[rmcdaniel]

Complete the missing installed PHP slice of shared #247. The lazy APIs shipped in3.10.0; no new API or SDK release is needed.

Add one opt-in to the maintained published-worker workflow on normal-registry SDK3.18.2/f948 and the qualified native3.8/index7988 tuple. Main-only guards refuse candidates, foreign tuples and conflicting qualification flags before installation/runtime effects. The sibling Laravel job excludes both ordinary proof selectors at job level; the earlier retry-identity control also rejects pagination. The PHP8.3/trust242c profile, native runtime bounds and teardown retain their existing rules. The retired411a setup source requires the activated central replacement before this caller can run again.

One ordinary Worker completes five uniquely typed workflows and one differently typed foreign control. The installed iterateWorkflows API must lazily return exactly the five matching completed instances across three two-item pages. The installed exact-run history iterator uses two-event pages, must yield its first page before fetching later pages, and must equal the bounded complete reference history with no gaps or duplicates. SDK-owned client metrics count successful real page requests without replacing the HTTP transport. Reflection/installed ZIP metadata bind the actual registry SDK; no fake API responses or source override enter the case. Retain typed tuple, real history, page counts and foreign exclusion with the existing installed graph.

Four new selector/evidence controls, four retry-identity/cross-job controls and five existing tuple/pipeline controls pass locally; YAML/diff pass. Exact head45e60d9 has terminal36 successful checks and two declared skips, including PHP lint/unit/framework/corpus/docs/static analysis. Original CI43589164151 analyse setup HTTP403 remains NONPASS; one targeted retry on the same unchanged stock profile passed after the other stock-profile lane succeeded. No second retry was selected. Current shared setup now has a distinct proven prerequisite failure: unchanged411a archive739209532 returns HTTP404 on both ordinary anonymous and authenticated metadata, blocking a future fresh main/installed run until .github restores a qualified immutable input. No tuple/profile fallback is selected. No installed pagination dispatch has occurred. Exact45e source/case now has independent PASS; the caller is explicitly HOLD on the retired411a dependency. Central404 has reviewed replacement source5c1ddbff, but its protected organization-rule transition and original hosted qualifiers are not activated/complete. SDK has prepared a local-only17-literal update across all six affected workflows, including matching docs action/control sources, without pushing or invoking unactivated setup. Concrete next action: after central404/400 activation and qualification, publish that bounded pin adoption, rerun exact-head caller checks, integrate normally, qualify actual main, then select one pagination invocation and independent artifact review before Docs handoff. This changes only excluded CI/test files, with no library/runtime, version, profile/catalog, #419/#420 or #421 acceptance change.

Refs durable-workflow/.github#247. Owner: sdk-php.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security review for exact 45e60d9d205b31b4328247cd9d0cd2346e4b5219: source/case PASS; exact caller HOLD on the shared setup dependency.

The pagination scope is closed correctly:

• main-only workflow dispatch, published SDK 3.18.2 source/dist f9483bb2..., native 3.8.0 image 7988a235..., no candidate source and mutual exclusion from activity-identity/Laravel/other qualification flags;
• six real completed workflows with a distinct foreign type, five exact filtered IDs over three two-item pages, lazy first-page request evidence and no prefix/filter substitution;
• exact selected run identity, a bounded complete reference history, multi-page two-item iteration byte/structure-equal to that reference, and no gaps/duplicates/live worker;
• installed registry distribution/reflection/Composer identity and result tuple are retained.

The four pagination selector controls and four activity-identity composition controls pass locally; current-head PHP/lint/quality suites are terminal success.

The exact workflow still invokes setup-php-linux@411a14ac..., whose bound Ubuntu 24/PHP 8.3 archive now returns HTTP 404. Therefore the old green PR run is not current caller evidence and no installed pagination dispatch should be selected from this head. Rebind only to the normally reviewed/activated central #404 successor, rerun the exact source/caller checks, then require current main integration before one runtime invocation.

No pagination runtime, installed-package qualification or broader tuple is cleared here.