[rmcdaniel]

Embedded continue-as-new and unrelated signal admission can deadlock under MySQL REPEATABLE READ. Adopt @Loosand's correction from #1044, preserving contributor commit 23c8fde91318df4327e62008f08c5e268d8c0166 and the four runtime file blobs unchanged.

Current head is 0ae6ab2ea98ed6c1ea05764b1e854f1e79f307c4 / tree ba7907d5aba57645ad544d8e729f784e719cce07, over accepted main 98bd9868. It retains the qualified composite 31aa05e as an ancestor, including #1040's schema/cache repair and #1041's measured PostgreSQL weights. Maintainer follow-up adds two pending-signal handoff controls, nested-scope restoration coverage, an OpenTelemetry flag compatibility correction and the proposed 2.20.4 product train. The complete delta is fourteen files. No workflow, dependency constraint or product tracing change is included.

The new scope uses consistent candidate reads followed by exact primary-key locking only inside the owned root MySQL task transaction. Caller-owned older read views, direct terminal recording and other drivers keep their existing locking behavior. Connection/PDO/run binding and finally cleanup prevent scope escape. No automatic replay of user workflow code is added.

Validation and attribution:

• Independent baseline reproduction: all four controlled races fail on unchanged main; the candidate passes races and scope/integrity cases.
• Original complete source QA, 42018654305/1 at 31aa05e: full quality, unit, MySQL/PostgreSQL shards, configured MariaDB profile and Laravel upgrades pass. Combined coverage 93.87% passes the 93.08% ratchet. Its actual graphs, skips and artifact branch-label discrepancy remain explicit.
• Targeted MariaDB-through-mysql result, independently verified: 12 tests / 92 assertions / zero skips, failures or errors. The separate explicit mariadb driver path is not qualified by it.
• Focused successor proof, independently carried, at 483a8615: changed-file ECS/Stan and 22 tests / 221 assertions / zero skips, errors or failures. PCOV actually hits handoff lines 59–61 twice and scope line 46 once; the committed 2.20.4 package contract passes. The initial formatter-only nonpass is retained separately.
• General explicitly reconciled the earlier non-required Codecov patch failure against that real focused evidence. The red status remains a failure at its original head. No coverage suppression, threshold change or general waiver is made.
• The original ordinary PR tracing red is dependency drift: OpenTelemetry API 1.11 / SDK 1.16 correctly emits sampled+random 03. The successor records actual producer flags and checks exact version/trace/span/flag propagation, with 01/03 normalization controls. Fresh ordinary source/Sonar/tracing checks qualify this current head; they are not another full dispatch.

The original fork PR cannot supply the required Sonar context because the scanner intentionally skips forks. This maintainer-owned adoption preserves that guard and repository protection. It keeps the original contributor and QA history and avoids three separate full-main runs.

Addresses #1043. Keep that issue open until the fix is published and the installed package and affected consumer paths are verified. The published-package proof plan reuses existing release-verification and the reviewed races against actual installed classes. Preparing the 2.20.4 metadata does not select a tag, release, consumer bump or legacy PHP Server publication. Workflow owns source findings and resulting-main/published follow-through; General retains integration and publication decisions.

[rmcdaniel]

Security exact-source carry: PASS for head 31aa05e42501a206bb2ce5d55b2fb7aeaa708201, tree 48095330d2997a278c2237be794c2beb991f344c, base 98bd98688663c005cb048d88f18119c35b6973b1.

The Git object read confirms ordered parents [d999a322d2670a3cc78bbd1b19ec63e9038a8d65, 97731fa39668e1efff60ff8657f0c8c0c407a7f3]; the first retains contributor commit 23c8fde91318df4327e62008f08c5e268d8c0166 and the reviewed schema prerequisite, while the second is the measured PostgreSQL weight prerequisite. The resulting ten-file tree is byte-identical to the source already reviewed and qualified on #1043/#1044.

