v0.10.0

Changed

• Represent unavailable observer transaction depth as null and deliver the
  statement notification when only that optional metadata inspection fails.
• Reject structured row-locked child queries before derived-source or IN/
  NOT IN attachment, preventing execution without the parent's transaction guard.

Fixed

• Infer QueryBuilder for untyped when() and unless() callback parameters
  in consumer static analysis without changing callback execution semantics.
• Quarantine the owner and preserve structured transaction-state evidence when
  the active-transaction check for a locking read cannot be inspected.
• Attempt statement cleanup when cursor binding or execution fails before
  handoff, preserving the original failure and cursor ownership rules.

v0.9.0

Fixed

• Release unused closed or discarded connection wrappers without waiting for
  cyclic garbage collection; retained queries and cursors still keep their owner.
• Validate complete SQL and ordered typed bindings in compiler benchmark digests,
  and measure associative key allocation on every simulated row.
• Reject aliased and wildcard identifier objects in column clauses before
  producing invalid SQL, matching structured string validation.
• Preserve successful generated-ID inserts when optional affected-row metadata
  cannot be collected for observation.
• Preserve finite float binding values independently of PHP's precision settings
  using locale-independent, round-trippable decimal strings.
• Prevent cloning connections and cursors from duplicating ownership of PDO,
  transaction state, and active statements.
• Avoid PHP 8.5 deprecation warnings from MySQL-specific PDO constants during
  MariaDB/MySQL connection setup and validation, retaining PHP 8.2 compatibility.
• Measure soak retained growth from PHP used memory instead of reserved
  arena chunks, so a normal 2 MiB arena increment no longer fails the soak
  memory gate as apparent retained growth.

v0.8.1

Fixed

• Reduce the per-row cursor discarded-connection guard to a shared internal
  lifecycle-state read, removing the v0.8.0 streaming-cursor benchmark cost
  while preserving the failure before the next fetch after a discarded
  connection.

v0.8.0

Added

• Add explicit connection lifecycle inspection (isClosed(), isReusable())
  and terminal discard() for application-owned recovery, with stale-query,
  cursor, and managed-transaction safeguards and no automatic reconnect or replay.
• Add normalized ConnectionException evidence (operation, sqlState,
  driverCode, driver, connectionLabel) for connection construction
  failures and closed/compiler-only misuse, without retaining the raw
  PDOException, driver message, or trace.
• Add an executable framework-free worker request lifecycle example with
  lazy per-role acquisition, pinned owners, monotonic idle boundaries, session
  initialization and restoration, eviction isolation, bounded counters, and
  finally cleanup.
• Add a direct MariaDB/MySQL session-hygiene probe covering session-scoped
  statement limits, functional restoration, replacement reinitialization, idle
  and lock inputs, observation boundaries, and acquisition cost.

Changed

• Normalize missing or malformed PDO errorInfo and integer exception codes
  consistently for connection construction and query execution failures, and
  mark the Connection::connect() DSN parameter #[SensitiveParameter].
• Document the framework-free worker recipe and FrankenPHP worker-loop mapping,
  session initialization and restoration, engine-specific timeout boundaries,
  per-role eviction, and application-owned lifecycle counters.
• Record the 0.8 lifecycle observation decision: lifecycle counters remain
  application-owned and no lifecycle observer is added.
• Validate min()/max() scalar returns and declare int|float|string|null,
  aligning them with sum()/average(); an unsupported driver scalar now
  throws QueryExecutionException and ADR-006 records the amendment.
• Document demonstrated write-interoperability pitfalls with executable
  fixtures and a direct-engine probe: raw vendor upsert and ignored-duplicate
  generated-ID behavior, boolean adapter ambiguity, chunk atomicity, and
  duplicate-submission reconciliation.
• Record the D5 decision to retain the transaction ownership guard and
  inspection cost, with controlled control-count tests, direct-engine component
  timings, and a paired v0.7.0 comparison (ADR-008 amended).

