1.1.0-alpha3: code-review polish bundle Lands the bulk of the post-1.0.0 code-review should-fix items as a focused polish pass on top of the alpha1 + alpha2 feature bundle. No contract changes; the four collector interfaces, the beacon payload envelope, the cwv_beacons / cwv_probes / cwv_events schemas, the AsyncContextStore service contract, and the CwvPanelWeight constants all remain stable. Highlights: - cwv-version Server-Timing entry on every response (operator- verifiable shipped version regardless of JS aggregation). - hook_requirements status-report rows for trusted-proxy posture and max_rows guard. - Time-series event overlay on daily counts panel. - enforceMaxRows correctness (id-based delete) and performance (information_schema cheap-check). - CollectorRegistry and CwvAsyncDecoratorBase now log swallowed exceptions to the cwv watchdog channel. - Probe correctness: per-iteration observed_at, split connect/ total timeout budget, multibyte-safe + bounded token normalisation, SSRF defence (http(s) scheme only). - BeaconController hardening: random_int instead of mt_rand, url userinfo+fragment strip, byte-safe URL truncation, alias- manager-aware route resolution. - InstrumentedCacheBackend::getMultiple records as a single batched observation with full elapsed time (was apportioning micros / requested which rounded to 0 on fast backends). - cwv_page_attachments skips admin and AJAX routes. - js/cwv.js: bfcache pageshow handling, URL fragment strip + 2048-char cap, sendBeacon-return-value falls through to fetch keepalive. - Defensive bounds on hottest_* strings + iterator materialisation in CollectorRegistry. - Doc consistency: CwvPanelContributionInterface PHPDoc weight constants and docs/collector-contract.md BeaconRequest helper list. Items deferred from alpha3 per the review's recommendation (schema-affecting refactors, settings-form server-side validation, RenderTreeInstrumentor value-object refactor, AsyncContextStore last-writer-wins doc / dead arg cleanup) land in subsequent 1.1.x patches or as separate issues. See ROADMAP.md for the full 1.1.0 entry; SECURITY.md and PERFORMANCE.md unchanged from 1.0.1; docs/collector-contract.md gets the BeaconRequest helper-list correction.