Harden Testing correctness, parallel ownership, and parity

AGENTS.md

@@ -434,7 +434,7 @@ PHPUnit loads test files directly (not via autoloading), so the namespace doesn'
 
 ### Temp directories for file I/O
 
-Tests that write files to disk must never write to the committed `tests/` directory. For tests needing a full app skeleton, `Testbench\TestCase` handles this automatically (see testbench entry in the paths table above). For unit/lightweight tests that just need a scratch directory, use `ParallelTesting::tempDir('TestName')` — store it as a property, delete any leftover copy and create it fresh in `setUp`, then delete it again via `Filesystem::deleteDirectory()` in `tearDown`. Use `sys_get_temp_dir()` directly only when the system temporary path itself is the behavior under test. See `FoundationViteTest` or `OptionTest` for the pattern.
+Tests that write files to disk must never write to the committed `tests/` directory. For tests needing a full app skeleton, `Testbench\TestCase` handles this automatically (see testbench entry in the paths table above). For any test that only needs an isolated scratch directory, use `ParallelTesting::tempDir('TestName')` — store it as a property, delete any leftover copy and create it fresh in `setUp`, then delete it again via `Filesystem::deleteDirectory()` in `tearDown`. Use `sys_get_temp_dir()` directly only when the system temporary path itself is the behavior under test. See `FoundationViteTest` or `OptionTest` for the pattern.
 
 The Testbench skeleton clone is shared for the whole worker, so tests that write under `BASE_PATH` must restore or delete the exact files they touch in `tearDown()`. For `.env` files, prefer `useEnvironmentPath()` with an isolated `ParallelTesting::tempDir()` directory.
 
@@ -700,6 +700,8 @@ The `tests/` directory is excluded from phpstan. Do not run phpstan on tests.
 
 Full PHPStan runs through `composer fix` at checkpoints. During implementation, use targeted PHPStan only when investigating or validating a specific type issue.
 
+`phpstan.types.neon.dist` validates only the committed `types/` fixtures. Never pass source or test paths to it.
+
 **When fixing phpstan errors:**
 
 1. **Investigate before coding.** For each error: read the code, check the Laravel equivalent's types (native and docblock), trace through callers and dependents. Report findings with the single, most correct fix.

composer.json

@@ -138,9 +138,7 @@
         "ext-dom": "*",
         "ext-fileinfo": "*",
         "ext-filter": "*",
-        "ext-hash": "*",
         "ext-intl": "*",
-        "ext-json": "*",
         "ext-mbstring": "*",
         "ext-openssl": "*",
         "ext-pcntl": "*",

docs/plans/2026-07-01-0915-fortify-passkeys-port.md

@@ -371,7 +371,6 @@ The `hypervel/queue` dependency is intentional for both packages if their ported
     "keywords": ["php", "hypervel", "passkeys", "webauthn", "passwordless", "swoole"],
     "require": {
         "php": "^8.4",
-        "ext-json": "*",
         "hypervel/auth": "^0.4",
         "hypervel/collections": "^0.4",
         "hypervel/config": "^0.4",
@@ -422,7 +421,6 @@ The `hypervel/queue` dependency is intentional for both packages if their ported
     "keywords": ["php", "hypervel", "fortify", "auth", "swoole"],
     "require": {
         "php": "^8.4",
-        "ext-json": "*",
         "bacon/bacon-qr-code": "^3.1",
         "hypervel/auth": "^0.4",
         "hypervel/cache": "^0.4",

docs/plans/2026-08-05-1615-auth-correctness-lifecycle-and-current-parity.md

@@ -470,7 +470,6 @@ Add one human-facing sentence to `src/boost/docs/verification.md`: links expire
 Add the remaining direct runtime dependencies to `src/auth/composer.json`, sorted under the existing package convention:
 
 ```json
-"ext-hash": "*",
 "hypervel/console": "^0.4",
 "hypervel/notifications": "^0.4",
 "hypervel/queue": "^0.4",

docs/plans/2026-08-05-2352-routing-correctness-current-parity-and-cache-lifecycles.md

@@ -639,7 +639,6 @@ Declare only the proven Routing split dependencies:
 {
   "require": {
     "ext-filter": "*",
-    "ext-hash": "*",
     "hypervel/auth": "^0.4",
     "hypervel/prompts": "^0.4",
     "hypervel/redis": "^0.4",

docs/plans/2026-08-07-1302-sanctum-correctness-cache-settlement-and-current-parity.md

@@ -486,7 +486,7 @@ No config validation subsystem or second JSON pass is added.
 
 ### 10. Complete metadata, public docs, and provenance
 
-In the split manifest add direct runtime dependencies: `ext-ctype`, `ext-filter`, `ext-json`,
+In the split manifest add direct runtime dependencies: `ext-ctype`, `ext-filter`,
 `hypervel/cookie`, `hypervel/foundation`, `hypervel/session`, and
 `symfony/http-foundation`. `symfony/console` already exists. Add Sanctum's provider to root package
 discovery, not `DefaultProviders`. Add executable root/split metadata coverage.

docs/plans/2026-08-07-2205-passkeys-correctness-security-and-maintenance.md

@@ -201,7 +201,6 @@ source-verifiable.
 Add these direct requirements to `src/passkeys/composer.json`:
 
 ```json
-"ext-hash": "*",
 "hypervel/context": "^0.4",
 "nesbot/carbon": "^3.13.1",
 "symfony/http-kernel": "^8.1"

docs/plans/2026-08-08-1443-telescope-correctness-current-parity-and-watcher-lifecycles.md

@@ -515,7 +515,6 @@ This is a boot/runtime performance improvement, not added overhead.
 Declare direct split-package requirements:
 
 ```json
-"ext-json": "*",
 "ext-mbstring": "*",
 "ext-pdo": "*",
 "guzzlehttp/guzzle": "^7.15.1",