git:20260906.35b18c4 to git:20260906.955ea6a

- - **Widening one parameter to `?T` obliges auditing every call site that forwards the same value.** The sibling call downstream still declares `string`, and `null` throws a `TypeError` there -- including in a file with no `declare(strict_types=1)`, because coercive mode coerces between scalars and never coerces `null` into one. The PHP 8.1 "passing null to parameter of type string is deprecated" behaviour is internal-functions-only; user functions have thrown on `null` since PHP 7.0. So "no strict_types, it'll coerce" is not a safety net, and the crash lands on the exact null-input case the widening was for. The mode is decided by the file the CALL is written in, never by the file declaring the callee, so "the callee declares strict types, therefore this 500s" is a phantom -- read the caller's first lines. Where the caller is coercive the boundary silently coerces instead of throwing (an object carrying `__toString()` becomes a string), and the follow-up question is whether that string is usable downstream. `php -r` is coercive; adding `declare(strict_types=1);` to the snippet reproduces a strict caller.

- - **`#[Scoped]` resets in exactly one place in the framework: the queue worker, between jobs.** `forgetScopedInstances()` has a single caller, so under PHP-FPM `#[Scoped]` and `#[Singleton]` are indistinguishable (a fresh container per request resets everything anyway) and Octane does not reset it on the HTTP path unless the app wires it. None of the reset points is a database transaction boundary: a scoped service that fills a memo from rows written inside `DB::transaction()` keeps that memo after the rollback, for the rest of the request or job. Lazy invalidation (`unset` the key, re-query on the next read) is rollback-safe by construction; converting it to a write-through refill as an optimisation silently trades that away, and no test that never rolls back mid-request will show it.

- - **`'field' => ['array:a,b']` restricts which keys may appear; it requires none of them.** Pairing it with per-key `sometimes` rules is the intended shape, but OpenAPI generators publish that key list as the object's `required` array -- so the generated request contract can mark every key of a section mandatory while every per-key rule is optional, and a `sometimes|nullable` enum key publishes as required AND non-nullable. Never read a generated `required` list as the endpoint's contract; open the FormRequest. A sibling field with a bare `array` rule emits no `required` at all, which is the control that proves the list is evidence about `array:` and not about the endpoint.

- - **A `set -e` container entrypoint is a fail-fast contract -- only put steps there whose failure should genuinely block traffic.** Migrations and `config:cache` qualify. Docs generation, optional caches, and any strict artisan command that exits non-zero on one bad annotation do not: the non-zero exit aborts the entrypoint before php-fpm and the workers start, so the container never boots and every deploy of that image fails. Amplifier to check for: a step that only runs outside local (`if ($this->app->isLocal()) return;`) is green on the author's machine and bricks staging and production only. Move non-critical steps after the workers start, or wrap them so a failure degrades that one feature (a 404 docs page) rather than the service.

- - **Laravel 12 `route:cache` serializes closure actions instead of throwing `LogicException: Uses Closure`, and a closure that captures `$this` from a service provider serializes the bound container along with it.** `Route::prepareForSerialization()` now hands the action to `SerializableClosure`, which serializes whatever `$this` closed over -- a provider holds the application container, so the cached payload balloons but, verified on Laravel 12.68, still terminates: it serializes, it does not diverge. Unbounded blowup (`Maximum call stack size / Infinite recursion?`) requires an actual reference cycle, e.g. the provider storing the closure back onto its own property, which the container then re-serializes on the next pass. Plain closure routes cache fine; group and middleware closures are fine; only serialized ACTION closures matter. Fix: move the handler to an invokable controller, or capture a local `use ($var)` instead of reaching through `$this`. Verify with `php artisan route:cache; echo $?` with the route present and removed.

- - **The `migrations` row is inserted AFTER `up()` returns and outside its transaction, so a process killed in that window leaves a committed-but-unrecorded migration.** `Migrator::runUp()` calls `runMigration()` and then, as a separate statement, `repository->log()`. On a deploy model that runs `migrate --force` at container preboot and can kill the task mid-boot, the migration stays "pending", every subsequent container re-runs `up()`, hits `relation already exists` / `type already exists`, and crash-loops -- bricking all further deploys. Fix with an early-return idempotency guard at the top of `up()`: `if (Schema::hasTable('the_main_table')) { return; }`. That single-object guard is a valid proxy for "everything exists" ONLY if the whole body is one transaction; any statement Postgres cannot run inside one is skipped on re-run and ships a partial schema (`ia-postgresql` skill, Migration Safety core rules).

