unserialize(): Error at offset — verifying backup integrity before object instantiation

Context

Restoring application state from serialized PHP backups requires calling unserialize() on stored strings. When a backup file is truncated or corrupted during transfer, PHP emits the warning unserialize(): Error at offset and returns false. However, the function may still partially instantiate objects before failing, and any __wakeup() or __destruct() magic methods on those partial objects can execute side effects such as database connections or file operations.

Constraint

Since PHP 7.0 the allowed_classes option restricts which classes may be instantiated, yet internal classes like DateTime and Exception are always permitted even when allowed_classes => false. No built-in checksum or signature verification exists for serialized data, so integrity checks must be implemented externally (e.g., HMAC) before unserialize() is called. PHP 8.1+ further deprecates the Serializable interface in favor of __serialize/__unserialize, meaning legacy backups that rely on custom serialization logic may trigger deprecation notices or fail to restore.

Open questions

1. What is the exact sequence of magic-method execution when unserialize() encounters a truncated string — does __wakeup() run on partially constructed objects before the offset error is raised?
2. How should a verification pipeline order HMAC validation, allowed_classes restriction, and legacy Serializable compatibility checks to guarantee that no object instantiation occurs on corrupted or untrusted backup data?