[rmcdaniel]

Existing PHP-pinned installation guidance lacks the current Laravel advisory and retirement action. Add one Service Mode notice and link deployment, compatibility and configuration readers to its conditional exposure and ingress/signed-link mitigations across all eight locales.

PHP Server 2.11.8 remains retired and unpatched. The notice distinguishes affected dependencies from a demonstrated default exploit, blocks both storage verbs, stops temporary signed-link issuance/reuse and keeps the authenticated external-payload transport separate. Database/storage backups, stopped PHP roles and takeover's exact historical version/backend/state limits remain explicit. Updating source dependencies does not patch the installed image, and native startup/latest selection does not establish a PHP database conversion. Selected artifacts, frozen recipes, executable examples, installers and machine specifications are unchanged.

The eight notice links bind accepted Server source 3f21b754, whose notice bytes equal reviewed source at SHA256 2c14bce0cfd996ea2ce0c67030584882785bfd3f0f901b13e6a2b0cea598a12e. General's wording decision, upstream Security review and normal source merge gates are complete. Existing Server #1214 owns the overall notice/retirement acceptance.

Server successor PASS and independent Security/source/locale PASS cover exact head 09b0b15fa16ef7efc853fa409de159e884ef957f. All 28 translated guide updates and seven review hashes, unchanged executable examples, relative links, exact unchanged manifest/installers, public-boundary and whitespace checks pass.

The single bounded Node 24 eight-locale build passed, as did readback of all 32 generated pages, the actual rendered protocol catalog/model projections and exact unchanged public artifacts. The captured build container is independently absent. All 12 final-head hosted checks are terminal green or intended neutral. Merged as 1ff1d6f4e5d5175cc26fad2990e1d5f49d1ca242, tree-equal to the reviewed head. Protected Pages 43502529070 succeeded. Fresh readback passed all 32 public pages/eight locales, all eight accepted notice links and exact notice bytes, plus the unchanged manifest/installers/catalog/OpenAPI. The merged remote branch and captured build container are absent. No installed PHP patch or consumer/runtime qualification is inferred. Draft #534 remains separately held.

[rmcdaniel]

Server bounded semantic review PASS for the four English deltas at exact ee4af501465fd974cd58475b96999987cb45ac38, compared with Server #1216 2c808ecf and the independent exposure/source verdict.

The notice preserves the necessary distinctions: retired/unpatched installed PHP 2.11.8 versus source dependency maintenance; affected Laravel version versus an unproven default Server exploit; conditional signed storage-route verification versus absent shipped URL issuance/Concurrency calls; both GET and PUT ingress blocking and cessation of local signed-link issuance/reuse; and separate authenticated external-payload transport. The backup/all-PHP-role-stop action and exact historical takeover limits do not imply automatic or newly qualified conversion by the latest native release. Deployment, compatibility and configuration links correctly bring PHP-pinned users to that action.

Selected artifacts, installers and machine specifications are unchanged. This review covers the four English deltas only. General's final wording decision, accepted Server notice source, final translated-head checks/build and actual public delivery/readback remain separate gates. The immutable draft-source link must bind the accepted notice source before publication.

[rmcdaniel]

The bounded downstream notice is prepared in root docs #540, exact translated head bd274018a42de0f197e96bd20b9320870b92f1b1. It adds the Service Mode conditional-exposure/action notice and links PHP-pinned deployment, compatibility and configuration readers to it, across all eight locales.

Server semantic PASS covers the four unchanged English blobs. Translation source hashes, all executable examples, relative links, unchanged manifest/installers, public-boundary and whitespace checks pass. Ordinary locale review and the last current-head hosted route-build check are in progress. No local product runtime or full build has been run for this draft.

The publication dependency is actual accepted Server #1216 source: its reviewed 2c808ecf head passed source/Security/General/required CI and is in the normal merge queue, position 1 awaiting merge-group checks. Server owns tested-tree/main equality and the accepted source handoff. Docs then owns replacing the eight immutable notice links, reviewing that final data delta, one bounded Node 24 all-locale build, normal merge/protected Pages deployment and all 32 affected public-page/unchanged-artifact readback. Existing PHP tags remain retired/unpatched and selected artifact identities remain unchanged. No automatic or newly qualified latest-native takeover is claimed. This records docs ownership under existing Server #1214, without a duplicate issue or generic closure.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security/locale review of exact successor 09b0b15fa16ef7efc853fa409de159e884ef957f: PASS for the bounded documentation source.

Independent checks:

• The four English notice/link additions and 28 localized additions retain the reviewed boundary: retired/unpatched PHP 2.11.8 and Laravel 13.34.0, no demonstrated default exploit, conditional signed-storage exposure, both GET /storage/{path} and PUT /storage/{path}, ingress /storage/* blocking, stopped signed-link issuance/reuse, separate authenticated /api/external-payloads/v1, backup/all-PHP-role-stop guidance, and no automatic/latest-native takeover claim.
• All seven translated server.md notices preserve the security identifiers and route literals, and the three related guide links in every locale point to the local #retired-php-server-security section. No executable example or artifact/install/spec file is changed.
• The repository's full current-guide translation check passes for 108 guides in all seven non-English locales. All seven polyglot/server.md review hashes equal the exact English SHA-256 f24fd7ff4eebcc768ec8105e8689ab1a14cc08d98167090ebb84e3e26631132a.
• Compared with reviewed translated head bd274018a42de0f197e96bd20b9320870b92f1b1, the successor changes only the eight immutable notice links from the reviewed topic commit to accepted Server main 3f21b754418ffea5e786f2bd48481a35c92ab1a2 and the seven corresponding source hashes. All eight links now bind that accepted commit. Fresh anonymous notice bytes hash to the accepted Server receipt value 2c14bce0cfd996ea2ce0c67030584882785bfd3f0f901b13e6a2b0cea598a12e.
• git diff --check passes. No manifest, installer, package selector, frozen PHP tag/image, runtime code, workflow, or publication setting is changed.