- - **`Builder::value()` and `pluck()` return the CAST attribute; `DB::table(...)->value()` returns the raw column.** A guard like `is_string($v) ? Enum::tryFrom($v) : null` silently returns `null` forever once a `$casts` entry exists for that column -- no error, clean PHPStan, green tests. Fix: accept both shapes (`$v instanceof Enum ? $v : (is_string($v) ? Enum::tryFrom($v) : null)`); grep every `->value()`/`->pluck()` call when a diff adds a cast. Full mechanism in [pitfalls-deep.md](./references/pitfalls-deep.md).

- - **With `Relation::enforceMorphMap()`, a model missing from the map throws `ClassMorphViolationException` -- and almost nothing calls the triggering method except the audit layer, which is usually config-gated off under test.** So a new unmapped model passes the whole suite and 500s on the first write once auditing is on, rolling back the whole request. Fix: add the map entry in the same commit as the model; a green suite is not evidence when the audit flag is off under test. Full mechanism in [pitfalls-deep.md](./references/pitfalls-deep.md).

- - **A nested `JsonResource` wrapping `null` serialises to JSON `null`, and the child's `toArray()` never runs.** `ConditionallyLoadsAttributes::filter()` replaces the whole value on `$value instanceof self && is_null($value->resource)` before `resolve()` reaches the child -- so an overriding `toArray()` that would fatal on a null resource is never entered, and `Resource::make($nullable)` and an explicit `$nullable ? Resource::make(...) : null` are byte-identical on the wire. The base-class `is_null($this->resource) => []` guard is not the mechanism and is overridden in every real resource. Probe resource serialisation through the parent's `resolve($request)`; `json_encode(['k' => Child::make(null)])` skips `filter()` entirely and throws, which reads as a production 500 and is not one.

- - **`Http::timeout($n)` is per redirect hop, not per logical call.** It becomes `CURLOPT_TIMEOUT_MS` on one curl handle, and Guzzle follows redirects itself -- `RedirectMiddleware` re-invokes the handler per hop with the same options, so each hop gets a fresh full budget. With the default `max` of 5 the ceiling is `(max_redirects + 1) x timeout`: 90s at `timeout(15)`, not 15s. A hanging endpoint IS bounded correctly (curl aborts the hop, the exception ends the call), so `rows x timeout` is right for "every request hangs" and wrong as a worst case -- six hops each answering just under the timeout reaches `6N`. Anything sized off that aggregate inherits the error: a `withoutOverlapping()` expiry, a queue `$timeout`, a task timeout, an SLO. `Http::fake()` does not model redirect latency, so it is not reproducible in a test.

- - **Adding a constructor parameter to a `ShouldQueue` job breaks every payload already queued, and a promoted default does not save it.** `unserialize()` never runs the constructor and restores only declaration-level defaults, which a promoted property has none of -- `handle()` throws `must not be accessed before initialization`, and `failed_jobs` keeps the stale payload, so every retry re-throws. Fix: a non-promoted, non-`readonly` property with a declaration-level default, assigned in the constructor body. Full mechanism in [pitfalls-deep.md](./references/pitfalls-deep.md).

- 2. Passes solo but fails in the suite → suspect shared state: container singletons, statics, `Carbon::setTestNow()` residue, DB state leaking between tests (the classic paratest failure). A `private static` memo is the sharp case: it is process-scoped, so no database rollback reaches it, and the symptom is an absence assertion that passes alone. Reset it for that one test through reflection rather than deleting the memo -- the per-request cache is correct production behaviour ([testing.md](./references/testing.md)).

- `MissingAttributeException` after `create()` usually means strict mode (`Model::shouldBeStrict()`) plus a factory that omits a column with a DB default -- Eloquent never re-reads that default, so the attribute is absent on the instance the factory just built, and the silent case (a rendered instance emitting JSON `null` for a required field) is worse than the thrown one. Fix: set the default on the model (`protected $attributes = [...]`), not the factory. Full mechanism in [testing.md](./references/testing.md).

