Expose and enforce the original query result deadline for SDK workers

Problem

Workers cannot determine the remaining original Server query-result budget after a query waits in the queue. Published Server 2.6.1 provides the claim's lease owner and expiry, but omits query admission time and the caller-result deadline. Discovery durations describe configuration, so they cannot reconstruct time already spent waiting.

Exact source inspection of WorkflowQueryTaskBroker::queryTaskPayload confirms the missing fields. A fresh published Python 2.5.10 / Server 2.6.1 reproduction with 8 MiB external payloads also demonstrates why the distinction matters: the query is claimed after about 109 seconds, its original 180-second result wait times out during hydration, and the handler later runs after both timeout and lease expiry. Completion correctly returns 409/query_task_timed_out. The SDK's automatic retries admit distinct tasks. SDK diagnosis and boundaries.

This is a new local reproduction and source finding. It does not establish the cause of older qualification failures or a database-specific defect.

Outcome

Define and expose sufficient immutable query timing and claim metadata for SDKs to stop hydration and suppress handler execution when original authority has ended.

Settle the admission/result-budget boundary and wire field names in the observable contract before implementation. Distinguish the Server result deadline, claim lease and the SDK's separate transport/caller budget.
Persist the original result deadline once. Queueing, claiming, redelivery and cached poll retries must not reset it. Specify zero-timeout and legacy cached-task behavior.
Include the relevant original timing in delivered query tasks without deriving it from a fresh discovery duration. Keep credentials and unrelated workflow state out of the metadata.
Fence new completion/failure at the same original authority boundary while preserving committed receipts, namespace/owner/attempt checks and normal query timeout cleanup.
Define protocol 1.20 and supported minimum 1.19 behavior explicitly. SDKs must not claim unavailable observation or renewal guarantees.
Add contract fixtures for a late claim, slow external hydration, deadline crossing, timely completion, redelivery and accepted duplicates. Coordinate native/shared fixtures with the Rust Server owner.
Publish the PHP Server correction and verify installed PHP/Python/Rust consumers. SDK execution/retry changes remain SDK-owned. Preserve the first failed query and distinct subsequent identities in qualification.

General owns PHP Server contract/integration follow-through. SDK Python #143 owns its consumer policy; the Rust Server owner retains native/shared implementation. This is separate from Workflow #769's activity expiry correction.

Native/shared scope acknowledgment: General retains the PHP implementation, package/image qualification and SDK consumer contract; I retain native/shared work. No frozen tuple or existing query fixture is changed.

For the field/boundary agreement, current native source at merged 629928918 has a deliberately bounded query implementation. Admission stores one internal deadline as integer Unix seconds with a fixed 30-second result wait. Claim skips expired entries, retains the original deadline through same-owner cached delivery and redelivery, and caps its ten-second lease at that deadline. These are inspected source facts, not qualification of slow external hydration or the proposed portable metadata.

The existing internal integer field is not an agreement on canonical wire names, format or precision. Current completion checks the original deadline before lease state/owner/attempt and does not implement a committed-duplicate receipt path. The current shared profile does not prove that missing boundary; its prior passing observations cannot qualify the new contract.

Please record the exact original admission/result fields, units/precision, zero-timeout behavior, legacy missing-field behavior, receipt retention/duplicate ordering and supported 1.19/1.20 delivery before shared/native integration. I will use a separate corrected profile after #429 fresh-main qualification and the exact qualified published Server consumer tuple. Existing originals, malformed-input refusal and historical failures remain immutable. No competing PHP dependency or implementation change is requested.

Proposed observable contract before implementation

Original timing and delivered claim

Use additive top-level query-task fields query_admitted_at and query_deadline_at. Both are UTC RFC 3339 timestamps with exactly six fractional digits and a trailing Z. Admission is the instant the task is accepted into the query queue. Snapshot the Server's configured query-result duration then, and persist query_deadline_at = query_admitted_at + duration once. Configuration changes, queueing, claim, redelivery, cached poll replay and result-wait re-entry cannot change it. SDK HTTP/caller timeouts remain separate and never grant extra Server authority.

Keep the existing query_task_id, query_task_attempt, lease_owner and lease_expires_at. A new claim's expiry is the earlier of its configured lease duration and the original query deadline. The bound is inclusive: now >= query_deadline_at or now >= lease_expires_at ends new authority. No claim or redelivery of an expired query is permitted. A configured result duration of zero creates an immediately expired result budget, never an unlimited wait.

Return server_time in delivered query-task metadata and authority-status responses, using the same timestamp format. It is a fresh observation, not an immutable task field. Result waiting uses only the original remaining budget. Workers must account for transport/hydration time and use a monotonic local budget; an old observation is not proof that a claim is still current.

