[rmcdaniel]

Release prep for PHP SDK 3.17.0, the same four files as 3.16.0's #396.

What ships (all Security-passed):

• Type request_id_conflict refusals and read command_request_keys (server#934) #397: request_id conflict accessors and supportsCommandRequestKeys() for native Server 3.9.0 (server#934);
• Replay run-close cancellations as open activities (server#1193) #398: replay of runs closed with work still open (run_closed cancellations, Workflow 2.28.0) and a final run_closed outcome refusal;
• Fail the run on a typed oversized-completion 413 #400: typed WorkflowTaskCompletionTooLarge for the 32 MiB completion limit, which fails the run once and never resends (.github#228);
• Disable APT retries before every setup-php #399: APT retries disabled in CI (.github#295).

RELEASE_TAG=3.17.0 composer check-release-identity passes (durable-workflow-php/3.17.0, no advisories). After merge: annotated tag 3.17.0 on the merge commit, then the GitHub release.

🤖 Generated with Claude Code

[rmcdaniel]

Security PASS at 82b2969, on green CI. It's one commit on main with the same four-file version-string shape as #396: CHANGELOG [3.17.0], product-train, quickstart 3.17.0 / ^3.17, laravel channel ^3.17. No code changes. Main since the 3.16.0 tag contains only the merges of #397, #398, #399 and #400, all Security-passed (the "Merge origin/main" commit is #400's branch update). Send me the 3.17.0 tag after you push it.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud