The roadmap took the framework from working to compliant with its six
principles. What remained in it was not a sequence anyone would follow —
it was a list of decisions already taken, kept in a file whose whole
premise was that the work was unfinished. Reading it told you about the
project rather than about the code.

The decisions that still shape the source moved into the guides, where
they are read before making a change rather than browsed. Everything else
was history, and git holds that.

Sessions are not being extracted into their own package. The split was the
roadmap's last open item and it would decouple nothing: every reference to
Session or CsrfToken outside framework/Sessions and VerifyCsrfToken is a
comment. The seam already carries the relationship, and an application
that leaves the middleware out of routes/middleware.php boots with no
session and no cookie today. PHP autoloads lazily, so the 311 lines cost
an application that never composes them nothing at all. What a split adds
is a repository, a Packagist entry and a version constraint to keep in
step, and cross-repo coordination is where this project's mistakes happen.

The one real argument for it was diagnostic — you cannot tell whether the
seam is enough for somebody else's package until something is one — and
that is answered more cheaply by fixing what it would have found. The
first is already known and is now written down in framework.md:
Console::registerCommands() globs core's Commands directory and the
application's, so a package can ship middleware but cannot ship a console
command, and nothing reports the absence.

releasing.md gains one line of hard-won advice: a patch can still break
something. v0.10.1 silently dropped readonly from Response because an
unrelated edit was in the working tree when it was staged.

No source changed.