v0.0.39

• hyper adopts kit 0.0.105, which removed the time limits of run-tests (kit K1175), passes no --timeout to run-tests, and takes template 0.0.26 and php-serialize 0.0.6 in every manifest and lock (H27.106).

v0.0.38

• hyper takes php-serialize 0.0.5 and template 0.0.24 in every manifest and lock (H27.104).

• The repository adopts kit 0.0.103, which keeps the output, errors and failures that kit used to drop silently (kit K1136–K1165) (H27.103).

• docs/operations/dependencies.md states the template requirement 0.0.23, the development links of .links and make link, the kit release v0.0.102, and the exact pin min-0-max/json-schema 2.6.0-p2 with its source, reason and removal condition (H27.88-1).

• docs/operations/dependencies.md states the PHP dependency of polyspec/template 0.0.23 that composer.lock records: min-0-max/json-schema v2.6.0-p2 from the VCS repository of the fork, not opis/json-schema from Packagist (H27.88).

v0.0.37

• Release 0.0.37 after H27.100 and H27.101: every manifest of config/release.json, the exact requirements of polyspec/hyper-server and @polyspec/hyper-client and the locks that npm, Composer and uv wrote hold 0.0.37 (H27.102).
• docs/spec/protocol.ko.md carries the revision of its source, which H27.91 changed in both languages (H27.101).
• hyper takes the latest releases of its providers, php-serialize 0.0.4 and template 0.0.23: the npm, Composer and uv manifests and locks name their release URLs and digests (H27.100).

v0.0.36

• Release 0.0.36 after H27.98: every manifest of config/release.json, the exact requirements of polyspec/hyper-server and @polyspec/hyper-client and the locks that npm, Composer and uv wrote hold 0.0.36 (H27.99).
• hyper adopts kit 0.0.102, whose uv-install puts back the provider links when its install fails; no recipe line changes (H27.98).

v0.0.35

• Release 0.0.35 after H27.96: every manifest of config/release.json, the exact requirements of polyspec/hyper-server and @polyspec/hyper-client and the locks that npm, Composer and uv wrote hold 0.0.35; the tag v0.0.34 has no release, since its release run failed in release-tools (H27.97).
• The release installs its tools with the Composer home and cache of install-tools, so the PHP lint that release-prepare installed there with its allowed plugin installs again without Composer refusing that plugin as global (H27.96).

v0.0.33

• Release 0.0.33 after H27.86: every manifest of config/release.json, the exact requirements of polyspec/hyper-server and @polyspec/hyper-client and the locks that npm, Composer and uv wrote hold 0.0.33 (H27.87).
• hyper takes the latest releases of its providers, php-serialize 0.0.2 and template 0.0.21: the npm, Composer and uv manifests and locks name their release URLs and digests, and the packages build, client and server/ts require them by version (H27.86).

v0.0.32

• make lint-php runs phpstan.dist.neon on packages/server/php again: kit 0.0.98 reads the phpstan.neon of a package folder first, so the level max configuration of make analyse-php is named phpstan-max.neon (H27.85).
• Release 0.0.32 after H27.81, H27.82 and H27.83: every manifest of config/release.json, the exact requirements of polyspec/hyper-server and @polyspec/hyper-client and the locks that npm, Composer and uv wrote hold 0.0.32 (H27.84).
• hyper supports kit 0.0.98, which includes no recipe, sets no setting of another tool and writes no copy into a repository: the Makefile includes no file of kit and holds every target that its recipes and workflows run, each running a utility of the installed kit with explicit arguments; mise.toml states the settings of mise and uv, .npmrc and tests/package-install/.npmrc state allow-remote, and knip.json, .oxlintrc.json, ruff.toml, phpcs.xml.dist and phpstan.dist.neon state the lint rules; the entry gates of ci.yml runs the checkers of kit in place of the copy ci-pipeline.yml; release.yml and the bootstrap action are files of hyper; the copies .githooks, .claude/settings.json, config/ci.json, config/cargo.schema.json and config/pyproject.schema.json are removed; PRINCIPLES is kit's copy whose Enforced by lines name the checks that hyper runs, the entry gates also runs make rules-check, and make check and the tests rely on no FINAL_RUN, ci-only refusal or Claude Code hook (H27.83).
• Both Composer roots require the json-schema fork by its release 2.6.0-p2 in place of its branch polyspec-origin-2.6.0, and hyper adopts kit 0.0.95, whose PRINCIPLES leave the rule of forks to the FORK.md of each fork and the manifest and lock of each root (H27.82).
• docs/operations/deployment.md states that a persistent connection of phpredis verifies the TLS certificate only when it opens, so a changed CA applies after php-fpm reloads, and that a running worker does not detect a wrong CA (H27.81).