- Real production footguns, invisible to PHPStan and feature tests alone. Extended mechanics and alternatives in [pitfalls-deep.md](./references/pitfalls-deep.md).

-

- **Query-builder `update()` silently skips observers and audit events.** `Model::query()->where(...)->update([...])` and `Relation::update()` fire no model events -- observers, Auditable traits, `static::saving/updating` all bypassed. Fix: `lockForUpdate() + save()` in a transaction keeps events firing; raw mass update only with a `// intentionally bypasses <Observer>` comment.

-

- **A database-level FK cascade fires no Eloquent events.** `->cascadeOnDelete()` is a constraint: the database removes the children, Eloquent never loads them, so no observer, `Auditable` trait, search sync, or storage cleanup runs for them -- while the parent's own delete IS audited, so the log looks populated. When a change adds a delete path on a parent, ask whether children die by cascade or row by row and what hangs off their `deleted` event; delete per row inside the transaction wherever an event-layer invariant must hold. A sibling path already deleting row by row with a comment explaining why is the tell.

-

- **Observer `deleting()` cleanup at parent scope nukes siblings.** `Storage::deleteDirectory($parent->uploadPath)` on a single child delete wipes storage for all siblings while their rows still point at the keys. Detection: when a single-row `delete()` has an Observer, check whether its hooks operate at parent or row scope. Fix: scope cleanup to the row's own paths, or move it to an Action that knows the sibling count.

-

- **`chunkById + json_decode + mutate + json_encode + update` loses concurrent writes on jsonb columns.** Any user save between the SELECT and the per-row UPDATE is silently overwritten. Fix: in-place `DB::raw("jsonb_set(...)")` for shallow edits, or `lockForUpdate()` inside the chunk; the decode/encode default is only safe with writes blocked.

-

- **`date:<fmt>` cast format only reaches `$model->toArray()`, NOT `JsonResource::resolve()`.** A resource returning the raw attribute emits Carbon's ISO 8601, ignoring the cast -- so a cast-format change is not a wire-format change unless the path uses `toArray()` directly (Filament, DTOs, `json_encode($model)`). Verify with a live reproducer before flagging.

-

- **A string that trims to empty skips every non-implicit validation rule.** `" "`, `"\t"`, `""` bypass `array`, `boolean`, `max`, `enum` and every custom rule -- only the implicit set (`required*`, `present*`, `filled`, `accepted*`) still fires. This is a property of the VALUE, not of `nullable`; the `'items.*' => 'array'` guard below stops `{"section": "Bob"}` but not `{"section": " "}`. Fix: normalise blank-ish strings to `null` in `prepareForValidation()`, or `is_array()` at the consumer. Full mechanism in [pitfalls-deep.md](./references/pitfalls-deep.md).

-

- **Nested-array validation accepts scalar elements when only `*.field` rules are set.** `'items.*.name' => 'string'` does not enforce that each `items.*` is an array -- scalars pass, then `$data['items'][0]['name']` yields `null` (blank row) or a `TypeError` (500). Always pair per-key rules with `'items.*' => 'array'`.

-

- **`validated()` rebuilds a nested array key from its ruled sub-keys only and drops the rest.** A FormRequest ruling `mapping.first_name` and not `mapping.middle_name` returns `mapping` without `middle_name` -- no error, and unit tests that hand-build the array never cross the FormRequest. Fix: rule every sub-key the consumer reads; when a diff adds a field to a nested payload, grep `rules()` for the dotted key and cover it with a feature test posting the real body. Full mechanism in [pitfalls-deep.md](./references/pitfalls-deep.md).

-

- **The `boolean` validation rule validates but never normalises.** `1`, `"0"`, etc. all pass, and `validated()` returns them unchanged -- a strict `=== true` compare against accepted input is false, and JSON-bool test payloads never expose it. Fix: cast at the read (`$request->boolean('flag')`, which uses `FILTER_VALIDATE_BOOL`); `boolean:strict` is not a built-in rule. Full mechanism in [pitfalls-deep.md](./references/pitfalls-deep.md).

-

- **`distinct` scopes to the leading explicit path, so at two wildcard levels it compares the whole payload, not per-parent.** `'questions.*.options.*.option_key' => ['distinct']` rejects the same option key reused across two different questions -- `ignore_case`/`strict` change the comparison mode, never the scope. Fix: drop `distinct` and de-dupe per parent in an `after()` closure. Full mechanism in [pitfalls-deep.md](./references/pitfalls-deep.md).