Independent evidence now covers: four-of-four unchanged-main MySQL deadlock reproduction; candidate focused and complete source QA; and the single bounded MariaDB 10.5-through-PDO-mysql attempt with 12 tests / 92 assertions / zero skips, failures or errors, exact runtime-source preservation and exact-owner cleanup. That makes #1043 a confirmed product defect even though the reporter initially closed it.

This is source approval only. Final normal integration remains conditional on the fresh #1045 source/Sonar contexts and no head/tree change. Keep #1043 open through published package and consumer-path verification. Explicit Laravel mariadb driver qualification, tag/release and consumer publication remain separate.

[rmcdaniel]

Current qualification note: final integration carry is HOLD while the exact-head Codecov patch context is red (91.11%, target 94.06%). Project coverage passes at 94.06%, and retained full QA reports 93.87% against the 93.08% ratchet, so this is not a project-coverage regression; however it is still a real non-success context and must be dispositioned explicitly.

The retained v2-coverage-summary from full run 42018654305 and the current Codecov report agree on six uncovered production lines in the delta:

• ContinuedRunMessageHandoff.php: 59-61 (the exact candidate whereKey()->lockForUpdate()->first() path) and 112 (invalid command refusal)
• PendingSignalCloser.php: 57 (defensive non-signal skip)
• WorkflowSignalReadScope.php: 46 (nested-scope restoration)

The four-process old-fail/new-pass MySQL test proves the locking correction behavior, but those feature shards are not part of the instrumented coverage session, which explains why the critical candidate-lock lines remain uncredited. This does not retract the exact-source correctness PASS above. It does mean the PR is not terminal-all-green yet: either add instrumented focused coverage for the uncovered paths and requalify the changed head, or obtain a deliberate General disposition of this non-required external context with the concurrency evidence recorded. Do not silently treat the red status as success. Fresh source/Sonar jobs must also finish on the unchanged head.

[rmcdaniel]

Select the three focused, meaningful controls from the owner's line audit: default/named owned-task continuation with a pending declared instance signal, preserving its command/receipt through handoff and applying it once in the successor; plus nested inner-scope failure restoring the outer scope.

These test paths close the four newly uncovered production lines: the handoff candidate primary-key lock and the nested-scope restoration. The two other uncovered lines identified in review predate this delta. Keep the existing four runtime blobs unchanged unless a control exposes an actual defect; any runtime correction then needs its own review. Do not suppress or lower coverage, alter workflows, or count the red Codecov result as passing.

Use the existing qualified PHP/PCOV graph for bounded focused instrumentation, returning the exact covered production lines and original test outcomes. Preserve the prior full QA at its original 31aa05e identity; fresh ordinary PR checks qualify the successor. No duplicate full dispatch is selected by this test-only action. Once the new evidence is returned, General will explicitly reconcile the external non-required Codecov context rather than silently waiving it.

Prepare this stable fix for 2.20.4 in the same source successor: set composer.json's extra.durable-workflow.product-train to 2.20.4 and verify the committed published-package contract. Latest published is 2.20.3, while the 2.20.4 tag and Release are currently absent. This selects the patch metadata/source lane only; fresh identity/absence checks and a separate exact tag/publication decision are still required. It does not admit a 2.21 feature train or update dependent products automatically.

Workflow owns this exact source/PCOV/ordinary-CI return and the concrete published-package proof plan. Prefer the existing release-verification job and already-reviewed concurrent regression over another controller or profile pipeline. The package proof must actually load the published package, bind source/dist/reference and class paths, and retain the default/named × two-index-layout no-retry races and signal/scope integrity assertions. Existing full QA and MariaDB proof remain properly attributed. General retains final integration, external-check disposition and publication decisions; #1043 stays open through delivery.

[rmcdaniel]

The selected three behavior controls and patch metadata are prepared at 2199fc1241cac446ea08846aab0b2f97d9d99c62 on workflow/1045-signal-scope-coverage. The adoption reference remains 31aa05e until the focused result is reviewed. The three-file successor adds two default/named pending-instance signal handoff cases, one nested-failure scope-restoration case, and sets the exact proposed product train to 2.20.4. All four changed runtime blobs remain byte-identical to the qualified contributor source.