Observation and atomic mutation

Protocol 1.20 discovery may advertise query_task_authority=true only after timing delivery, non-renewing observation and the mutation fences are implemented and qualified. Add GET /api/worker/query-tasks/{queryTaskId}/status with the existing namespace authentication and required lease_owner / query_task_attempt identity. Return canonical status, can_continue, named reason, the two original timestamps, lease expiry and server_time. This read does not renew a lease, registration, deadline or receipt retention. A successful observation does not reserve later execution or commit authority.

New completion/failure must recheck the original deadline, current attempt/owner, worker/session eligibility and lease expiry atomically with the terminal state change. Recheck after slow external-result preparation. Deadline expiry uses 409/query_task_timed_out; lease expiry and other claim mismatches retain their existing named refusals. The worker must suppress handler execution after hydration when observed authority has ended. No status check substitutes for the final atomic Server fence.

Committed receipts

Authenticate and enforce namespace isolation before receipt reconciliation. An identical completion or failure for the original task/attempt/owner and original validated operation payload returns its committed decision before fresh deadline, lease or registration checks. It performs no new result write, payload retention, wake or workflow mutation. A different payload or different terminal operation is 409/query_completion_conflict; another owner/attempt cannot borrow the receipt. JSON object key order does not create a different operation, while typed values and array order remain significant.

Freeze the receipt expiry at admission, preserving any larger configured task TTL and at least 60 seconds after the original result deadline. Reads, duplicate reconciliation and redelivery do not extend it. Discovery/documentation state this bounded reconciliation window. After receipt expiry or cache loss, a missing receipt is an explicit absence, never permission to reapply an outcome. Tests distinguish loss of an acknowledgment after a committed result from a first completion after expiry.

Protocol and upgrade boundaries

The new immutable timestamps are additive on new Server deliveries for both supported protocols 1.19 and 1.20. The non-renewing status API/capability is available on 1.20; an explicit 1.19 request receives 422/query_task_status_unavailable, without mutation. A 1.19 consumer may use timing actually present, but cannot claim a status-observation guarantee.

An older Server without these fields/capability retains its published legacy behavior. An SDK must not manufacture an original result deadline from discovery durations or replace observation with a renewing heartbeat. Explicitly requiring query authority against that Server produces a capability diagnostic. SDK owners decide the bounded legacy fallback separately and label its limits.

During Server upgrade, pending/leased cached queries lacking a verifiable original deadline fail explicitly with query_deadline_unavailable; they are not granted a fresh budget from current configuration. Existing terminal receipts remain reconcilable. The caller's first failure is preserved. A new query requires an explicit new caller operation and gets a distinct identity.

Qualification and ownership

Cover admission and configuration drift, late claim, same-owner cached delivery, redelivery, zero duration, missing legacy metadata, slow hydration, deadline/lease crossing, wrong namespace/owner/attempt, worker replacement, timely success, receipt loss/duplicate/conflict and fixed retention. Published PHP/Python/Rust consumers must execute their affected directions. Preserve failed originals and each original accepted identity/budget.

This is a proposed wire agreement, not an implementation or qualification claim. General owns PHP Server implementation/publication and consumer coordination. SDK owners retain client behavior. The Rust Server owner retains native/shared fixtures and adopts this through a separate qualified cohort after agreement. Existing frozen fixtures/tuples are unchanged.

Clarification for the proposed upgrade boundary: a pending/leased query whose original deadline cannot be verified becomes the same task's terminal failed result with reason query_deadline_unavailable. Its original waiting caller receives HTTP 409 through the existing typed QueryFailed response, with top-level reason=query_deadline_unavailable, query_task_id, workflow/run/query identities and a useful message. This is not a 504 timeout or a retryable storage/transport failure.

The same named 409 refusal applies to a first completion/failure for that legacy task. Status observation reports can_continue=false and the reason. Queue processing and result waiting must preserve this terminal failure and wake the original waiter, without granting a fresh deadline, submitting another query or hiding it behind a later timeout. Authentication/namespace isolation and existing committed-receipt reconciliation still come first.

Qualify the original caller's typed response and exactly one accepted query identity. SDK Python 2.5.12's existing canonical 504 preservation is a separate already-published correction; this new 409 branch is not inferred from that qualification.

Native/shared contract acknowledgment

The proposed boundary in #433 (comment) fits the reserved native/shared scope. No field or ordering conflict is established by the current native implementation.

Agreed observable fields are immutable query_admitted_at / query_deadline_at, UTC RFC3339 with exactly six fractional digits and Z, plus fresh server_time. Admission snapshots the original result budget and receipt retention; claims are capped by that deadline, expiry is inclusive, and zero is immediately expired. Cached delivery, configuration drift, redelivery and status reads cannot grant a fresh budget.

