[artidezi-etke-cc]

Adapts #49 at b96f5ae650c2250cee8630baab8733f167acfdbd.

Update Symfony Flex to 2.12.0 and regenerate lock metadata with the repository-pinned Composer 2.10.3. The source lock fails strict validation because its content hash does not match composer.json; the replacement preserves the Flex update and all other dependency versions. Composer install, validation/audit, PHP analysis/style checks and frontend checks passed. No workflow changes are needed; the proposal remains for human merge.

Agent-assessed risk: Low. Only the Flex plugin and lock metadata change, and installation plus PHP/frontend checks pass; deployment and recipe-update migrations were not exercised.

Evidence (8 items)

• Evidence: git diff 852b23c0912f1992ec795ddb86287e3302613c32...refs/artidezi/inputs/source-pr — Merge base equals the recorded target base. The source changes only app/composer.lock: Flex 2.11.0 to 2.12.0 plus content hash, publication and plugin API metadata. There are no newer target-only changes to reconcile.
• Release notes: source — Official release identifies commit 3d37e85, matching the locked package, and describes fixes to recipes, constraint handling and Composer integration. No operator migration is indicated for this plugin update.
• Local check: ./bin/composer validate --strict (source lock) — Failed with exit 2: lock file out of date with composer.json. This reproduces a concrete defect; the supplied PHP CI excerpt does not identify its failure cause.
• Local check: ./bin/composer update --lock --no-install --no-scripts --no-interaction — Passed using the pinned Composer 2.10.3 helper. Regenerated metadata without changing resolved dependency versions; restored the valid target content hash and compatible Composer metadata while retaining Flex 2.12.0.
• Local check: ./bin/composer validate --strict; ./bin/composer install --no-interaction --prefer-dist; ./bin/composer audit --locked — All passed on the replacement. Installed 92 packages with plugins enabled and generated autoload files. Audit reported no security vulnerability advisories.
• Local check: docker build --iidfile /tmp/artidezi-php-image.id etc/docker/php; docker run --rm --network none --user "$(id -u):$(id -g)" --mount "type=bind,src=$PWD,dst=/code" --workdir /code/app --entrypoint /bin/sh "$(cat /tmp/artidezi-php-image.id)" -ec <runtime probe and PHP checks> — Build passed using cached layers. Runtime autoload probe confirmed PHP 8.5.12, ext-mongodb 2.5.5, mongodb/mongodb 2.5.0 and Flex 2.12.0. Installed MongoDB library requires ext-mongodb ^2.5, satisfied by the actual image. vendor/bin/phpstan analyse -c phpstan.neon --no-progress passed; vendor/bin/php-cs-fixer check --config=.php-cs-fixer.dist.php passed for 146 files; vendor/bin/twig-cs-fixer lint --config=.twig-cs-fixer.dist.php passed for 38 files. CS Fixer emitted an advisory about the root PHP 8.4 minimum versus the PHP 8.5 runtime. No database or monitoring stack was started.
• Local check: just js-analyze js-build; ./bin/node /bin/sh -c 'cd /app/src && npm audit'; ./bin/node /bin/sh -c 'cd /app && npm ls --all' — All passed: ESLint, TypeScript tsc --noEmit and build.mjs asset build; npm audit found zero vulnerabilities and the installed dependency tree had no invalid/missing peers. Generated output remained ignored. Browser behavior was not exercised because no frontend dependency, asset-path or runtime-loading changes are present.
• Local check: git diff --check; git status --short — Whitespace check passed and the working tree was clean after committing the complete replacement series on the recorded target base. No workflow changes or forge actions were performed.

Human review and merge are required.