[Xauele]

phpGH-24280 independent unmodified-base CI control

Fork-only DRAFT / negative control. Do not merge this PR. This branch changes only audit documentation, not PHP source, Zend VM logic, PHPTs, or build configuration.

• Unmodified parent: PHP-8.4 at 6ec698758e50d0356a7befeca6b2bfaffffa15aa.
• Control PR test(audit): unchanged PHP 8.4 control for GH-24280 CI failures #3 head tested: 16bb8787957adefa5dc9a2fc91bbefeed06c1743.
• Patched candidate: #2, 7b5662a162b8ca9a18921cd119f28740a2c3017b.
• Compare unchanged-base Test run 39420291798 with candidate Test run 39050937352.

Independent A/B CI audit (21 Oct 2026)

Gate	Unmodified PHP-8.4 control	Patched candidate #2	Finding
FREEBSD_NTS (FreeBSD 13.5)	FAIL, job 118619342655	FAIL, job 118603459095	Same pkgmir.geo.freebsd.org/FreeBSD:13:amd64/latest catalog Not Found errors, before PHP compilation.
MACOS_ARM64_DEBUG_NTS Tracing JIT	FAIL, job 118619342611	FAIL, job 118603391513	Same ext/zip/tests/oo_torrentzip.phpt test failure: ZipArchive::close(): Internal error, followed by ValueError: Invalid or uninitialized Zip object in getArchiveFlag(4).

Both macOS jobs use the same visible Tracing JIT test invocation (opcache.jit=tracing, opcache.protect_memory=1, opcache.jit_buffer_size=64M, -j2). Each reports exactly one failed test, the same oo_torrentzip.phpt. The FreeBSD jobs both fail during package bootstrap, so neither reaches the PHP patch.

VERIFIED: Both failures are reproducible on the unchanged base. They cannot, by themselves, be attributed to the phpGH-24280 Zend foreach change.

NOT VERIFIED: The underlying macOS ZIP/libzip/JIT root cause; whether every runner environment is otherwise identical; or the absence of unrelated patch regressions on other configurations. The negative control rules out these failures as patch-specific evidence but does not certify the patch.

Decision and outstanding gates

• Control PR test(audit): unchanged PHP 8.4 control for GH-24280 CI failures #3: audit complete, retain Draft, do not merge. The negative control has served its purpose; it is not a PHP bug fix.
• Candidate PR Fix GH-24280: enforce asymmetric setter access in foreach by-reference #2: remains Draft / NO-GO for upstream until independent Zend VM semantic review, hot-path performance assessment, supported-platform/full-suite qualification, and fresh PHP-8.4 rebase/diff audit.
• Do not weaken/remove oo_torrentzip.phpt or FreeBSD tests to manufacture a green matrix. Remediate those environment/ZIP problems separately and repeat the relevant gates.
• Preserve the original tested SHA-to-log evidence. Updating this PR description and its audit comment does not change the source tree or invalidate the existing exact-head control.

This audit distinguishes pre-existing CI failures from proof of functional correctness. One does not imply the other.

[Xauele]

Independent negative control: final A/B result (21 Oct 2026)

Compared the full raw logs for the unmodified PHP-8.4 control (6ec698758e50d0356a7befeca6b2bfaffffa15aa, PR #3 head 16bb8787957adefa5dc9a2fc91bbefeed06c1743) and candidate #2 (7b5662a162b8ca9a18921cd119f28740a2c3017b).

• VERIFIED FreeBSD: control job and candidate job both fail on FreeBSD 13.5 while fetching pkgmir.geo.freebsd.org/FreeBSD:13:amd64/latest (meta.txz, data.pkg, and packagesite all Not Found). Failure occurs before PHP is built.
• VERIFIED macOS: control job and candidate job use the same visible Tracing JIT invocation and each fails exactly one test, ext/zip/tests/oo_torrentzip.phpt, with the same ZipArchive::close(): Internal error followed by ValueError: Invalid or uninitialized Zip object on ZipArchive::getArchiveFlag(4).
• CONCLUSION: both red CI signatures reproduce without the Zend patch. They cannot be treated as patch-specific regression evidence. The precise root cause of the macOS ZIP failure remains UNVERIFIED, as does a complete clean supported-platform matrix.

The control changes no PHP/Zend source or CI configuration. PR #3 remains Draft / no-merge. PR #2 remains NO-GO upstream pending independent semantic review, hot-path benchmark, platform qualification and upstream sync. No tests have been disabled; original exact-SHA run evidence is preserved.

[Xauele]

Fork housekeeping (2026-10-24): archived without merging. Intentional unmodified PHP-8.4 negative control for phpGH-24280. It was evidence-only and never a source patch; archived after the upstream submission. Historical control SHA, Actions and discussion remain accessible. No branch, commit, test evidence, or upstream submission deleted.