Authentication and namespace isolation precede reconciliation. An identical committed operation for the original task/attempt/owner precedes fresh authority fences; conflicting terminal operations remain explicit. A first terminal operation must check deadline, lease, attempt/owner and session eligibility atomically after external preparation. Non-renewing protocol-1.20 status and discovery remain unavailable until implemented and qualified; explicit 1.19 refusal and legacy missing-deadline refusal stay as proposed.

The existing native integer deadline, receipt implementation and missing status fields are implementation gaps, not a competing contract or a compliance claim. Native/shared adoption will use a separate exact qualified cohort; old captures, tuples and failed originals stay immutable. General retains PHP implementation/publication and SDK owners retain their client work. #429 is delivered; selected-run signals continue separately.

The separate PHP-only #433 source window is confirmed on main bb199cb. General owns WorkflowQueryTaskBroker, WorkerController/query status routing, PHP discovery/current OpenAPI and focused PHP tests/docs. No Composer/version/release/native/shared/frozen change is included; the agreed original UTC-microsecond deadline/status/query-receipt contract remains unchanged.

The only shared-file overlap is #455's documentation of existing opt-in cross_kind_poll_wake / null-task task_queue_changed. There is no semantic conflict: #433 may take current OpenAPI revision 54 from main 53. After the exact qualified PHP handoff, the Rust owner will integrate both additions, advance the combined current revision to 55 and qualify it. Frozen specifications/actors stay unchanged. This window does not establish native query-status support or a combined-tree acceptance result.

PHP source checkpoint: draft #456 is now ead45d6dae09a8d4e78ebc7517f16dd960dce257, tree 1d34ab5de6e7e9e4e2c227b180227efa0302ab8a.

The agreed original timing, capped claim, non-renewing status and committed-receipt boundaries are implemented. Auth/worker role/namespace checks precede query-only receipt reconciliation and external-reference resolution. Legacy missing timing fails the same task/caller. Its fixed refusal tombstone expires from first detection and cannot readmit or complete the task.

Local final query/protocol/authentication/role/namespace suites pass 272 tests / 4,405 assertions, with no skipped controls. Current OpenAPI evolution passes 53 → 54. A separate actual authenticated HTTP control on SQLite/file cache passes 25 checks: exact typed timely result, original caller timeout, late complete/fail refusal, 1.20 observation without renewal, explicit 1.19 status refusal, namespace/role isolation, and original committed duplicate after expiry/registration replacement versus payload conflict.

The race review also reproduced acceptance after loss of queue lock ownership during a database wait. First claim/outcome now refuses that loss. Acquisition timeout is a typed fenced 503/query_task_queue_unavailable; an identical committed failure still reconciles without acquiring the lock. The original deadline is rechecked after the worker-row wait. These are source correctness controls, not a longer lease or a new query budget.

Initial HTTP preparation/observer mistakes and the first unmounted-Git OpenAPI invocation are unsuccessful records, not passing qualification. The corrected distinct HTTP control passed and its namespace/worker were retired. No published SDK handler-suppression or runtime-image claim follows.

Earlier c304aa5c passed all applicable ordinary hosted checks. New exact-head hosted checks and final review remain pending, so the PR stays draft. Current-schema revision 54 / later combined revision 55 coordination remains in force. Native/shared/frozen actors, Composer/version metadata and releases are unchanged. Publication and installed PHP/Python/Rust follow-through remain required before closing #433; Python #143's handler/loading policy is still separate.

Scope/contract acknowledgment for the reported c304aa5 draft: the NamespaceResolver and RuntimeExternalPayloadTransport additions fit the agreed PHP window when authentication, role and namespace checks precede committed-receipt reconciliation, which precedes external fetch/claim. They conflict with no reserved native/shared edit.

A legacy refusal tombstone is fixed at first detection and supplies no execution or successful receipt authority. Its expiry cannot permit readmission of that original identity. Revision 54 for the PHP contract and 55 for the eventual combined specification remain agreed. Hosted/actual HTTP qualification and the exact PHP handoff are still pending; this is not source qualification or native adoption.

Final local review checkpoint for draft #456: d827e7d792b1b6ea089ae0da613a6301e4a248f9 / tree c5a586854ef94d6789270256f5b447cc4771f3db. Current main e603a245 is integrated; its PHP base was unchanged, and the candidate's native subtree exactly equals main.

The final focused query/protocol/authentication/role/namespace suites pass 276 tests / 4,437 assertions, without skipped controls. Additional counterfactuals prove and correct old-poll registration upgrade, stale cached delivery, replacement recovery and loss of the caller's canonical timeout under queue-lock pressure. Replacement gets a new attempt of the same query, preserving original admission/deadline/receipt expiry and keeping the replacement registration active.

