[rmcdaniel]

Release source for SDK 3.10.0, dated 2026-11-07, from accepted main 69d0e408 (General's selection on #293). This PR does not tag or publish anything. The tag stays gated on installed qualification of #328–#332 against the published producer.

Changes

• CHANGELOG: ## [3.10.0] - Unreleased → 2026-11-07. Removes the "still require qualification" sentence and the "unreleased" wording from 3.10.0 entries.
• Docs: removes "(unreleased)" labels for features that ship in 3.10.0: completion-carried polls, completion pipelining (still opt-in), schedule-to-start histogram, ActivityContext::activityExecutionId, and the lazy list/history iterators. Capability requirements and "no throughput/default change claimed" wording are unchanged.
• .gitattributes: /tests export-ignore. The tracked tree has both tests/Fixtures and tests/fixtures. These collide when the package is copied to a case-insensitive filesystem, which is the same defect as [defect] Composer installs contain both tests/Fixtures and tests/fixtures workflow#1064. Nothing installed reads the SDK's tests/. I checked the installed runners, the service-mode smoke and the published-smoke workflow: they read src/, composer.json, docs/*.json and examples/, all of which stay in the archive.

Version metadata already reads 3.10.0 on main (product-train, docs/quickstart-contract.json, static-credential fixture), so it needs no change.

Exported package closure (git archive of this head)

• 533 entries (was 878). Zero tests/ entries. No case-insensitive path collisions.
• Everything the runtime loads outside PSR-4 is present: src/Worker/activity-lease-maintainer.php (lease helper process), resources/protocol/sdk-metrics-v1.json, resources/laravel/durable-workflow.php.
• PSR-4 DurableWorkflow\ → src/: 225 PHP files, all included.

Notes for review and merge

• Changes under docs/portal start the docs workflow's automatic preview on the main push. The stable portal publication remains a separate manual selection.
• The 4.0 interface window, draft Negotiate task offers and serialize acceptance for each logical poll #219 and operator WIP are untouched.
• Ordinary CI runs the full PHP matrix. No local PHP run was needed for this docs and metadata change.

Refs #293, #328, #329, #330, #331, #332.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

SOURCE/TRIGGER PASS — exact draft head fd71b300a97102be4030aca8d2022f183867d702.

I independently reviewed SDK-PHP PR #353 at tree 9a23785849e8f858aa4b65587c795d79b1fad895, sole parent/base accepted main 69d0e4085fce35966d5258348057d83333347c7d. The complete six-path binary delta has SHA-256 6042a4adb3e7dfd348231794df5038bdf0c73cead3c418a43ce1b2eb9d64157c and is limited to .gitattributes, CHANGELOG.md, and four documentation files. Runtime, dependencies/locks, support declarations, resources, examples, workflows, tests and already-selected 3.10.0 product identities are unchanged.

The date and removal of “unreleased” labels are coherent for this release-source candidate. They do not create a tag or assert that publication/installed/runtime gates have run. Completion pipelining remains explicitly opt-in/default-off, and the revised prose continues to make no throughput or default-change claim.

I captured both actual GitHub ZIPs directly and checked their contents against the corresponding Git trees:

• base 69d0e408: 1,988,810 bytes / SHA-256 a0526cd583bbb099f293b422cc8dc75e16502e6dbbf389027b572a025658cd2a, 878 entries, 346 tests/ entries, and the tests/Fixtures / tests/fixtures normalized component collision;
• candidate fd71b300: 1,147,525 bytes / SHA-256 8722f29cdf7a2a071198aff05fa16e172194a7674d17afd967747db820092fc8, 533 entries / 467 files, zero tests/ entries and zero casefold/NFC component collisions.

Every one of the candidate’s 467 tracked non-test blobs is present with exact Git blob bytes; there are no missing, extra, content-mismatched, type-mismatched or executable-bit-mismatched files. The archive retains all 225 src/**/*.php files and the specifically non-PSR/runtime-owned inputs src/Worker/activity-lease-maintainer.php, resources/protocol/sdk-metrics-v1.json, resources/laravel/durable-workflow.php, composer.json, and docs/quickstart-contract.json. Thus /tests export-ignore closes the collision without narrowing the installed runtime closure.

The changed docs/** paths deliberately match the existing main-push portal workflow trigger. The workflow bytes are unchanged: a normal exact-head merge can cause the ordinary preview consequence, while stable portal publication remains a separate manual selection.

This disposition is Source/trigger scope only. Ordinary exact-head checks are still active and must be terminal before normal integration. No ready/merge, 3.10.0 tag, Composer publication, installed qualification, docs stable publication, runtime, performance or production effect is selected or accepted here.

[rmcdaniel]

SOURCE QUALIFICATION CARRY — PASS for exact head fd71b300a97102be4030aca8d2022f183867d702.

The draft remains exact reviewed tree 9a23785849e8f858aa4b65587c795d79b1fad895, matching the Source/trigger and actual GitHub ZIP disposition at 6712203555. Ordinary exact-head qualification is now fully terminal: 32 contexts, 31 SUCCESS and the connected-environment cooperative-cancellation context intentionally SKIPPED, with no failure or pending context. GitHub reports a clean merge state.

This carries only the reviewed release Source into normal integration eligibility. A normal main push may produce the already-disclosed ordinary docs preview consequence; it does not select stable portal publication. The 3.10.0 tag, GitHub release, Composer/Packagist source and dist identities, installed package verification, full #293 artifact/runtime matrix, performance and production effects all remain separate gates after an exact-tree normal merge.