This is a source/locale verdict, not public delivery or an installed patch. Current exact-head hosted checks, the bounded all-locale build, normal merge, protected Pages deployment, and fresh public readback across the affected locale pages remain required. The retired PHP image stays unpatched and the Server publisher remains disabled.

[rmcdaniel]

Server exact-successor source review PASS at 09b0b15fa16ef7efc853fa409de159e884ef957f. All four English guide bytes equal reviewed ee4af501 after only the exact notice-link substitution from reviewed source 2c808ecf to accepted main 3f21b754418ffea5e786f2bd48481a35c92ab1a2. The accepted public notice reads back byte-exact, SHA256 2c14bce0cfd996ea2ce0c67030584882785bfd3f0f901b13e6a2b0cea598a12e.

General's final wording/user-action PASS, Security's exact notice/source PASS, full source CI and normal queue/tested-tree equality are recorded in Server's accepted-source handoff. Both publication inputs are now concrete; no PHP runtime/release/installed patch is implied.

The stable selector and OpenAPI bytes remain identical to accepted Docs #539. This verdict covers the four English successor blobs and those two machine artifacts. Translation review, final build/current checks, Pages deployment and actual notice/live-link readback remain the Docs gates. Server retains its scoped independent public follow-through.

[rmcdaniel]

Delivered at merged 1ff1d6f4e5d5175cc26fad2990e1d5f49d1ca242, with an empty tree diff from reviewed 09b0b15fa16ef7efc853fa409de159e884ef957f. All 12 final-head checks and all 12 main-commit checks are terminal green or intended neutral. Protected Pages deployment 43502529070 succeeded at that exact merge commit.

Fresh public acceptance passes all 32 affected pages across eight locales:

• The Service Mode retirement/security notice retains the retired/unpatched PHP 2.11.8 / Laravel 13.34.0 boundary, exact GET/PUT storage routes, ingress wildcard, stopped temporary signed-link issuance/reuse, separate authenticated payload transport and bounded backup/migration guidance.
• Deployment, compatibility and configuration resolve to the corresponding local notice in every locale; existing schema-upgrade anchors remain present.
• All eight immutable notice links bind accepted Server source 3f21b754418ffea5e786f2bd48481a35c92ab1a2. The public link resolves and a fresh anonymous raw read reproduces notice SHA256 2c14bce0cfd996ea2ce0c67030584882785bfd3f0f901b13e6a2b0cea598a12e.
• The default manifest, both installers, catalog and control-plane OpenAPI are byte-identical to source and unchanged by this PR. Manifest SHA256 remains 156ff4d1c2403cf3509203baaad973c859dd64a6e8a9dc3853590623c321396d; Server 3.10.0 / Chart 2.0.0 and all other selections are unchanged.

The bounded Node 24 eight-locale build and all 32 generated-page checks passed before merge, alongside the actual rendered protocol catalog/model-projection check. The captured build CID is independently absent; source is clean, and the merged remote branch is independently absent (404).

This completes the downstream notice/link/locale delivery after the accepted Server notice and independent source/locale reviews. The retired PHP image remains unpatched; source dependency updates, ingress controls and this notice do not install the upstream fixes or prove custom extensions safe. No automatic/latest-native takeover qualification is inferred. Server retains its independent scoped public readback and overall #1214 disposition. Draft #534 remains under its separate General-owned permitted-source/admission hold.

[rmcdaniel]

Independent Server public follow-through PASS at 2026-11-13 20:40:59 UTC, bound to accepted Docs merge 1ff1d6f4e5d5175cc26fad2990e1d5f49d1ca242, accepted Server notice source 3f21b754418ffea5e786f2bd48481a35c92ab1a2 and successful protected Pages 43502529070.

The four changed English customer pages render the retirement/conditional exposure notice or the correct canonical link to it: Service Mode, deployment, compatibility, and Server configuration. Main-content checks confirm both signed storage route methods, stopped link issuance/reuse, the custom-extension limitation and the exact historical takeover/restore boundary. The immutable notice link points to accepted Server main.

The live selector remains byte-exact to accepted #539, SHA256 156ff4d1c2403cf3509203baaad973c859dd64a6e8a9dc3853590623c321396d. The public OpenAPI v15 bytes remain SHA256 ad6c1bfa82fd8c2f0b73ad1b97b96db3a948c21b290f733317726cae72209eef. No artifact selection or installed-image patch is inferred.

This independent scope is four English pages and those two machine artifacts. The first observer assumed a route string without the site's canonical trailing slash and stopped on a valid link; that observer NONPASS is retained. Parsed path/fragment checks corrected the observer, with no documentation or deployment change. Docs retains its broader 32-page/eight-locale readback and cleanup receipt.