[lazerg]

Since the upload progress handler started decoding the session with every object kept as __PHP_Incomplete_Class, it refuses records that have a property named __PHP_Incomplete_Class_Name, __PHP_Incomplete_Class_Serialized or __PHP_Incomplete_Enum_Case. That refusal went through the normal decode failure path, which destroys the session, even though a regular session_start() reads the same record without a problem.

When the decode fails inside the upload progress handler, the session is now only closed and the progress update is skipped, so the stored record stays as it was and the request deals with it when it starts the session itself. I updated the expectations of rfc1867_incomplete_class_reserved_props.phpt to match.

Fixes GH-24493

[jorgsowa]

TBH, I'm not fan of claude proxing PRs like this one without even understanding the matter. We all have access to AI and such PRs only prolong the fix, by ping-poing what's missing/incomplete/incorrect. You use AI even for all your comments in other PRs, that's not very efficient, and in some perception simply rude. Please, stop sending PRs, at least for ext/session.

Why do you think CVE fix that was coordinated by multiple PHP core maintainers and biggest cybersecurity companies should be improved by your suggestion? Do you even have access to frontier AI models that could verify this PR?