Release v1.1.0: fix examples 005-SessionsWeb AOT smoke (GET flash missing; PHPSESSID=/index.php; re-#23848)

[PurHur]

Category

Regression: · AOT session / CGI · release blocker · Pillar 2 (Ship)

Problem

./script/release-readiness.sh --full --json fails on examples-aot-smoke for 005-SessionsWeb. Build links; the two-request flash ladder fails at GET flash (Flash: Saved missing). Distinct from prior #23427 (heap abort) and #23848 (static-call link guard).

Observed on master @ 83260f552 during 2026-08-01 release-manager --full probe. Quick readiness stays 7/7 green; examples-web-smoke is OK — AOT execute path only.

Repro table (exact smoke CGI env)

Step	Result (2026-08-01)
phpc build --project examples/005-SessionsWeb	✅ links
GET empty	✅ body has No flash message yet
Set-Cookie	🔴 PHPSESSID=/index.php (path leaked into sid)
session file	🔴 empty sess_indexphp under PHP_COMPILER_SESSION_DIR
POST message=Saved	🔴 empty stdout (exit 0)
GET flash	🔴 still No flash message yet — missing Flash: Saved

examples-aot-smoke: 005-SessionsWeb: GET flash failed

Prior art

• Release v1.1.0: fix examples 005-SessionsWeb AOT smoke (POST flash exit 134 free(): invalid pointer) #23427 (closed): POST flash exit 134 free(): invalid pointer
• Release v1.1.0: fix examples 005-SessionsWeb AOT smoke (Static call class must be a literal; re-#23427) #23848 (closed): link-time Static call class must be a literal
• Smoke must not skip: real session id + flash round-trip (Testing: 005-SessionsWeb AOT link + two-request CGI execute smoke #1891)

Repro

./script/docker-exec.sh -- bash -lc 'EXAMPLES_AOT_SMOKE_ONLY=005 ./script/examples-aot-smoke.sh'
# or full gate:
./script/docker-exec.sh -- bash -lc './script/release-readiness.sh --full --json'

Exact CGI (after phpc build --project examples/005-SessionsWeb):

PHP_COMPILER_SESSION_DIR=$tmpdir REQUEST_METHOD=GET SCRIPT_NAME=/example.php REQUEST_URI=/example.php \
  ./examples/005-SessionsWeb/.phpc/bin/app
# observe: Set-Cookie: PHPSESSID=/index.php

Done when

• Session cookie is a real PHPSESSID (not a path like /index.php)
• POST then GET flash prints Flash: Saved
• EXAMPLES_AOT_SMOKE_ONLY=005 ./script/examples-aot-smoke.sh exits 0
• ./script/release-readiness.sh --full --json → examples-aot-smoke ok (absent unrelated failures)
• Root cause is real lowering/session fix (not smoke-script shortcut)

Tracker

• Roadmap: 🗺️ ROADMAP: Self-host + web-capable PHP subset (living) #78 · Strategy: Strategic alignment: compiler excellence pillars (2026 H2) #10533 Pillar 2
• Prior: Release v1.1.0: fix examples 005-SessionsWeb AOT smoke (Static call class must be a literal; re-#23427) #23848 / Release v1.1.0: fix examples 005-SessionsWeb AOT smoke (POST flash exit 134 free(): invalid pointer) #23427 (closed) · re-spin

[PurHur]

claim: Worker lane C (Composer) — starting this run

Pre-claim gates (2026-08-01):

• docker info: ok
• bootstrap-inventory --check: construct-flag drift on lib/VM.php (588 vs 589 methods) — not a missing-file inventory fail
• release-readiness --json: still running at claim time
• Lane C pick: Release v1.1.0: fix examples 005-SessionsWeb AOT smoke (GET flash missing; PHPSESSID=/index.php; re-#23848) #26411 (IMPORTANT + release-blocker; issue % 3 == 2); no open PR / no prior claim