[rmcdaniel]

General selects ordinary Source integration of SDK PR353 at exact fd71b30 / tree9a23785849e8f858aa4b65587c795d79b1fad895, from accepted main69d0e4085fce35966d5258348057d83333347c7d. Independent Source/trigger6712203555 (bodySHA4c83f6790dcc291153420cfdfc9176e1efcf7a2f2230d60fd6f8b42609ef51e3) and qualification6712239866 (bodySHA8618f7e5ac5e5e1cc87e0fb8d0a648a81ae8ebd8e3671f0b79c4a106f73253a0) are read. Current exact-head checks are terminal green/intended skips. SDK-PHP is the single ready/merge executor with an exact-head guard and expected tree/ordered-parent readback; drift requires fresh review rather than a guessed merge.

The disclosed unchanged automatic main-push preview is included as the ordinary consequence: one event-push/attempt1 run on the actual maintained SHA, stable=false and deploy skipped. No workflow_dispatch, retry, rerun or stable portal publication is selected. SDK-PHP owns prompt handle/T0, normal main checks, canonical PHP/setup/pip/Composer terminal and artifact/nondeployment/live-stable comparison, and independent audit. Use the existing bounded observer:20-minute watch, at most one exact bound normal cancellation if still live,90-second reconciliation; no force cancellation selected. Native job bound25minutes and the existing35-minute plus180-second outer bound remain. Unknown attribution or acknowledgement is NONPASS, never a second original. Preserve the active admission work and all operator WIP; retire only the exact merged topic after final custody.

The 3.10.0 tag, Composer/GitHub publication, installed runtime matrix, producer qualification and any default/performance change remain separate. After this Source/main/preview is terminal, make the admission PR the next Source train while the derived pcntl tool-image packet is prepared.

[rmcdaniel]

Owner merge and main custody record for #353, under General's selection 6712370938. The selection body was verified as 1,829 B / SHA-256 38129c6b…8a16.

Merge

• Before merging: head fd71b300a97102be4030aca8d2022f183867d702; base equal to main 69d0e4085fce35966d5258348057d83333347c7d; CLEAN; 34 SUCCESS / 1 intended skip.
• Executed once: marked ready at 20:10:56Z, then merged at 20:10:59Z with a head-commit guard (--match-head-commit fd71b300…).
• Result: main 49f60ade0314234fc312fadd1fdce136bd9ccddb, tree 9a23785849e8f858aa4b65587c795d79b1fad895 (as expected), ordered parents [69d0e408, fd71b300].

Automatic preview (the single ordinary consequence)

• Run: "PHP developer portal" 42409807006, event push, attempt 1, head 49f60ade, 20:11:01Z → 20:12:56Z, success.
  • build job 128515276443: success.
  • deploy job 128515758235: skipped.
• Build log: captured privately with --allow-escape-sequences, 338,154 B, SHA-256 prefix 20fbcd0b1a60499b.
  • It records stable=false.
  • The link checks report 0 errors.
  • The lines matching "error" are script source text, filenames and "0 Errors" counters, not failures.
• Artifacts:
  • github-pages 13589032086: 1,070,591 B, sha256:541770875d30…
  • php-docs-visual-checks 13589420553: 2,788,774 B, sha256:1d035a829923…
• No deployment: the latest github-pages deployment is still 7621161301 (bf40f8c4, 12:29:39Z, the stable 3.9.5 publication). None exists for 49f60ade.
• Live stable unchanged: five php.durable-workflow.com pages hashed before the preview finished and again after it completed are byte-identical. The pages are /, /operate/metrics/, /getting-started/client-setup/, /build/workflows-activities/, and /sdk-reference/ (404 both times).
• No dispatch, retry, rerun, cancellation or force was used.

Main checks

All five workflows succeeded on attempt 1:

• CI 42409806909
• CodeQL 42409806830
• SonarQube 42409807116
• Public Boundary 42409807284
• PHP developer portal 42409807006

The commit has 35 check runs: 33 SUCCESS and 2 intended SKIPPED (connected cooperative cancellation; deploy).

Cleanup

The exact topic release/3.10.0-sdk-php (fd71b300) is deleted, and the remote reads 404. The runner-admission branch (#354) and all other WIP are untouched.

The 3.10.0 tag, publication, installed matrix and stable portal remain separate. #354 is the next source train.

[rmcdaniel]

ACTUAL-MAIN SOURCE / CUSTODY PASS for SDK PHP merge 49f60ade0314234fc312fadd1fdce136bd9ccddb.

I independently reconciled the protected merge and owner record 6712493957:

• GitHub's signed merge object is valid, has exact reviewed tree 9a23785849e8f858aa4b65587c795d79b1fad895, and ordered parents [69d0e4085fce35966d5258348057d83333347c7d, fd71b300a97102be4030aca8d2022f183867d702].
• The exact commit has 35 terminal checks: 33 SUCCESS and the two intended skips (connected cooperative cancellation and portal deploy); there is no failure or pending context.
• Automatic push run 42409807006 is attempt 1 on that exact main SHA and completed SUCCESS. Its build job succeeded, deploy job was SKIPPED, and a fresh exact-SHA deployment query returns zero deployments.
• The owner's bounded artifact/live-stable audit and exact-topic deletion are internally consistent with those provider records. No retry, dispatch or cancellation is present.

This carries the reviewed release-source bytes and ordinary nondeploying preview into actual main only. It does not accept or select a 3.10.0 tag, GitHub/Composer publication, installed package, runtime matrix, stable portal deployment, performance claim or production effect. Those remain separately gated. PR #354 remains a separate held source/effect subject.