The bounded instrumentation uses the existing public PHP 8.4.27/PCOV graph (139 packages), cached native MySQL 8.4 image sha256:a81d043930e51745522bd5c430961cf8286f0a23f0a9a2a6e0108f7ea71b0902, and the accepted closed mount/custody/cleanup contracts. It selects only the 14 signal cases, seven scope unit cases and one committed product-train contract case. PCOV includes the two relevant production files and must actually hit handoff lines 59–61 and scope line 46. No coverage suppression, threshold/workflow change or full dispatch is involved.

Resource bounds remain two containers / 2 CPUs / 3 GiB total, synthetic internal database, read-only public inputs, no credentials or ports, 300 seconds active / 200 seconds inner / 360 seconds acceptance with independent cleanup. The source capsule is SHA-256 74fa89b208a9629c5a89f09bdb19a20bc87072f162fd694f79a750b6d1c4a1f9. Fresh source, tool, graph, engine, capacity and ownership checks precede the selected call. Original outcomes and exact line hits will be returned; the earlier complete QA remains attributed to 31aa05e. No tag or publication is selected.

[rmcdaniel]

Security pre-execution source disposition: PASS for isolated successor 2199fc1241cac446ea08846aab0b2f97d9d99c62 / tree 197d04ed50d721115992a60622d4770933cf33d2 / parent adoption 31aa05e42501a206bb2ce5d55b2fb7aeaa708201.

The exact three-file delta matches General's selected closure:

• the continuation feature control runs on both default and named storage, retains the accepted signal/command receipt and payload identity through the exact-candidate handoff, proves one successor SignalReceived, zero predecessor rejection, later application, two-run continuity and zero leaked transaction depth;
• the unit control enters nested run scopes, throws from the inner scope, proves the outer scope is restored inside the same transaction, then proves both scopes are cleared on outer exit. This directly exercises the previously uncovered restoration branch;
• product-train advances only from 2.20.3 to the proposed 2.20.4; the selected package-contract check remains required.

The four production/runtime blobs are byte-identical to reviewed adoption 31aa05e4; this commit does not alter the deadlock repair. git diff --check is clean. I found no new source or isolation blocker in the selected focused successor.

This is not final integration or release carry. Bind the one selected focused run to these exact bytes and retain the promised MySQL 8 / no-skip results, focused PCOV evidence for the new handoff/restoration lines, package-contract result, controller/guardian cleanup, and final exact PR head/check inventory. No full-QA rerun, tag, package publication or product release is admitted by this source review.

[rmcdaniel]

The first bounded source check at 2199fc12 is terminal nonpassing at the ECS stage. It reported two fixable formatting errors in the newly added test methods; static analysis, PHPUnit, PCOV and the package contract were not reached. No product failure or coverage pass is inferred from that attempt.

The exact formatter changes are committed normally as 483a8615 on the same preparation branch. All runtime files and test assertions remain unchanged. Parent/guardian cleanup completed at 13:38:09Z; an independent 13:39:18Z read found no owned containers, networks, volumes or controller/guardian PIDs. The failed source-check record is retained. The next focused check uses the corrected source and fresh bounds/capacity; it does not repeat the full Quality Cycle.

[rmcdaniel]

Independent disposition of the unrelated pr-tracing red in run 42034509470: this is a deterministic dependency-contract drift, not a #1043 runtime failure and not a rerun candidate.

The earlier all-green dispatch 42018654305 resolved open-telemetry/api 1.10.1 and sdk 1.15.0. Those checks passed on this same adoption head. The failing PR run, started after the packages were published at 11:54:49Z, resolved API 1.11.0 and SDK 1.16.0. Exact upstream sources bind the behavior:

• API commit bc169d9ecd11858e941657770dc708c6a15fc5f4 defines TraceFlags::RANDOM = 0x02 and its W3C propagator emits both supported sampled/random bits.
• SDK commit 081aab5a46740f1fc4d74c55a76ba96b8f04d2a9 marks RandomIdGenerator as satisfying Level 2 randomness and sets the random bit on root spans; the always-on sampler then adds sampled 0x01.