v0.7.0

Changed

• Clarify that trusted raw SQL literals and retained exception chains may contain sensitive diagnostics.
• Record hosted candidate source provenance, the required remote CI result, and
  clarify that soak retained growth is measured per operation across timed
  samples.
• Recertify retained database and proxy fixtures across prepare/buffering modes, and add actual SQLite 3.39.2 execution with explicit upstream-maintenance guidance.
• Reuse required affected-row counts and avoid generated-ID metadata reads when observation is disabled, preserving write and failure semantics.
• Retain contextual eager and cursor row validation after review, avoiding an additional per-row error-factory interface.
• Centralize raw binding-list validation while retaining contextual diagnostics and validation order; bounded comparisons showed no repeatable actionable regression.
• Attempt ordinary statement cleanup once while preserving existing result, exception, observation and quarantine policies.
• Align active benchmark comparisons and changelog links with immutable v0.6.0.
• Bound the next release to correctness, existing resource contracts and retained
  compatibility targets, with independently validated delivery tasks.

Fixed

• Allow a well-defined plan-free post-release state and a previous-release
  benchmark baseline at release finalization, while stale development baselines,
  missing evidence-index release facts, and repeated workflow artifact labels
  still fail.
• Refactor release tooling, fixture registries and three condition guards
  for code health without behavior changes, with documented rule exceptions
  for certification tooling and fixture registries.
• Reject symbolic links disguised as ZIP directories during artifact certification.
• Pin the CI branch-coverage lane to stable Xdebug 3.5.3 so PHP 8.5 does not
  install an alpha coverage driver that misreports branch coverage.
• Fail benchmark comparisons only on repeatable candidate-operation regressions,
  retain direct-PDO and component control movement as non-blocking attribution
  evidence, and upload reports from failed comparison runs.
• Reject orphaned typed compiler cases that no feature manifest entry references.
• Reject missing, malformed and stale release facts, with an explicit published-version input for independent provenance checks.
• Reject failed SQLite busy-timeout reads instead of accepting them as a declared zero timeout.
• Preserve original callback exceptions when transaction-state inspection fails during recovery or rollback verification.
• Reject malformed named raw conditions and joins instead of silently discarding supplied operands.

Added

• Record local candidate quality, coverage, compatibility, artifact, security
  and required remote CI evidence.
• Certify Composer and Git archives with explicit contents, contamination checks, size budgets and independent no-dev installed consumers in CI.
• Cover combined bind/execute and cleanup failures, and verify eight selected binding, lifecycle and observation faults are detected by regressions.
• Validate complete typed compiler fixtures against executable case registries and per-dialect feature references, including explicit unsupported cases.
• Characterize caller-owned LOB streams in SQLite tests and execution probes, with guidance on position, reuse and structural snapshots.

v0.6.0

Added

• Add attributable compiler, hydration, execution-cleanup, observer, and
  result-memory benchmarks with dimensional and component controls, fresh-worker
  transient-allocation/RSS samples, and live buffered/unbuffered engine and
  proxy comparisons.
• Add a deterministic release-consistency check for active plans, support and
  security policies, benchmark baseline labels, maintained commands, and
  configuration paths.
• Add a data-driven connection state-transition matrix covering clean, active
  cursor, transaction, quarantine, and closed lifecycle paths.
• Add an automated clean no-dev consumer lifecycle test suite covering
  connection, compilation, read/write/aggregate terminals, streaming cursors,
  savepoint transactions, and safe failure diagnostics.
• Add a concise terminal choice decision matrix and driver caveats to the results
  and writes guide.
• Add an exception troubleshooting matrix mapping all error classes to safe
  application remediation actions and redaction guarantees in the public API
  reference.
• Add guidance on engine parameter limits, packet ceilings, buffered versus
  unbuffered cursor streaming, and deterministic pagination ordering.

Changed

• Compare benchmark candidates with immutable v0.5.0 in both source orders
  using generic artifacts and repeated identical-source noise controls, so
  sub-millisecond percentages and within-control variance are not actionable.
• Reduce transient allocation for high-cardinality IN and batch-insert
  compilation by removing placeholder, row-group, and validated-binding list
  intermediates while preserving SQL and binding contracts.
• Reduce associative hydration's per-row validation allocation by iterating
  fetched keys in place while preserving duplicate-column behavior,
  numeric-column rejection, and result shapes.
• Remove retired CodeScene duplication gate rules and synchronize support
  policy baseline references with the 0.6 release line.

v0.5.0

Added

• Add QueryBuilder::when(), unless(), and strict 1-based forPage() helpers for conditional clauses and deterministic limit/offset pagination.

