B2 and B3 — the profiler stops instrumenting production, and its profile serialises

[gplanchat]

Two audit findings on the same surface, one hiding the other.

B2 — the profiler ran in production, and leaked in workers

registerProfiler() was called unconditionally, first thing in load(). This is not neutral plumbing: the service it aliases onto WorkflowExecutionObserverInterface is injected into ExecutionRuntime, ExecutionEngine and ActivityMessageProcessor. It therefore sat on the hot path of every execution, feeding a page nobody serves in production.

And its trace was only cleared by ResetDurableProfilerListener, which listens on kernel.request — an event messenger:consume never fires. In a worker, the timeline grew for as long as the process lived.

Both halves are handled together:

• Outside kernel.debug, nothing of the profiler is registered and observation falls back to NullWorkflowExecutionObserver. Doing nothing is a real behaviour here, not a signature filler — an execution nobody watches runs the same way, like NullLogger. It is also what FrameworkBundle does, loading its collectors from separate files under a condition.
• In debug, the trace gains the kernel.reset tag, which hands it to services_resetter — the mechanism that actually clears state between two messages of a worker. The reset() method already existed; only the declaration was missing.

B3 — an unserialisable payload broke the whole profile

The collector stored raw payloads and __serialize() returned them as-is. A closure in a payload therefore does not bring down the Durable panel: it brings down the request's profile, other bundles' panels included. RED reproduced exactly: Exception: Serialization of 'Closure' is not allowed.

A barrier at the single point where $this->data is assembled reduces everything to scalars and arrays — which is the conversion the template performs anyway in order to display (|json_encode). Nothing shown is lost, and one point covers every payload source, present and future.

JSON_INVALID_UTF8_SUBSTITUTE settles, in the same gesture, a second defect at the same place, noted separately in the audit: a journal carries bytes, not necessarily valid text, and the template rendered an empty area where there was a payload.

What the tests pin down

Case	What it keeps
closure, resource, anonymous object holding a closure	the profile stays storable whatever is observed
ordinary payload with ints, floats, booleans, null, list, nested array	the barrier distorts nothing — a JSON round trip turning a list into an object would silently break the keys the template reads
binary payload	the panel does not go blank
kernel.reset tag, reset method	a debug worker stays bounded
outside debug: no definition tagged data_collector, no trace	production stops paying
in debug: the observer is indeed the trace	regression net

Verification

	main	this branch
unit suite	1073 tests, 4 errors	1084 tests, 4 errors
PHPStan	2 errors	2 errors

The 4 errors are pre-existing and identical (illuminate/cache missing on this machine). PHPStan is strictly at baseline this time: no new diagnostic.

Eleven more tests for ten cases written: the eleventh comes from CoreDependsOnNoHostTest, a data-provider guard over every file in src/Durable/, which gains an entry for the null object and confirms it imports neither host nor bridge. The placement is validated by a guard the repository already had.

Break

Behavioural, and documented in UPGRADE.md: an application that pulled durable.execution_trace from the container in production will no longer find it. It does not have to resurrect the profiler for that — implementing WorkflowExecutionObserverInterface and aliasing the interface onto its own service is cheaper and does not accumulate a timeline for nobody's screen.

---

Addendum — 2026-09-04, after cross-review

This branch broke the production container, and CI was green. Twelve review axes blocked it; eight reached the same defect, three by actually compiling a container.

registerProfiler() became conditional, so durable.execution_trace no longer exists outside debug — but DurableExtension:668 still referenced it by a bare Reference in the Temporal-native branch. A production application with a temporal.dsn raised ServiceNotFoundException at compile time; a Sylius shop no longer booted. The target constructor declares ?DurableExecutionTrace = null, so the reference now carries NULL_ON_INVALID_REFERENCE.

No test could see it: all of them loaded load([[]]), without a DSN, so the offending branch was never built, and none of them ran a compiler pass. There is now one that does.

The serialisation barrier was a duplicate, and it bit harder than the defect. DurableDataCollector::storable() re-implemented, privately, what Durable\Observation\RecordedDetails already does for every observation surface — a class whose docblock states that "this is where degradation is decided, for all surfaces at once". The variant returning a structure rather than text now sits next to of(), and DiagnoseExecutionCommand, which had no barrier at all, uses it too.

Three failure modes, each observed in execution before being fixed:

• json_encode calls the payload's jsonSerialize(), i.e. business code, which can throw. No flag covers this. The exception reached collect() — kernel.response — where the original defect only broke saveProfile() on kernel.terminate, with the response already sent. The fix made the failure earlier and user-visible.
• Beyond 512 levels of nesting, json_decode returns null, assigned to $this->data which the parent types array|Data: TypeError. The barrier is therefore applied key by key.
• Without JSON_PRESERVE_ZERO_FRACTION, a float of integral value comes back as int, and the timeline bounds that declare float lie about their type.

Recursion, by contrast, survives: JSON_PARTIAL_OUTPUT_ON_ERROR truncates it and returns the rest. That case is now tested so it stops being assumed broken.

The escape hatch prescribed by UPGRADE.md did not work. Aliasing WorkflowExecutionObserverInterface onto your own service was overwritten by the extension's setAlias(): the application's services.yaml definitions already exist when the extension loads. The alias now respects what the application declared, in debug as in production.

Still open, out of scope: kernel.reset does not fire on Temporal transports, which return no envelope — B2 is only closed for the bus-driven half; the overlap between that tag and ResetDurableProfilerListener, which the review did not settle; and the inverted coupling that makes all of this possible — Bridge/Temporal type-hints a bundle class its composer.json does not require.