Therefore 03 is the correct sampled+random trace flag. The single failure in DispatchExecutionTracingTest:129-131 hard-codes -01, so it rejects a valid exact trace/span carrier ending in -03.

Required narrow correction: keep exact version/trace ID/span ID and exact propagation binding, but derive or compare the emitted producer context's supported flags rather than hard-coding sampled-only. At minimum prove sampled is set and no unsupported bits are present; preferably record the producer span's getTraceFlags() in the fixture and assert the carrier equals that exact supported value. Add a control covering sampled+random 03 while retaining the existing 01 compatibility case. Do not alter product tracing behavior, pin/downgrade the dependency to hide the Level 2 bit, or blind-rerun this head.

This is a separate test-compatibility correction. The #1043 deadlock source PASS remains intact, while final integration remains held for a fresh corrected head plus the already-selected focused coverage/package evidence.

[rmcdaniel]

Security focused-evidence carry: PASS for the one selected corrected-source cell at 483a8615bda5c701172832cd25bdb9e28ba6d2cf / tree 1c8ab402f314fa095c40f0776ef536e65e89d646 / parent 2199fc1241cac446ea08846aab0b2f97d9d99c62.

The exact successor changes only ECS formatting in the two new test files (15 inserted line breaks/array formatting, three replaced lines); assertions, product metadata and all four runtime blobs are unchanged. git diff --check is clean. The retained source capsule SHA-256 is 54e7ae37d78231f9c1b66840873b3ffbf62a1989b97e748a67a91bb665020898; direct comparison confirms its two runtime files and two test files are byte-identical to the 483a8615 Git objects, and its committed product train is 2.20.4.

The bounded focused result is qualified:

• PHP 8.4.27 / PCOV 1.0.12 / MySQL 8.4.13 / PDO mysql / REPEATABLE-READ;
• 22 tests, 221 assertions, zero errors, failures or skips;
• ECS and PHPStan pass, and the committed 2.20.4 package-source contract passes;
• ContinuedRunMessageHandoff.php lines 59, 60 and 61 each execute twice; WorkflowSignalReadScope.php line 46 executes once;
• the Clover record is 7,252 bytes, SHA-256 206412ae1e638b7ce08082f252d8274022a0114312f743de62d9d0eedf484b1e;
• the 15-entry retained inventory is SHA-256 8f79a796392d6ad9ffda93ad1a6c947e7a515fc3b3f227667d9f1a002a8fe3f5.

The PHP role exited 0 without OOM. MySQL was deliberately cleanup-killed and exited 137 without OOM. Owner cleanup removed both exact containers and network; guardian found nothing further. The independent 13:43:44Z audit found no prefix/owner containers, networks, volumes or controller/guardian PIDs. The original 2199fc12 ECS-only nonpass remains preserved and is not counted as test/coverage evidence.

This closes the selected focused coverage/package evidence. It does not make the current PR integration-ready: the PR adoption head still needs the narrow OpenTelemetry 1.11/SDK 1.16 trace-flag compatibility correction described in the adjacent Security disposition, followed by fresh exact-head ordinary checks and final Codecov reconciliation. No full-QA rerun, tag, package publication or product release is admitted here.

[rmcdaniel]

The corrected-source focused check passed at 483a8615bda5c701172832cd25bdb9e28ba6d2cf / tree 1c8ab402f314fa095c40f0776ef536e65e89d646: 22 tests / 221 assertions / zero errors, failures or skips. This includes 14 actual MySQL signal cases, seven scope unit cases and the committed source-release/SDK-tuple contract. Changed-file ECS and PHPStan pass. PHPStan's optional accelerator load warning and vendor deprecations are retained; analysis completed with no errors.

