[nahime0]

Prepare the approved 0.27.4 changelog for 2026-10-21, with 46 user-facing entries and updated comparison links. The source audit reconciles all 510 commits from v0.27.3 through main 3c39673c06606f4b381df4c1cedca7b9deeb2a4b: 54 merged PRs and eight direct integrations, with no unresolved sources. All previous 45 release bullets are preserved.

Align compiler, runtime, parser, optimization and PDO documentation plus the roadmap with shipped behavior, including native testing and post-autoload prelude order. Remove 46 completed or superseded plans, merge the two Core logs and condense the active backlogs. Keep the 12 historical PHP reproducers, iOS working specification and newly merged native-testing plan. Retain reachable Git history for retired plans and temporary release records. Rust/PHP source and test edits change comments only.

The earlier 43-integration audit remains in Git history. These nineteen additional integrations complete the current 62-row source ledger:

Source	Decision	Release outcome
#901	Covered	PHP strip_tags() on AOT and eval, with string/array allow-lists.
#1904	Covered	Explicit C integer widths; breaking migration: C int/unsigned declarations use i32/u32, while int/i64 preserve 64 bits.
#1909	Covered	f32 extern function parameters/returns, the f64 alias and four f32/f64 pointer builtins on AOT/eval.
#1696	Covered	Lexical property/parameter defaults, lazy catchable errors, Reflection and eval metadata.
#1913	Covered	Guarded, budgeted native-catalog deferral for short numeric dynamic eval.
#1910	Covered	Avoid redundant heap free-list tail scans.
#1911	Covered	Borrow constant integer operands for boxed arithmetic.
#1926	Covered	Keep JSON integer-array prefixes packed until widening is required.
#1930	Covered	Reuse unique unresolved mbstring string origins.
ad7d3423354cb37f6eeb03356b4d4341dcdd13d4	Omit	Generated repository statistics and benchmark data, with no new release behavior claim.
#1903	Covered	Native elephc test: Composer test autoloading, assertion subset, data providers, per-test process isolation and timeouts, filtering and JUnit reports.
09c634061ae4b68335066fcb56d6764e26a024b8	Covered	Add the temporary signing keychain to the search list and restore the original list; completes the existing signing/notarization release feature.
#1943	Covered	Reduce compilation work and generated code for literal eval using reachable declarations and builtin surfaces, with conservative fallback for runtime sources and dynamic hazards. CI archives, caches, fixture bundles and shard balancing stay internal.
487cae6abc7d98c1f16bb99042e491bb8a32e27b	Omit	Internal nextest JUnit upload-path correction.
#1876	Covered	Preserve packed-array copies when array_unshift mutates through references, including growth and multiple prepended values.
#1710	Covered	Static array prefix updates and nested array writes: COW, key/RHS order, missing parents, false-conversion diagnostics, throwing handlers and ArrayAccess child append dispatch.
#1945	Omit	Security reporting policy, scanner recipe and threat model. Repository process setup; no compiler fix, successful enrollment or completed scan is claimed.
#1674	Covered	Enum trait constants, Reflection order and method contracts; selected enum interface argument binding and compatible reference returns; boxed iterable and reference-rebinding ownership; stream notification callback provenance. Preserves unsupported dynamic-descriptor and incompatible-reference-layout diagnostics.
#1954	Include	Security: update webpki-roots to 1.0.10 and rustls-webpki to 0.103.16, remove the affected 0.26 roots wrapper and address RUSTSEC-2026-0381 / RUSTSEC-2026-0382 for distrusted emSign certificate paths. The requested release prerequisite is merged and included.

The complete classification is 49 covered sources, one newly included Security PR, and twelve omitted sources. No release outcome needs a decision. The complete source/test-backed 62-row semantic ledger is also retained in Code Journal document 53bbcdba.

Validation for this refresh: GitHub-verified full source reconciliation, inspection of the final merged PR1954 manifest/lockfile diff and both primary RustSec advisories. All nineteen preparation commits rebased onto main 3c39673c06606f4b381df4c1cedca7b9deeb2a4b without conflicts; range-diff confirms identical patches. Static checks confirm all previous 45 notes in order, 46 current release entries, unchanged older releases/comparison links, empty Unreleased, October 21 date, 41 relative plan links, reachable retired-record history, comment-only changes in all eleven Rust/PHP files, TOML parsing and exactly one patched roots/verifier lock entry, and git diff --check. The earlier Greptile fixes are preserved. No tests, behavioral probes, examples, benchmarks or builds were run for this refresh, honoring the explicit no-test request. Previous build/review results and the RustSec failure belong to earlier dependency snapshots; fresh review/check results must match the new head 1c7bd470d6015785e08fd83da85052d25f81f93e.

Greptile follow-up: corrected the PhpStorm proposal to match SourceMode::strict_php_is_effective(): .lfc remains extension-enabled even with --strict-php, which restricts only physical PHP-mode files. Verified against src/source.rs, the existing strict-mode regression source and the CLI reference; git diff --check passes. No tests or builds were run.

[greptile-apps]

Confidence Score: 5/5

[Low impact] This documentation and comment-only PR appears safe to merge.

Summary

Prepares the 0.27.4 release notes and consolidates completed plans into a smaller active backlog.

• The changelog now records the approved 0.27.4 release.
• The plans folder now separates current follow-up work from retired records.
• Compiler and runtime docs now describe the shipped behavior.
• Compiler comments now point to permanent documentation.

_{Reviews (8) · Last reviewed commit: "docs(release): include tls security upda..." · Reviewed by Greptile}