Changed

• Reduce hot-path allocations in default projection compilation, automatic binding normalization, compilation snapshots, and object hydration without changing SQL, binding order, or result contracts.

Removed

• Remove development-only Pixie migration automation and the 0.4-specific duplication gate; historical migration and quality evidence remains archived.

v0.4.0

Added

• Add code duplication gate (composer duplication:check) integrated into composer check to detect golden SQL/fixture ID duplicates, duplicate test names, and hotspot regressions.
• Add multiprocess SQLite write-contention probe (composer probe:sqlite:contention) testing concurrent WAL database transactions, SQLITE_BUSY surfacing, busy-timeout blocking, and 4-process write safety.
• Add memory-stability soak scenarios for streaming cursors and batch writes, per-sample allocation metrics, and a 256 KiB retained-allocation memory gate.
• Add hot-path benchmark scenarios (compile_allocation and terminal_reuse) and automated paired v0.3.0 baseline comparisons in CI.
• Record v0.3.0 baseline manifest, duplication/complexity inventory, performance/stability evidence, and ADR-015 for PHP 8.2+ attribute floor policy.

Changed

• Consolidate MySQL and MariaDB dialect compilers behind a shared @internal MySqlFamilyCompiler base.
• Unify clause condition construction into a single BuildsConditions dispatcher for where() and having().
• Centralize insert(), insertMany(), update(), and delete() write compilation and state validation in AbstractDialectCompiler.
• Extract connection lifecycle, DSN validation, and PDO options into @internal ConnectionProfile.
• Replace func_num_args() overload dispatch with explicit sentinel defaults (MISSING sentinel enum) and variadic catch-alls across clause methods, exposing reflection defaults while preserving exact where('col', null) behavior.
• Replace magic strings in AST internal state with closed enums (LockMode, LockModifier, JoinType).
• Reuse stateless dialect compilers and executors per Connection instance via @internal compilerForQueryBuilding() and executorForQueryBuilding() accessors, cutting compilation and terminal allocations.
• Shallow-clone condition and join state during query compilation snapshots (QueryState::copyForCompilation()), optimizing hot-path aggregate rewrites.
• Data-drive dialect golden assertions via JSON fixtures (tests/Fixtures/Compiler/*.json) and consolidate PDOStatement test doubles into ConfigurableStatement.
• Formalize PHP 8.2 runtime floor checks in composer check with check-platform-reqs, PHP linting, and PHPStan analysis floors.

v0.3.0

Added

• Add canonical 0.3.0 query, transaction, streaming, batching, migration, upgrade, and API guidance, plus CI-executed SQLite examples for early cursor cleanup and application-owned batch/atomicity policy.
• Add release-candidate evidence for local quality and coverage, clean no-dev installation, minimum/current direct and proxy probes, path-redacted consumer validation, security review, and the remaining deployment gate.
• Add correctness-gated production-shaped compiler, report hydration/cursor, logical count, batch write, and SQLite query-plan benchmark evidence.
• Add generic baseline/candidate comparison labels, operation-level median change review signals, and paired v0.2.0 release-candidate measurements.
• Add a deterministic reflection-based public API signature manifest and composer check gates for unreviewed contract drift and broken relative documentation links.
• Add an architecture and code-quality audit covering the @internal public seam, core responsibility hotspots, extraction decisions, style rules, and focused condition, transaction, exception, cursor, and connection-state tests.
• Extend the independent PHPStan level-9 consumer with production-shaped model construction, mutable query helpers, generated IDs, managed transactions, callbacks, raw-expression overloads, generic cursors, and exception evidence.
• Add transaction-classification and exception-ergonomics evidence, ADR-020, supported-PHP SQLite immediate probes, and application-owned immediate-transaction and lock-conflict recipes without retry claims.
• Add trusted expression-to-bound-value comparisons across WHERE, nested condition groups, HAVING, and value-oriented joins while retaining ordered positional bindings and established null semantics.
• Add explicit whereColumn() and orWhereColumn() identifier comparisons, plus join comparisons with exactly one trusted expression operand.
• Add an expression-comparison ADR, projection-ergonomics decision record, index-friendly date-range guidance, all-dialect binding-order coverage, SQLite execution coverage, and direct MariaDB/MySQL probe coverage.
• Add a deterministic, read-only SimpleQuery adoption audit with path-redacted findings for clauses, result terminals, raw-expression contexts, generated-ID timing, direct PDO, transaction ownership, dynamic identifiers, batching, and streaming.
• Add a production-shaped synthetic adoption corpus, a required migration review report, an anonymized first-production-migration evidence record, and a reproducible v0.2.0 source/query/coverage/benchmark baseline.