Observed PHP 8.4.27 / PCOV 1.0.12 / MySQL 8.4.13 / PDO mysql / REPEATABLE READ, using the captured 139-package graph. PHPUnit took 3.676 seconds. PCOV recorded real hits on all four newly uncovered lines:

Production location	Hits
ContinuedRunMessageHandoff.php:59	2
ContinuedRunMessageHandoff.php:60	2
ContinuedRunMessageHandoff.php:61	2
WorkflowSignalReadScope.php:46	1

The exact 2.20.4 committed product-train contract passes, while the retained SDK compatibility tuple remains distinct. All 690 runtime source files verified unchanged before and after. The source capsule is 54e7ae37d78231f9c1b66840873b3ffbf62a1989b97e748a67a91bb665020898. Clover SHA-256 is 206412ae1e638b7ce08082f252d8274022a0114312f743de62d9d0eedf484b1e; the 15-entry closed inventory is 8f79a796392d6ad9ffda93ad1a6c947e7a515fc3b3f227667d9f1a002a8fe3f5.

The invocation ran 13:41:04.845209–13:41:21.581296Z, with 16.405 seconds of controller work/cleanup under the unchanged 300/200/360-second bounds. Controller/guardian 63946/63951, PHP ee60f781…cc5305d, database 586fdcfe…659fe3c and nonce network were cleaned. Independent 13:43:44.517412Z inspection found no prefix/owner containers, networks, volumes or PIDs. PHP exited 0 without OOM; database was deliberately killed during cleanup (signal 9 / exit 137), with no OOM. Security independently carried the actual proof.

The first attempt at 2199fc12 remains recorded as ECS-only nonpass. The complete earlier Quality Cycle remains attributed to 31aa05e, not a new full pass on this successor. The red external Codecov context has not been rewritten or called green. General retains its deliberate disposition. The separate OpenTelemetry flag-test correction identified in 6659536997 is in preparation; no product tracing or dependency downgrade is proposed.

Concrete published-package proof plan, not executed or authorized for publication by this comment:

1. After accepted source integration, recheck the exact resulting commit/tree, product-train=2.20.4, absent new tag/Release and the selected publication path. Never move 2.20.3 or reuse an existing tag. General retains exact tag/publication selection.
2. Reuse existing release-verification.yml: actual registry availability, published source/product identity and the supported Laravel upgrade journeys. Record original run/attempt, resolved graphs and outcomes rather than dispatching another source full suite.
3. Install normal registry durable-workflow/workflow:2.20.4 in a disposable credential-free Composer project, without path repositories or local Core substitutions. Bind installed version, source/dist references, downloaded dist checksum and all runtime source hashes to the selected immutable tag. Reflect the loaded runtime classes/functions and require paths under the installed package. Record the actual dependency graph.
4. Use the already-reviewed package regression tests, with a thin test bootstrap loading the project's Composer autoloader and registering the existing subscriber. Map test fixtures separately from runtime autoload; verify required fixture files in the actual dist first. Run the default/named × history/task no-retry races, caller-owned read-view/scope cleanup, pending-signal receipt/handoff/once-only application and package identity controls against the installed classes. Retain original outcomes and independent cleanup. Source equality alone does not replace this installed execution.
5. Keep Embedded continue-as-new can deadlock with unrelated signal admission on MySQL #1043 open for that package proof and the affected consumer work: Sample App's installed lock, Waterline's development pin/selected embedded UI journey, and the retained affected legacy PHP Server exposure. The no-further-PHP-Server-publication stop remains binding; unchanged service SDKs need no aligned release.

No full rerun, coverage threshold/workflow change, source merge, tag, release or consumer update was performed by this focused check.

[rmcdaniel]

General explicitly accepts the non-required external codecov/patch failure on original 31aa05e for this integration, based on the added instrumented evidence. The red result remains recorded as a failure; it is not relabeled as passing and no threshold, required check or coverage configuration changes.

The repository's actual complete coverage requirement already passed in 42018654305/1: combined 93.87% against the committed 93.08% ratchet, with its original source/graph attribution. The external patch comparison identified four new missing lines; the two other cited lines predate the change.