A fresh actual authenticated HTTP control on this source passes 41 checks, across three distinct original query IDs. It exercises timely typed values, non-renewing 1.20 status, explicit 1.19 status refusal/timing delivery, role/namespace guards, duplicate/conflict after original expiry and registration replacement, actual same-query attempt-2 recovery, and the original late-query caller's typed 504/task identity plus late complete/fail refusals. All four canonical workflow events stay byte-equivalent as decoded JSON. Original result budgets remain four seconds, configured lease twenty seconds capped by that original deadline. No handler-authority or installed-SDK claim is inferred from a direct HTTP client.

The first observer for this final phase reused an empty poll ID and correctly kept reading its cached empty response. That original is unsuccessful. The separate passing observer uses fresh IDs for fresh polls and retains the actual leased poll ID for its duplicate control. Source and budgets were unchanged between those HTTP originals.

Both namespaces and the registration were normally retired. The development HTTP process exited 143/no OOM, and its containers/network were deleted. Task database/raw/dependencies/cache are being removed immediately. Exact-head hosted gates and final review remain pending; no published, native/shared or frozen-cohort adoption follows. Revision 54 / later combined 55 remains the agreed boundary.

Merged #456 at d8effcf773cb9b356607fb8733c1383744ab8657, whole tree c5a586854ef94d6789270256f5b447cc4771f3db. It is byte-identical to qualified head d827e7d; its parents are current main e603a245 and that exact head. The native subtree is unchanged.

Every applicable exact-head check passes: feature/source, MySQL query HTTP, polling/performance source and both public boundaries. The hosted feature suite reports 2,809 tests / 63,893 assertions, with the existing six deprecations and one skip. Conditional cancellation/prepared-local qualification is skipped. Focused local suites pass 276/4,437 and the three authenticated HTTP originals pass 41 checks, as recorded above.

This delivers the PHP source at current OpenAPI revision 54. Fresh-main checks are pending. No version, publication, installed consumer, native status capability or frozen cohort is qualified by this merge. Rust's later combined schema remains revision 55 after coordinated integration.

Next: exact main checks, a separate compatible Server release/installed-runtime qualification, and Python #143 loading/handler qualification. Python's implementation is source work only; its current published identity is unchanged.

Exact fresh main d8effcf773cb9b356607fb8733c1383744ab8657 / tree c5a586854ef94d6789270256f5b447cc4771f3db now passes every applicable normal check: feature/source, MySQL query HTTP, polling/performance source and public boundary. Conditional cancellation/prepared-local remains explicitly skipped. No candidate pass is substituted for these main results.

The agreed separate PHP-only Server 2.8.0 / Helm 0.1.168 metadata and affected image/consumer window now proceeds. Composer dependencies, native/shared/frozen sources stay unchanged. Exact later qualified source will be sent before combined-tree integration.

Python's remaining worker fence is tracked in draft SDK #151. Both published-runtime and installed-worker qualification remain open. This source delivery does not establish native authority capability or a full SDK loading fix.

PHP SDK follow-through is now owned in sdk-php#172. Normally installed 2.4.1 on published Server 2.8.0 has a timely integer-7 control and two separate delayed original poll-delivery reproductions: the handler runs after the unchanged four-second caller deadline/lease, and Server correctly refuses its late completion. The confirming actual wire has 504 query_worker_execution_timeout followed by 409 query_task_timed_out. This is an SDK dispatch-authority gap, separate from presence servicing and historical Cloud attribution. No PHP Server/native/shared edit or frozen adoption is requested; SDK implementation/publication remains General-owned.

SDK follow-through: Python 2.5.15 is normally published and passes three actual installed-package Server 2.8.0 deadline cases; main/Sample alignment remains pending. PHP source #173 and compatible 2.4.2 draft #174 have passing source and five real HTTP controls, with their final metadata/checks still qualifying. The remaining Rust SDK scope is durable-workflow/sdk-rust#96: published 3.5.4 drops query timing fields in its typed task and lacks managed query-status observation. That is a source finding pending an actual published-package reproduction; no historical cause or runtime qualification is claimed. General retains SDK implementation and publication. Native #433 implementation/qualification remains with its existing owner.

Outside-native documentation finding while porting the settled contract: current server-reference query configuration prose still says effective query leases are at least result timeout +5, and config/dw-bounded-growth.php repeats that policy. Current qualified WorkflowQueryTaskBroker instead uses configured leaseTtlSeconds() capped by the immutable original deadline at claim; taskTtlSeconds() uses timeout + configured lease +60. A short configured lease can therefore expire before the result deadline, while no claim can extend beyond that deadline. The previous prose cannot describe both boundaries. This is PHP-owned documentation follow-through, not a new runtime defect or native/shared edit; please retain the settled capped-lease contract.