Changed

• Reuse one private associative-row validator across full and first-result execution while preserving result, exception, SQL, and binding behavior.
• Add low-noise import and comparison consistency rules without a style baseline or broad formatting churn.
• Move pinned checkout and artifact-upload CI actions to their Node.js 24 releases, removing runner deprecation annotations.
• Require PDO to report physical activity immediately after every managed transaction begin, and retain direct PDO ownership for schema control, manually started work, SQLite immediate transactions, and deployment-specific exception classification.
• Extend the public API and independent level-9 consumer contract with the accepted expression and column comparison overloads; retain variadic select() instead of adding a SQL-list parser or parallel projection API.
• Reorganize documentation into guides, reference, maintainer operations, active plans, ADRs, and evidence; remove completed roadmap and release-plan documents, and add the evidence-gated 0.3.0 development plan.

v0.2.0

Added

• Add an independent level-9 external-consumer PHPStan fixture for callback, positional-binding, and generic cursor inference.
• Add executable null-containing list, oversized integer string, duplicate/numeric result-column, cursor-observation, connection-policy, and public value-boundary tests.
• Add a required Xdebug branch/path coverage job and minimum/current MariaDB 11.8 and MySQL 8.0 direct-engine fixture matrix.
• Add a dependency-free, fresh-process benchmark runner with explicit setup, warm-up, correctness digests, alternating direct-PDO controls, raw samples, source/runtime/PDO metadata, PHP memory peaks, process RSS, and retained memory/file-descriptor deltas.
• Add executable compiler-shape, hydration/cursor, observer, batch, terminal, transaction, lifecycle, migration, live direct/proxy, and multiprocess-soak scenarios, plus an identical-runner v0.1.0 comparison.
• Archive deterministic SQLite benchmark reports in pull-request CI and live engine/proxy/soak reports in scheduled and release workflows.

Changed

• Publish positional bindings as lists, infer typed join/condition callbacks, and expose object/associative cursor row types through PHPDoc generics.
• Validate consumer-constructed CompiledQuery binding members and QueryExecution parameter types and numeric metadata at runtime.
• Make configured branch thresholds fail when Clover omits branch metrics; retain PCOV as the separate fast line-coverage gate.
• Reduce associative full-result peak memory by validating rows in a one-pass fetch loop, and avoid copying already-validated associative cursor rows.
• Add paired source-order hydration comparison and realistic observer binding-count/profile commands to the maintained performance harness.
• Replace the legacy benchmark scripts and overstated planned matrix with the exact schema-version-2 executable scenario and artifact contract.
• sum(), average(), min(), and max() now reject distinct(), GROUP BY, and HAVING query shapes with UnsupportedFeatureException; use count() for supported logical grouped/distinct counts or select grouped aggregate rows explicitly.
• Managed transaction startup now verifies physical inactivity after a failed begin, and uncertain nested savepoint creation quarantines the connection.

Fixed

• Prevent non-count scalar aggregates from silently returning the first value of a multi-row grouped aggregate result.
• Treat a false or throwing PDOStatement::closeCursor() as uncertain connection state, quarantine the connection, and preserve an earlier fetch/result failure as the primary exception when cleanup also fails.