[rmcdaniel]

Worker polls can be cut by idle proxies before the requested wait ends. Negotiate the Server progress transport on the default bounded cURL path, validate its terminal envelope, and preserve status, refusal details and retry headers before existing error/retry handling. Legacy JSON remains supported.

Progress cannot extend the complete request deadline. Ordinary polls preserve a shorter injected Guzzle timeout; opaque PSR-18 clients retain ordinary JSON and their own policies. Per-attempt worker warnings identify early connection/gateway cutoffs with observed duration, configured wait and timeout remediation. Retries keep the same poll identity.

Prepares patch 3.5.1, including matching package/quickstart metadata and worker guidance. Refs durable-workflow/server#526 and the merged transport component durable-workflow/server#755. Authoritative task-delivery recovery and fixed published-image qualification remain open in #526.

Validation:

• PHP 8.3.36 / Guzzle 8.3: full suite 2,830 tests / 14,734 assertions, zero errors/failures; 56 existing fixture-dependent integration tests skipped. The 29 new transport cases have no skips.
• PHPStan clean; strict Composer validation, production dependency boundary, five documentation examples, and fresh path-consumer registration identity passed. Production consumer audit reports no advisories.
• Real Apache/MySQL/Redis through a three-second nginx idle timeout: all four poll routes complete in 4.039–4.058 seconds; early 422 preserved. Forced legacy JSON produces a real 504 and cutoff warning at 3.004 observed seconds / 4 configured seconds. All fixture resources removed.
• On the unchanged parent, 10 behavioral regressions fail with zero errors; the real continuously-progressing TCP deadline control still passes.

[rmcdaniel]

The first CI cycle for 5db27a4 is retained: only the docs job and its aggregate failed; PHP 8.1–8.4, framework compatibility, static analysis, package smoke, regression corpus and CodeQL passed. The failing step was the unchanged moderate npm-audit gate reporting fast-uri 3.1.8.

Corrected head 2d6d34f locks the documentation-only transitive parser to upstream security release 3.1.9. Local npm audit now reports 0 vulnerabilities; all five documentation examples pass. The gate threshold and runtime dependency requirements are unchanged.

The same commit extracts the poll timeout policy helper to address the actual Sonar complexity finding. All 61 affected transport/connection/deadline cases pass (268 assertions, zero errors/failures/skips); PHPStan is clean. The old public TransportException::fromResponse(..., $rawBody) argument remains for positional/named-call compatibility. Its existing unused-argument debt is individually accepted in Sonar issue AaFxW4imXMYMJHNhOHuK with a compatibility explanation; it is not classified as used or globally suppressed.

The corrected head was pushed once after the first cycle became terminal. Patch 3.5.1 remains prepared, not published.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
1 Accepted issue

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

PR #218 merged normally at exact accepted head 2d6d34f after 41 successful checks and one intended connected-fixture skip. Merge 06ab2e4 has parents 61fdd37 + accepted head, tree c569571c4d87eafc953b5a2b4e1ed1ed07d241ce identical to the tested head. Remote feature branch is deleted and independently 404; local source remains for installed acceptance.

New immutable 3.5.1 release points to that merge and is already available from Packagist, whose source/dist references both equal 06ab2e4. The normal webhook/registry path was used. Independent main workflows and fresh registry-installed/source-free published qualification are running; this receipt is publication evidence, not their completion claim. The first failing npm-audit cycle and its correction remain recorded above.

Full Server #526 authority recovery, remaining SDK parity and fixed published-image/proxy/restart/replacement acceptance remain open. No Server image is published by this SDK release.

[rmcdaniel]

Published PHP SDK 3.5.1 installed acceptance is complete for this transport component.

• New immutable tag/release and both Packagist source/dist references point to 06ab2e4. All 191 installed SDK source files match that commit by Git blob hash; package and quickstart release identities agree.
• A fresh registry-only Composer consumer passed 61 transport/connection/deadline cases / 268 assertions, zero failures/errors/skips. The loaded implementation was inside the installed package; no SDK source fallback or overlay was configured.
• Normal published service-mode run 40163696217 passed actual class-oriented workflow completion and PHP 3 instance-lifetime checks using the registry package and published Server 2.5.0, immutable image durableworkflow/server@sha256:66bd0e510c033af611cc1e2191e1ed592acf26e80f89766b0a3e1a0e463ccd19. Optional cooperative-image discovery was intentionally not selected.
• With unmodified published Server 2.11.1 (durableworkflow/server@sha256:bf8bed13f5f809ee3425233180a581353eac4683adbee5c4ecbf63bb18bbd102), all four legacy poll kinds completed normally in 4.076–4.150 seconds through the longer proxy. A three-second proxy produced the real 504 cutoff observation at 3.004 seconds / 4 configured; early 422 was preserved.
• The same installed SDK against the qualified PHP Server candidate 582a6369 and normal Core 2.13.1 completed all four negotiated-progress polls through a three-second idle proxy in 4.050–4.122 seconds, preserving early 422. This candidate reports prepared Server 2.11.3; it is source qualification, not a published fixed Server image.
• All five independent main workflows succeeded: CI40163557493, CodeQL40163557500, Sonar40163557481, portal40163557484 and boundary40163557502. The tag boundary40163614777 also passed. The public worker guidance returns 200 and includes the cutoff/deadline instructions. Main Sonar gate is OK with zero new unresolved findings since this PR; existing repository debt is not claimed clean.

All local qualification services, bootstrap/one-off containers, networks, volumes and wait-lock directories are gone. Small fixed vectors and reports remain only for active Server #526 acceptance.

Consumer review: CLI has no PHP SDK runtime dependency. Waterline pins 3.4.1 for development/service observation and has no worker-poll call sites, so this worker-only change needs no Waterline release. Sample App accepts ^3.1 but still locks/pins 3.1.0 in its qualified tuple; its worker tuple/lock refresh remains required follow-through in Server #526 after the complete new tuple is qualified. The SDK-owned examples and deployed guidance identify 3.5.1. No pinned consumer is assumed updated by this tag.

This delivers the PHP SDK component. Full Server #526 task-delivery authority recovery, remaining SDK parity and fixed published-image/proxy/restart/worker-replacement acceptance remain open.