feat: roadrunner application server support

[markshust]

Adds marko/roadrunner, letting a Marko application be served by RoadRunner — booted once, serving many requests — instead of booting per request under PHP-FPM.

Stacked on #152. Base is feature/response-decoration, not develop. This PR needs #152's Response::headerLines(), Request::cookie(), ResettableInterface and Container::resolvedInstances(). Retarget to develop once #152 merges.

Purely additive

This PR touches no existing package. Everything it needed from existing code was fixed at the source in #152 — which is why the reset lifecycle here can stay generic instead of special-casing packages.

What it does

The request boundary was already pure: $router->handle(Request): Response. Application exposes a public virtual $router property, so the worker needed no core change at all.

• worker.php — boots once, then serves. Kept to wiring; the loop lives in a testable WorkerRequestHandler.
• PSR-7 bridges — request and response. PSR-7 stays confined to this package; a tests/Psr7ContainmentTest.php static scan fails the build if Psr\Http\Message, Nyholm\Psr7 or Spiral\RoadRunner appears under packages/*/src or packages/*/tests anywhere else.
• Per-request reset — filters Container::resolvedInstances(ResettableInterface::class), sorts for deterministic ordering, resets before each request so a thrown or killed request cannot hand stale state forward. It never instantiates a service to reset it, so a service the request never used is correctly absent rather than needlessly constructed.
• Guard rails — refuses to boot with marko/sse installed, naming the exact config key that downgrades it to a warning; warns on debugbar.
• rr:serve and a working .rr.yaml.

The three hazards this had to solve

STDOUT is the goridge relay. RoadRunner's default pipes relay carries protocol frames on STDOUT. errors-simple's boot-registered handler checks isCli() — true in a worker — and echos its report straight into that stream. One uncaught throwable would corrupt the relay. The worker installs a safe exception handler and buffers every request, restoring ob_get_level() on all paths including exceptions.

The base path is not dirname(__DIR__, N). worker.php runs as vendor/marko/roadrunner/worker.php, which under Composer path repositories is a symlink back into the monorepo — exactly how this repo installs its own packages. Resolution order is MARKO_BASE_PATH, then the loaded Composer autoloader's own directory.

Presence of a package is a blunt signal. Hard-refusing marko/sse with no way out contradicts "every no comes with a yes, this way instead." The refusal names a config override, and states what an operator who takes it actually gets: a loud per-request 500 on the SSE route from the response bridge, not a silently truncated stream.

The spike is the interesting part

Rather than designing a reset interface up front, task 005 drove hundreds of requests through one booted application and audited every singleton declaration, boot-time instance() binding, mutable static, superglobal reader and process-global in the monorepo — recording an explicit verdict for each, including negatives so nobody re-investigates them. Findings: packages/docs-markdown/docs/packages/roadrunner-state-leaks.md.

It found two real cross-request leaks nobody had predicted:

• Inertia::$shared — a singleton whose shared props merge into every subsequent render(). Middleware sharing the authenticated user once per request leaves that user visible to every following request. A cross-user data leak, not just memory growth.
• ReadWriteConnection — a transaction left open by a request that threw, on a connection pooled across requests, silently absorbing the next request's writes.

Both are fixed in #152, at their source.

Verification

The end-to-end suite drives a real rr serve process pinned to one worker, so sequential requests provably hit the same process. Isolation cases run authenticated → anonymous → different user; the anonymous request in the middle is what catches a stale cached identity, which an A → B sequence would miss.

It is in the integration-destructive group, and nightly.yml now installs the RoadRunner binary — without that step the entire suite would have skipped in CI forever, so a CiWorkflowTest assertion guards it.

packages/roadrunner/src is added to phpstan.neon — the only non-core package under level-6 analysis, deliberately, because this is the one place a type error becomes a cross-user security bug.

7086 tests passing, PHPStan no errors, PHPCS clean.

Closes #151

🤖 Generated with Claude Code