v0.0.31

• Release 0.0.31 after H27.79: every manifest of config/release.json, the exact requirements of polyspec/hyper-server and @polyspec/hyper-client and the locks that npm, Composer and uv wrote hold 0.0.31 (H27.80).
• A PHP request that cannot reach the Redis server no longer replaces the session cookie of the client: with a lost connection the session handler of phpredis fails to validate the identifier, so PHP queued the cookie of a new identifier before the read failed, and the answer of status 500 carried it, which ended the session and refused the next form with status 403. A session that cannot start now withdraws that cookie, and tests read the cookie of each answer of status 500 on the three servers (H27.79).

v0.0.30

• Release 0.0.30 after H26.9 and H27.77: every manifest of config/release.json, the exact requirements of polyspec/hyper-server and @polyspec/hyper-client and the locks that npm, Composer and uv wrote hold 0.0.30 (H27.78).
• A Python server on Redis Sentinel no longer splits a session after a promotion: the setup option of RedisSessions asks Sentinel before the first command of a request that has a session, where a pooled connection of redis-py stayed on the former primary, which accepts writes until it becomes a replica, and answered status 403 for the sessions of the new primary. A test promotes the replica while the primary runs and shares new sessions across the three servers in that window (H27.77).
• docs/operations/benchmark.md holds the record of two runs of .github/workflows/bench.yml on PHP 8.4.27 in place of the PHP 8.5.10 record of 2026-10-02: the native extension of template 0.0.20 renders 1,000 rows in 29.6 ms and the generated program in 15.2 ms, and the SSR script and the CSR shell exceed their size limits (H26.9).
• make bench-server builds the assets, which a clean checkout lacked, so every request answered status 500; the server benchmark fails when a request answers another status than the one it measures (H26.9-2).
• .github/workflows/bench.yml runs make bench and make bench-sessions one after another in one job on a manual run and uploads the report of each target, outside the checks and the release. The server benchmark sends a CSRF token with POST /board/create, so the request answers status 422, and the browser benchmark prints page errors, console errors and failed requests (H26.9-1).

v0.0.29

• Release 0.0.29 after H27.72, H27.73, H27.74 and H27.76: every manifest of config/release.json, the exact requirements of polyspec/hyper-server and @polyspec/hyper-client and the locks that npm, Composer and uv wrote hold 0.0.29 (H27.75).
• A Node or Python request that changed nothing in a Redis session sets its new expiry without comparing the lock, as phpredis does, so a long request that only reads no longer answers status 500 when its lock expires; tests check a lock that really expires, a killed process, the HTTP servers of the board and a stop and a start of the Redis server (H27.72).
• The Redis sessions hold on a primary with replicas: RedisSentinelSessions and the sessionSetup option of App::open let the PHP server keep the session module of phpredis on the primary that Redis Sentinel names, the Node and Python servers follow it through a Sentinel client, and tests kill the primary under the three servers; the connections take TLS and an ACL user, also with Sentinel, and make bench-sessions measures the capacity of one Redis server (H27.73).
• The Redis sessions hold on Redis Cluster with their locks: RedisClusterSessions gives the PHP server the protocol of HY-115, which the rediscluster handler of phpredis lacks, and tests run the three servers on a real cluster of three primaries while a slot moves, through lock failures, a renewal, the HTTP servers, a replica that takes over, TLS and an ACL user (H27.74).
• Adopt kit 0.0.93, whose ci-setup installs the PHP symbol extractor, so the shared CI pipeline names no language (H27.76).