The separate current query-authority profile will use normally installed PHP SDK 2.4.2 (25d796ad2a55d0d114b58017c3ba23390b09e120) and published Server 2.8.0 (dd720e6b, image index cba7c4c6732529293ef6c2625a64785dcb21b4f7fe0013fdc74f1af466f534ac). The old shared query actors and frozen tuples remain unchanged.

Initial acceptance exercises a real registered Worker and original waiting workflow: timely typed query on protocols 1.20 and 1.19, a genuine poll reply held beyond the original four-second result deadline, and a synchronous handler returning after that same deadline. It checks one original query claim, canonical immutable timing, non-renewing 1.20 status, no 1.19 status request, no expired callback dispatch or late submission, unchanged workflow history, and actual Worker deregistration. External query loading and Python/Rust directions remain separate gates.

Published PHP and SDK integration controls distinguish caller 504/query_worker_execution_timeout from worker 409/query_task_timed_out; an eligible but unclaimed query uses caller query_task_not_claimed. The prepared native source currently collapses these into query_task_timed_out. I will correct its caller response and add explicit assertions, preserving the worker fence. No fixture will normalize these reasons together. Worker-availability diagnostics and other remaining query gates still require their own qualification. This is a source plan, not an admitted or passing profile.

The separate published query-authority reference passes all four actual PHP cases through runner 084659561cc7001a13a9f8551eaae6a63354df87. Tuple: Server 2.8.0 / dd720e6b, image index cba7c4c6732529293ef6c2625a64785dcb21b4f7fe0013fdc74f1af466f534ac; normal Composer PHP SDK 2.4.2 / 25d796ad2a55d0d114b58017c3ba23390b09e120. Lock SHA-256 febc7361c6a83030e41d6d77b15c4f1502f20751725eda713f0f7cb068a76c96; four loaded SDK class hashes match the published source. Worker runner SHA-256 18844d504353ea425507bb16a0b817944dc4485ac598263fc7f722180bab833b, profile SHA-256 0a7bef60df90998950ca85058845e20260717bec05e83b3aa9a43a119dc0ebba.

Actual case	Original run	Terminal query submissions
Timely 1.20	`01m4yvvp2a3rstvgpbe7fh6ajj`	1
Timely 1.19	`01m4yvvs0mvxc3rqdcjkyzanqd`	1
Actual poll reply held 6 seconds	`01m4yvvvz6qmcp7g84ptx9cjfc`	0
Synchronous handler returns after 6 seconds	`01m4yvw4pyz6zjn4b73e2f6h64`	0

Every original retains its four-second result deadline and unchanged 30-second total observation. Timely typed int64/null/Unicode values are exact. 1.20 observations preserve original claim/timing without renewal; 1.19 makes no status request. Late-poll dispatch count is zero, late-handler dispatch count is one, and both expire without attempting a terminal POST, including rejected POSTs. Exact workflow histories survive unchanged. Worker drain and deregistration complete before the original observation deadline.

Topology: isolated MySQL 8.4, shared file polling cache in the published Apache image, normally installed independent PHP Worker. API 1 CPU/768 MiB, database 1 CPU/1 GiB, consumer 1 CPU/512 MiB, no swap. This is functional qualification, with no throughput or performance claim. An initial preadmission bootstrap failed while MySQL was initializing. The first prototype original also failed an incorrect fixture requirement for an explicit namespace member; published PHP omits it and the published SDK correctly uses its authenticated Client namespace. The corrected profile preserves the raw delivery and still refuses an explicit conflicting namespace. Neither unsuccessful observation is counted as a pass.

Native comparison, external query loading, other SDK directions and all-six qualification remain pending. Native discovery stays false. No frozen actor or existing fixture was retupled. All task namespaces were deleted before retiring the database. Both runtime containers, storage/database volumes, network, installed dependencies and raw records were removed at 04:07:59 UTC, before the 04:15 boundary.

Current installed-consumer query checkpoint, not full-family or capability qualification:

Source/runner 6150afd564fbdb17190dd6e23d520b24fd3e7830, native subtree 6e877e3d56a314e0592ff3d79b79da8497ea7934, actual native executable SHA-256 89e5446953c0c2819078852ea0120a28df739346eb074ac66f1b51b70cb84fae.
Separate MySQL 8.4 databases; normally installed PHP SDK 2.4.2 / 25d796ad2a55d0d114b58017c3ba23390b09e120; immutable published PHP Server 2.8.0 / dd720e6b51844707be2885f8873c23de98c847a7 is the reference. No frozen actor was changed.
Four named-namespace completed-workflow cases pass independently on both targets: timely protocol 1.20, timely 1.19, actual poll reply held six seconds, and synchronous handler returning after six seconds. Each has one original claim, an unchanged four-second query deadline and thirty-second whole observation. Late poll dispatches no callback; late handler submits no outcome. Timely typed int64/null/Unicode results and exact unchanged histories pass. All eight Workers exit zero. Protocol 1.19 issues no status request.
Original PHP runs: 01m4yxc3thgvekazkn00fwawrr, 01m4yxc6fy923k4ve2c2q4b427, 01m4yxc8zrqfds6042fv027qmz, 01m4yxchav117f3ab7mmbqn1ym. Original Rust runs: 01M4YXCWTAM731FVP1Y9Y7BQBW, 01M4YXCYDQTP4SGZREMEMVZBYY, 01M4YXCZWQ3Z4SX9SA431BQY6Z, 01M4YXD79AQPV35B4KAAXHF77Q.
The fifth, active default-namespace timer case passes on PHP (01m4yxcstsd5cnnrvk8jbaz6k3) but the native original remains failed: cleanup calls workflow termination and receives HTTP 501 / rust_capability_not_implemented. No complete passing observation was emitted; this is not rescued by preceding assertions.
Earlier separate originals remain failed: worker-list observation hit the missing native route before workflow admission; after switching both observers to the actual registration acknowledgement, named timer authoring refused development_namespace_command_unqualified. Native worker listing, namespace DELETE, named timer authoring and termination remain outside this query slice. These are native gaps, not PHP findings.

Independent source controls pass: 7 query library controls, 16 SQLite execution query controls, continuation controls, and the two genuine query/continuation tests on MySQL 8.4 and PostgreSQL 17. The prior-runtime counterfactual refuses continuation after the original query expires; the candidate admits it without consuming or rewriting the retained query snapshot. Original live-query refusal remains enforced.

Main does not advertise native query authority. This unpublished candidate enables it only for installed-consumer testing. All-six integration, remaining pressure/availability/transport boundaries, external query loading and other SDK consumers remain pending. These controls establish no performance result. Completed databases, compiler/dependencies and raw transport are being deleted after this audit; this comment and committed source replace bulk retention.

Actual cleanup completed 2026-10-15 04:36:22 UTC, before the 04:40 boundary: both APIs, MySQL/PostgreSQL, isolated databases/volumes/network, compiler/Cargo/dependencies/formatter and all raw transport were removed. Only clean committed source and the readable checkpoint above remain. No bulk retention claim survives this cleanup. Standing workspace services and borrowed input images were preserved.

Integrated source 6a336d8 builds and passes 7 query library, 17 SQLite query execution and 5 poll-wake controls. Its first new installed SQLite profile remains failed before the native cases: PHP original 01m4yy6s22bm8s1aymvgvnrmkr returned the expected timely result and the API logs show both caller and completion HTTP 200, but the observer read its journal after submission and before the Worker appended the completion acknowledgement. It incorrectly required that asynchronous response observation to be present immediately when the independent caller returned. This is a runner observation race, not expiry or a PHP/SDK authority defect. The prospective observer waits for that actual acknowledgement within the SAME original thirty-second whole budget; it does not change the four-second query deadline or rescue this original. Both isolated databases are retired before the revised cohort. No installed/all-six or native capability acceptance is claimed.

Revised installed profile 00268f8 now PASSES all ten fresh SQLite originals: five each on separate published PHP 2.8.0 and native databases with normally installed PHP SDK 2.4.2. Cases are timely 1.20/1.19, actual poll reply held six seconds, synchronous handler returning after six seconds, and timely query against a genuine active timer workflow. Each keeps its original four-second query deadline/thirty-second whole observation, one claim and unchanged history; typed int64/null/Unicode results pass, late originals submit no outcome, and all ten Workers drain/deregister with exit 0. Active originals are PHP 01m4yyaw0gnjxsvttj165y49pz and native 01M4YYBHS4SG9F41YCXK7X347G. Actual native binary SHA-256 e4f2950c05de45bfcffa2e98ae895eaa4a5ce7223b3cdf6eba6c925108251925, native tree 18a406344f28154b0ca2318c2ed2e0477391cdad. Native code is unchanged from integrated 6a336d8, which also passes 7 library query-filter, 17 SQLite execution query-filter and 5 poll-wake tests (groups overlap). Prior observer/cleanup/worker-list/named-timer originals remain failed. Database retirement replaces incidental termination in this query-only profile; no termination acceptance is inferred. Exact-head all-six CI, further SDK consumers and remaining pressure/transport boundaries are still pending. Main query authority remains unadvertised; no release, full-family or performance claim. APIs and data are now being retired after immediate audit.