-

- **`Exists` and `Unique` self-skip once the attribute already has a validation message, so `bail` does not protect the query -- the unprotected value is the rule's SCOPE argument, not the attribute.** A malformed UUID never reaches the database; a nullable scope arg cast to `''` against a `uuid` column does (Postgres `22P02`). Triage: is the suspect value the attribute being validated, or an argument to the rule? Full mechanism in [pitfalls-deep.md](./references/pitfalls-deep.md).

-

- **`DB::afterCommit` prevents run-on-rollback but does NOT retry post-commit failures.** Default fix: dispatch a queued job with `tries` + `failed()` that reverts the DB precondition. Alternatives in [pitfalls-deep.md](./references/pitfalls-deep.md).

-

- **Observer writes a model the caller also holds → stale in-memory copy; the caller's later `save()` silently re-clobbers.** Fix: `$model->refresh()` after the triggering event, or `Model::withoutEvents()` when the caller owns the column.

-

- **`BelongsToMany::attach` / `detach` / `sync` / `updateExistingPivot` are query-builder writes -- without `using()`, no pivot model events fire.** Observers and audit traits record nothing. Fix: make the pivot a real `Pivot` model (`->using(PivotModel::class)`) and write through it with `firstOrCreate(...)->fill([...])->save()`. Qualification for one path: `syncWithoutDetaching([$id => [...]])` is attach-or-UPDATE, not insert-only, and `using()` decides both idempotency and whether events fire. It is `sync($ids, false)` -- the `false` disables detaching and nothing else -- and `attachNew()` routes an already-attached id with a non-empty attribute array to `updateExistingPivot()`. Without `using()` that is an unconditional `UPDATE` plus pivot timestamps and no model events, so re-running with the same value still writes. With `using(CustomPivot::class)` it is dirty-checked through `fill()->isDirty()`, issues no query when unchanged, and DOES fire normal Eloquent events on the pivot subclass. "Is it idempotent?" is answered by `grep -n 'using(' <Model>.php`; "does it clobber?" is answered by the pivot column's value set (a two-case enum has nothing to lose; a `draft`/`verified`/`completed` status does).

-

- **`QueryException::getMessage()` interpolates raw query bindings plus host/database into the message** -- any log sink or APM recording exception messages leaks parameter values on every failed query. Recent versions add per-connection `mask_bindings_in_exception_messages` (env `DB_MASK_BINDINGS`), default off; enable in production if query exceptions reach logs (confirm the option exists in the installed version).

-

- **`Carbon::parse('2020')` is today at 20:20, not year 2020** -- a bare 4-digit string parses as `HHMM` time-of-day, breaking date-comparison rules on year-only input. Fix: `Carbon::createFromFormat('Y', $year)->startOfYear()` + partial-date-aware rules. Full mechanism in [pitfalls-deep.md](./references/pitfalls-deep.md).

-

- **A custom auth guard whose failure path calls `report()` can infinitely recurse -- an unauthenticated DoS.** `report()`'s exception context calls `Auth::id()`, which re-enters the same failing guard, which reports again, exhausting memory on a single malformed `Authorization` header. Fix: a `resolving` re-entry flag in the guard, memoising the null resolution. Full mechanism in [pitfalls-deep.md](./references/pitfalls-deep.md).

-

- **A backed enum serialises as the case NAME, never the backing value, so renaming or removing a case breaks unserialization silently rather than raising `Enum::from()`'s `ValueError`.** A removed case degrades to a permanent cache MISS; other shape changes (a new property, a moved class) fail worse and uncaught. Fix: version the cache key whenever a stored object graph's shape changes. Full mechanism in [pitfalls-deep.md](./references/pitfalls-deep.md).

- **A `composer.lock` conflict confined to the `content-hash` line is not a lock conflict.** The package arrays merged cleanly; both hashes are stale because each was computed against its own `composer.json`. Never hand-pick a side's hash -- recompute it. Full recipe in [pitfalls-deep.md](./references/pitfalls-deep.md).

- - [pitfalls-deep.md](./references/pitfalls-deep.md) -- afterCommit alternatives, observer-desync mechanics, jsonb race, savepoint mechanics