PHP SDK 3.4.0

Ordinary control calls now have a configurable total HTTP deadline with a 60-second default. Configure Client(requestTimeoutSeconds:) or the framework request_timeout_seconds setting. Typed request_timeout errors retain signal/update failure types and never automatically resubmit an ambiguous mutation.

Owned no-cURL control requests use mature HTTP_Request2 with one deadline across connect, verified CONNECT/TLS, headers and body. PHP8.1, Guzzle7/8, PSR-message1/2 and HTTP-only installation without OpenSSL remain supported. Existing proxy environment selection, NO_PROXY, CA/hostname verification and authentication remain covered; HTTPS-scheme proxies retain the prior native support boundary. Injected clients keep their configured policies. Worker, lease/heartbeat and payload budgets remain separate.

Validation includes supported PHP/framework CI, PHPStan, Sonar/CodeQL, replay/corpus and dependency/security-floor checks; real stalled/slow-header/body, TLS/proxy, framing, authentication, injected-client, HTTP-only and mutation controls. See #203 and #209 for exact qualification and package receipts. Waterline configuration, browser/error handling and Retry follow-through remain separate.