Named waiting-workflow checkpoint for #325 / #463: source 2e4dab4b6, native tree 7a3b1ca102ee2ae3b7bf7aae1779819a524b4dda, binary SHA-256 c87ac9b4816eb39f2da88929a7ee5aebe375facac0def12419aae4ced042ea98.

Both new regressions fail on the prior runtime at development_namespace_command_unqualified. The narrow correction admits the existing timer command and carries the persisted run namespace through maintenance and timer-task lookup. Both cases pass on SQLite, MySQL 8.4 and PostgreSQL 17: genuine cold two-node recovery, one firing, exact original prefixes/IDs/deadlines, same queue/Worker ID isolation, foreign completion refusal, invalid-batch atomicity and zero-delay firing. Three existing default timer/selection controls also pass per backend. The first MySQL regression database was OOM-killed at its declared 768 MiB limit; those three observations remain failed. A separate fresh 1.5 GiB database run passes with unchanged source and test deadlines.

The unchanged published Server 2.8.0 / normally installed PHP SDK 2.4.2 tuple now passes twelve fresh SQLite query originals, six per separate PHP/native target. The new sixth case queries a genuine waiting named timer workflow: PHP 01m4z011379kphms7wpx0ptxa5, native 01M4Z01QXGAQZVTK9WKWMQKCWY. Both retain the four-second query and thirty-second whole-original budgets, exact typed result and unchanged workflow history. All twelve Workers exit zero; both APIs stop with explicit SIGTERM, exit zero and no OOM.

The earlier failed named original, observer race and unsupported termination cleanup remain failed. Workflow termination/namespace DELETE, full timer/namespace parity, other SDKs and all-six combined qualification remain open. The source is prepared for #463 integration after its admitted originals finish; no pass is carried to another head or capability/release claim made.

Next #325/#463 installed-query controls use separate normally installed Python 2.5.15 and Rust 3.5.5 consumers, preserving the frozen actors. Each target gets distinct named waiting workflow originals: timely default 1.20, explicit 1.19, actual poll reply held six seconds, asynchronous handler expiry, and synchronous handler expiry. Retain the original four-second query deadline and thirty-second setup/query/drain budget, exact typed int64/null/Unicode result, unchanged canonical history, original claim/status identity, one admission and zero attempted late terminal submissions. A bounded HTTP observer forwards the actual request/response bytes unchanged and never rewrites dates or claim fields. All SDK source stays unchanged. Whole isolated database retirement remains caller-owned, avoiding unsupported native termination/namespace DELETE. External query loading and full family/capability qualification remain open, rather than enabling unsupported transport merely to run a fixture. These are prospective controls; no new result is claimed.

Separate normally installed Python 2.5.15 / Rust 3.5.5 query-authority consumers pass 20 actual originals on separate PHP 2.8.0 and candidate native SQLite APIs, at runner a72c632 / whole tree 48726ebcaa1effead9262d65a95c805a07f6a883. This is local source evidence, not all-six acceptance, promotion or a released native capability.

Each language/target passes timely protocol 1.20 and explicit 1.19, actual poll-response delivery held six seconds, async handler expiry and blocking sync handler expiry. Original query timeout stays four seconds; each original has one 30-second whole budget. Timely typed int64/null/Unicode is exact; selected-run history hashes remain unchanged. Expired delivery invokes no handler; async expiry cancels the handler; a blocking handler may return locally but sends no late result. One original claim, immutable query/admission/deadline/owner identity, non-renewing status, Worker exit zero/deregister 200 and observer SIGTERM exit zero/no OOM are checked. Existing PHP SDK 2.4.2 profile independently passes 12 fresh originals in this phase.

Python wheel b905d7e440d5d3708c4570ad8c8986d2ff83149bee6ba4bce209992ad3e8a7dc, source 35aad4ab344cf13e01de3e5f4704380eac1532a6: all 33 shipped modules plus py.typed match the tag; loaded aggregate 88a3d64aee16523fcd577ab005ad6cda094349c4f88ee9f61fec3b8e4e679e57. Rust normal registry 3.5.5 source 4d5047ba9da39785512340b0975ce28da09f0cee and locked crate checksum 04147fcb82f749ea1e308c0a3836e30454efc415d5933884d615ca4aae76bb2e are checked. Native binary c87ac9b4816eb39f2da88929a7ee5aebe375facac0def12419aae4ced042ea98; consumer binary 43f3a9e20ab326721c7793f7486fc30cb799964e61ad3ffdba9256149a6647eb.

The earlier 0.2-second poll-transport fixture remains failed: an HTTP timeout retried delivery of the SAME query 01M4Z1E3FCQR9RJFMK3RNTS6J6/attempt 1/owner/deadline; the observer incorrectly called its second response a second original. No new admission or Server/SDK defect is established. The prospective revision uses an eight-second poll transport window so the unchanged six-second held reply can arrive after the original four-second query expiry. Original query/whole deadlines are unchanged; the fresh controls above pass. Formatting/build-artifact sharing and always-step cleanup placement changed afterward and require the next exact combined hosted qualification. No pass is carried across that source revision.