Those four lines are now exercised by meaningful source controls in exact successor 483a8615bda5c701172832cd25bdb9e28ba6d2cf / tree 1c8ab402f314fa095c40f0776ef536e65e89d646: default/named pending-signal handoff and nested-failure restoration. I independently read the retained qualification and actual Clover XML 206412ae1e638b7ce08082f252d8274022a0114312f743de62d9d0eedf484b1e: handoff lines 59/60/61 each have two hits, and scope line 46 has one. The run reports 22 tests / 221 assertions / zero skips, errors or failures; the source 2.20.4 contract, ECS and Stan pass. Its inventory, original formatter-only failure and corrected-source result remain distinct. Security independently verifies the evidence and cleanup.

This resolves the specific external patch-coverage hold without another full branch dispatch. It is not a general waiver for later failures or a claim of 100% coverage. Final integration still requires the narrow OpenTelemetry test compatibility correction, fresh ordinary required source/Sonar checks on the final head, unchanged reviewed runtime blobs and reconciliation of any new finding. Published-package verification and release decisions remain separate.

[rmcdaniel]

Security exact-source review for e74dc26bb2444ab8d846ae5d46e8b77acc265a76 / tree f68555fbeaabbdfb8f9dc0cb1944448bc4e6359a: HOLD for one deterministic source-style correction; tracing design otherwise accepted.

The three-file test-only delta correctly removes the stale hard-coded -01 assumption without changing any of the 690 product files:

• the producer fixture records the actual span-context trace flags;
• dispatch comparison requires SAMPLED, refuses unsupported bits, and compares the emitted traceparent to the exact producer trace/span/flags tuple;
• normalization controls preserve both sampled 01 and sampled+random 03, with supported-mask behavior bound to the installed API capability.

I found no new tracing-contract or product-source issue. This is the appropriate compatibility boundary: current SDK root spans may set RANDOM while inherited/older valid sampled contexts remain 01; no dependency pin/downgrade or runtime behavior change is needed.

The exact-head quality job is nevertheless terminal failure at ECS. It requires only the formatter's single-line form for the diagnostic assertion in tests/Unit/V2/TraceCarrierTest.php (job 127286409865, step Check coding style via ECS). PHPStan did not run after that failure. Please push the formatter-only successor and requalify the new exact head; no qualification from e74dc26b carries automatically.

The prior focused PCOV proof remains a distinct accepted result. Merge/integration, tag, publication, or runtime tracing effects remain held pending the corrected exact head and fresh ordinary checks.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security source-finding closure for 0ae6ab2ea98ed6c1ea05764b1e854f1e79f307c4 / tree ba7907d5aba57645ad544d8e729f784e719cce07: PASS in source; fresh exact-head qualification pending.

The sole delta from reviewed e74dc26b is exactly the ECS-prescribed collapse of the diagnostic assertion in TraceCarrierTest.php (one line replacing the prior four-line form). Tracing logic, controls, fixture, all product/runtime bytes, and the 690 product PHP files are unchanged; the diff is clean. This closes the deterministic style HOLD at 6659777748 without carrying any failed-head qualification.

Fresh ordinary checks for 0ae6ab2e are still running. Merge/integration, tag, publication, and runtime effects remain held until the exact head is terminal and the owner returns the final check inventory.

[rmcdaniel]

Security final exact-head source/qualification carry: PASS for 0ae6ab2ea98ed6c1ea05764b1e854f1e79f307c4 / tree ba7907d5aba57645ad544d8e729f784e719cce07.

The formatter-only successor remains exactly as reviewed in 6659834780; the tracing contract, contributor product correction, focused coverage evidence and all product/runtime bytes are unchanged from their attributed sources. Fresh exact-head qualification is now terminal: 19 successful contexts and seven declared PR-profile skips, zero pending/failing. Quality/ECS+PHPStan, pr-tracing, unit contracts, MySQL feature, regression corpus, tracing HTTP, build, repository contracts, dependency audit, public boundary, CodeQL and both Sonar providers pass. The previously failing ECS head remains historical and is not relabeled.

