestors of063e, removed their clean temporary worktrees and owned ignored public vendor copies, deleted the remote/local #335 and #339 topic branches, and verified every exact path/ref absent. The local safe-delete command initially declined because the current branch is main; explicit ancestry to the actual maintenance merge was checked again before deleting only those owned merged local refs. Active release337, draft340 and all unrelated operator/previous-session WIP refs/worktrees remain untouched. No source container or runtime was launched for this follow-up.