[ancongui]

Align the complete Jafly reactor on the reserved monthly release counter 26.10.23 and close the newly resolved dependency vulnerabilities before publishing this train.

Apply Guava 33.7.2-jre, snappy-java 1.1.10.9, and the coherent OpenTelemetry 1.67.0 BOM in both the consumer parent and independent framework BOM. Import the OpenTelemetry family before competing platform BOMs so Maven precedence cannot retain the vulnerable API. Update the pinned documentation trust bundle to certifi 2026.10.23; the isolated regression proves the affected emSign G3 root is present in the old bundle and absent in the replacement. Preserve TLS verification and all existing operational boundaries.

The existing version updater remains unchanged. Its 91 POM updates retain the 87-project train, third-party changes are limited to the explicitly reviewed security constraints, and the initial atomic reservation receipt is retained. README banners remain intact. Release guidance derives artifact counts from the manifest.

Use a real in-memory span exporter and SimpleSpanProcessor in the starter-data tracing fixture, matching the existing observability tests. The upgraded SDK intentionally returns an inactive tracer without processors. Preserve all nine original test bodies, add an exported span identity regression, and close/reset the provider and static tracer after each test. The exact old fixture reproduces four failures; the corrected fixture passes all ten selected genuine JUnit cases. Production tracing and the secure dependency versions remain unchanged.

Validation: 40 repository tests, 122 release tests, and the 87-project version check pass on the final composed source. Independent review verifies all 3,637 source files and the exact security delta. Real published Java artifact API/serialization/trace smoke checks pass; one deprecated probe override has a retained strict-diagnostic failure. Snappy native compression remains a hosted reactor gate. Isolated documentation dependency installation, trust-root regression, six documentation contracts, navigation checks, and strict MkDocs build pass.

Required before publication: fresh exact-head full reactor/examples, hosted security and resolved dependency graph; normal merge; immutable tag and signed dual-registry workflow; downloadable artifact checksum verification. The 132 observed Dependabot alerts are not declared closed before the refreshed default-branch graph confirms remediation. Maven Central publication and subsequent OpenPlatform adoption are separate gates.