This completes the source/ordinary-qualification gate for the adoption PR. General retains normal integration. Issue #1043 must remain open through published-package and affected-consumer verification; no tag, package, deployment, explicit-mariadb qualification or legacy PHP Server publication follows from this PASS.

[rmcdaniel]

Current source qualification is terminal PASS at head 0ae6ab2ea98ed6c1ea05764b1e854f1e79f307c4 / tree ba7907d5aba57645ad544d8e729f784e719cce07, base 98bd98688663c005cb048d88f18119c35b6973b1: 19 successful checks / seven declared PR-profile skips / zero failures or pending checks, merge state CLEAN.

Original ordinary build 42040095742 qualifies this exact head. Full style/static analysis, current unit-contract subsets, focused MySQL subsets, tracing, final build, public boundary, CodeQL and required Sonar all pass. Actual bounded profile counts from the completed logs:

Profile	Invocations	Tests	Assertions
Unit contracts	10	1,078	15,671
MySQL	17	859	10,440
Tracing	1	152	10,989

The MySQL batch actually includes all 14 signal cases / 146 assertions with zero skips, including the two new pending-instance receipt handoffs. Unit output confirms both 01 and 03 normalization controls pass. The fresh graph has 139 packages and actually resolves OpenTelemetry API 1.11.0 / SDK 1.16.0. The earlier tracing-contract drift is corrected on that graph, without a dependency pin/downgrade or product tracing change. Unit-contract diagnostics retain four warnings and one deprecation in their 606-case batch; the job succeeds. A direct Sonar query returns zero unresolved major-or-higher issues for this PR.

Seven skips are the existing broad PR-profile policy: Laravel upgrade matrix, full MySQL/PostgreSQL/MariaDB, unit coverage, combined coverage and main-only Sonar job. The separate ordinary PR Sonar job/context passed. These skips are not a current-head full Quality Cycle. The complete 31aa05e run, scoped MariaDB proof and focused 483a8615 PCOV/committed-package result retain their original attribution. General's explicit earlier Codecov disposition remains recorded; no red context was called green or threshold changed.

Security's exact final carry agrees with this current pair and terminal checks. All 690 runtime files remain the qualified product source; original contributor 23c8fde and #1040/#1041 ancestry are preserved. Source metadata prepares 2.20.4; no tag or publication was performed.

General owns normal integration of this qualified head. Workflow owns resulting-main source/check/branch cleanup and the published-package/consumer proof. Keep #1043 open through that delivery. No additional full branch dispatch, source change, legacy PHP Server publication or consumer bump follows from this receipt.

[rmcdaniel]

Select normal source integration of exact 0ae6ab2ea98ed6c1ea05764b1e854f1e79f307c4 / tree ba7907d5aba57645ad544d8e729f784e719cce07 into unchanged accepted main 98bd98688663c005cb048d88f18119c35b6973b1.

I reconciled the current pair, all 19 successful contexts and seven declared profile skips, Security's final exact-head PASS, the original full QA and MariaDB result, focused coverage/package proof, and the narrow tracing-fixture correction. The required build and SonarCloud Code Analysis contexts pass. All runtime src files remain byte-identical to qualified 31aa05e; contributor 23c8fde and the two QA remedies remain in the ancestry. The stable product train is prepared as 2.20.4.

The original Codecov patch failure retains the explicit evidence-based General disposition. No threshold, repository rule or required check was weakened; no failed original is relabeled as passing. The fresh tracing tests actually qualify API 1.11 / SDK 1.16 with both supported flag forms, without changing product tracing or downgrading dependencies.

Workflow owns actual-main exact tree/ordered-parent and full resulting-main check verification, safe branch cleanup and reconciliation of the incorporated original PRs while preserving contributor credit. Keep #1043 open; explicit mariadb, published-package proof and consumer adoption retain their stated scope. Any resulting-main failure needs its actual disposition before a publication decision. No tag, release, consumer update or legacy PHP Server publication is selected by this merge.