v1.81.0 - Alnair

[1.81.0] - 2026-09-06 — Alnair

Fixed

• Boot no longer writes /tmp/boot_profile.log on every request: the boot profiler's
  phase-breakdown dump is now opt-in via BOOT_PROFILE_LOG (true for a per-user file under
  the system temp directory, or an explicit path) and is best-effort — a dump that cannot be
  written is skipped, never surfaced. Previously every boot wrote a hard-coded shared path
  unconditionally, so on any host where a second OS user (a second site, or a CLI run as root
  followed by one as the site user) had created the file first, the denied write became a
  fatal ErrorException under the framework's error handler and no command — including
  first-run provisioning — could boot.
• SessionCleanupJob logs what was actually removed: the completion log read a
  cleaned_count key the task never returns, so every run reported zero sessions cleaned.
  It now totals the task's four per-category counts. Surfaced by PHPStan 2.2.13's precise
  array-shape inference, which also retired three redundant guards in
  PasswordHasher::getInfo().

Upgrade Notes

• /tmp/boot_profile.log is no longer written. Nothing depends on it inside the framework;
  if external tooling tailed that file, set BOOT_PROFILE_LOG=/tmp/boot_profile.log to keep
  it, or BOOT_PROFILE_LOG=true for a per-user file under the system temp directory. The
  structured boot summary still reaches the framework logger exactly as before.