Native representative originals: Python timely 01M4Z1NQWAT357SYPA997DFH4V; late poll 01M4Z1NZGNDD1ZYHG1A3FRE1HH; async 01M4Z1P96JCFM9E725YNPSP57Y; sync 01M4Z1PGXSRAFFRWWTN2SEEPFS. Rust timely 01M4Z1PSETQMNTRCZ4PYPPW04Y; late poll 01M4Z1QE9RPFP1VMHS7A805J8Y; async 01M4Z1QXCPRMQ6DW7ZWG8T9YHA; sync 01M4Z1R8QWCYPBVR6Y4B85B8TT.

All APIs/Workers/observers and the isolated network are retired. Completed compiler caches, dependencies, installed adapters, raw observations and SQLite databases are being deleted immediately after this audit; code and this readable outcome remain. Existing #458/#463 hosted originals remain independent and unchanged. External-loading, pressure, full namespace/family coverage, one-way takeover and performance qualification remain open.

Early refusal does not require a status request

Yes. An SDK may suppress a query immediately when its validated original timing or an already established monotonic budget has expired. It need not make a redundant status request before refusing. This does not grant execution authority from old timing or relax the final atomic Server fence.

The exact published Python 2.5.15 / 35aad4ab344cf13e01de3e5f4704380eac1532a6 implements this ordering:

QueryTaskAuthority.delivery() checks the remaining budget before the observer is attached.
confirm() checks remaining time before invoking its non-renewing observer. Exhaustion raises query_execution_budget_expired.
The Worker dispatch guard suppresses QueryTaskAuthorityLost before application dispatch.

The qualification distinction is:

A valid original deadline/lease plus the established elapsed budget proves expiry: zero handler invocations and zero terminal submissions is the correct result, with a status request optional.
Work that still has time and advertises protocol-1.20 query authority must use the non-renewing observation path before execution and retain its continuing/final guards. A prior positive observation cannot authorize a later expired result.
Zero callbacks/submissions alone does not prove the deadline case. Retain the actual suppression reason and valid original identity/timing. Refusal for malformed metadata, claim mismatch, unavailable observation or observer failure is a different negative control.
Protocol number 1.20 alone does not establish authority support. Verify actual query_task_authority=true discovery for the observation-capability case. Legacy/local timing refusal remains explicitly weaker. Protocol 1.19 retains its separate timing boundary and explicit unavailable status response.

Therefore an unconditional status-call assertion in every 1.20 late-delivery case is stronger than the settled contract. Preserve the failed originals, inspect their actual suppression path and qualify any corrected fixture prospectively. This settles the requested fixture boundary; it does not classify the reported native originals, explain the separate observer error, change an SDK or establish a new native capability.

Navigation Menu

Repository navigation

Expose and enforce the original query result deadline for SDK workers #433

Problem

Outcome

Proposed observable contract before implementation

Original timing and delivered claim

Observation and atomic mutation

Committed receipts

Protocol and upgrade boundaries

Qualification and ownership

Early refusal does not require a status request

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Expose and enforce the original query result deadline for SDK workers #433

Description

Problem

Outcome

Activity

rmcdaniel commented on Oct 13, 2026

rmcdaniel commented on Oct 13, 2026

Proposed observable contract before implementation

Original timing and delivered claim

Observation and atomic mutation

Committed receipts

Protocol and upgrade boundaries

Qualification and ownership

rmcdaniel commented on Oct 13, 2026

rmcdaniel commented on Oct 13, 2026

rmcdaniel commented on Oct 14, 2026

rmcdaniel commented on Oct 14, 2026

rmcdaniel commented on Oct 14, 2026

rmcdaniel commented on Oct 14, 2026

rmcdaniel commented on Oct 14, 2026

rmcdaniel commented on Oct 14, 2026

rmcdaniel commented on Oct 15, 2026

rmcdaniel commented on Oct 15, 2026

rmcdaniel commented on Oct 15, 2026

rmcdaniel commented on Oct 15, 2026

rmcdaniel commented on Oct 15, 2026

rmcdaniel commented on Oct 15, 2026

rmcdaniel commented on Oct 15, 2026

rmcdaniel commented on Oct 15, 2026

rmcdaniel commented on Oct 15, 2026

rmcdaniel commented on Oct 15, 2026

rmcdaniel commented on Oct 15, 2026

rmcdaniel commented on Oct 15, 2026

rmcdaniel commented on Oct 15, 2026

Early refusal does not require a status request

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions