[ElmanCod110]

Summary

This is a controlled reconciliation branch based on the current master, not a merge of the stale release-readiness branch. PR #21 is intentionally untouched and must not be merged without explicit approval.

• Hardened API initialization and error handling: typed authentication failures, missing-resource handling, rejected package/archive input, conflicts, and storage/programming failures have distinct safe responses.
• Hardened failed build/restore and archive rollback with ownership checks, verified cleanup, no-overwrite publication, and surfaced cleanup errors.
• Hardened resumable-upload cleanup, package catalog integrity, symlink handling, archive traversal rejection, V14 stream failure handling, temporary-file identity and restrictive modes.
• Added HTTP, archive, catalog, upload-cleanup, package authorization, restore-safety, and typed archive-failure regression coverage.
• Reconciled tests previously strengthened by PR chore: establish v1.0.0 release readiness gates #21: package-catalog tests now verify missing/unauthorized lookup privacy parity, security diagnostics assert the V14 format metadata, and a new test checks runtime version metadata against VERSION and the versioning policy. The first run exposed that diagnostics did not return the format fields; the implementation was fixed to expose SECURE-PKG-V14 and format version 14.
• Ported the safer V14 package-build cleanup behavior from PR chore: establish v1.0.0 release readiness gates #21: failed builds now verify cleanup, reject symlink/file path ambiguity, and surface cleanup failures instead of silently suppressing filesystem errors; password and pattern zeroization remains in finally.
• Fixed a false-positive restore-safety assertion: the test now accepts only the expected PackageStorageException for an existing destination and verifies that its contents remain unchanged.
• Added a Windows smoke job for locked Composer install/audit, PHP syntax, self-check, source audit, V14 round-trip/restore/archive safety, browser V13 compatibility, and external-trust-root signer verification.
• Added a release-readiness lockfile gate and full regression/security suite to Security and Release Integrity.
• Documented visible package metadata, offline password-and-pattern guessing, sender-authenticity limits, legacy reader policy, and the migration boundary.
• Updated the release QA matrix with the Windows smoke job and a specific stable-format KDF resource-budget gate.
• Kept the stable binary format candidate isolated in PR feat(format): add isolated stable binary package format candidate #38; this PR does not switch the production/default writer to that format.
• No tag or release was created.

Branch reconciliation findings

• PR chore: establish v1.0.0 release readiness gates #21 remains open, draft, and currently reports mergeable=false because its release/v1.0.0-readiness branch is based on stale history. It has not been merged, retargeted, or force-updated.
• This branch is based on current master and is 90 commits ahead, 0 behind (59 changed files; 7,746 additions and 590 deletions). It is the controlled reconciliation path; it does not rewrite or replace PR chore: establish v1.0.0 release readiness gates #21.
• Several old-branch changes already match current master (including PackageDeletionTransaction.php and AuditLogger.php), so they were not duplicated.
• The older V14PackageBuilder.php from PR chore: establish v1.0.0 release readiness gates #21 was not copied because it predates the current per-file key-zeroization finally block. The current VERSIONING.md also contains the more complete stable-format release boundary.
• Useful tests and release gates were selectively carried forward; stale branch history was not merged wholesale.

Compatibility and migration policy

• V14 server packages and browser V13 packages retain separate legacy readers. They are not silently reinterpreted as the stable binary format.
• The stable binary candidate has a fixed version-independent marker and no serialized application/format/schema version field, but remains isolated until reviewed and integrated.
• A converter is not required merely to keep legacy packages readable; a dedicated converter is not currently available. No in-place version-field rewrite or automatic parser fallback is allowed.
• The stable-format KDF profile uses 3 operations and 256 MiB by default (maximum accepted: 4 operations and 256 MiB). Actual target-host latency/peak-memory and concurrent failed-unlock tests remain NOT RUN and are a release blocker.

Validation for latest head

All four PR-triggered workflows passed on code head 7df5584b2d3278b373b43127e382ea543594bde2. The V14 cleanup regression test and its changelog entry are included at latest head 9be19cf0154002813bc464bc35c81b246fb9b6ab. All four workflows passed on this exact head:

• CI, including PHP 8.2/8.3 and Windows smoke
• Security and Release Integrity, including the full regression suite
• Client Security
• V1 Release Gate

The isolated stable-format candidate in PR #38 also passed all four PR-triggered workflows on head b7919d1391e81fa31f330d114d61b1385668ef87:

• CI, including Windows stable-format and compatibility smoke jobs
• Security and Release Integrity
• Client Security
• V1 Release Gate

These are automated checks on the listed exact commits, not evidence of local XAMPP/shared-hosting validation, real-browser accessibility QA, an independent security audit, or verification of a signed release artifact.

Still required before release approval

• Benchmark the stable-format KDF memory/latency profile and concurrent failed unlocks on the actual target host.
• Complete manual Windows/XAMPP filesystem and deployment testing.
• Complete real-browser compatibility and accessibility QA.
• Verify a signed release artifact against an independently distributed trust root.
• Obtain an independent security review of the stable binary format and release candidate.

Do not merge this draft, PR #21, or PR #38 into master without the required review and explicit maintainer approval. Do not create or publish a v1.0.0 tag/release until all required release gates are satisfied.