Enforce original Nexus deadlines in the published Server

[rmcdaniel]

Summary

Addresses Workflow #761 and the published deadline regression in #405.

• Reject malformed deadline policies with HTTP422 before catalog create/update or a new call admission.
• Preserve an authorized duplicate's original accepted call even if the current catalog has changed.
• Expose original acceptance and call deadline as UTC timestamps with six fractional digits.
• Document original-budget expiry, independent late target completion and the required upgrade backup.
• Pin published Workflow 2.5.12 at 19a7a1cf33604c66f1f838e8b3db22563041f6b2 with one package update. Other locked dependencies are unchanged.
• Prepare Server 2.5.23 / Helm 0.1.160 using the existing source-release generator, keeping Compose and chart defaults consistent.

The source change preserves the native work merged in #406 and #408. The behavior change is in the PHP controller and affected tests/docs. Native implementation and shared differential work stay with their owning change.

Verification

The actual Packagist 2.5.12 installation passes 91 selected catalog, execution, boundary, worker-operation and query-service tests / 1,011 assertions, Pint on all three affected PHP files, Composer validation and the package-authority check. It uses the locked dependency graph without a source overlay. The source-release generator reports synchronized Server 2.5.23 / Helm 0.1.160 consumers. Normal PR/main gates, rebuilt image and the published original-deadline fixture remain required.

Workflow's full main gate passes 3,839 unit tests / 49,740 assertions, coverage, all database shards and five Laravel upgrade checks. Its published package verification passes all 16 Laravel/PHP upgrade cells.

Coverage includes strict policy boundaries, unknown/both fields, invalid calendar/offset/precision/range, legacy unsupported policies, original acceptance-relative budget and catalog changes across authorized duplicate requests.

[rmcdaniel]

Reviewed exact head ecff18a41140a459603871cdd4cec04e8ac0a46b against current main 748e01bd46b0ab1f98665417b9384392e287c60e.

Strict policy validation precedes new catalog/call side effects, while the authorized duplicate path retains the original stored budget independently of catalog changes. UTC microsecond serialization matches the published package contract. Tests exercise actual admission and delegate duplicate reads to the real control plane. Only Workflow changes in the lockfile, to published 2.5.12 at 19a7a1cf33604c66f1f838e8b3db22563041f6b2. Generated release consumers consistently select Server2.5.23 / Helm0.1.160. Native owner408 is preserved.

Actual installed-package checks pass91 selected tests /1011 assertions, Pint, Composer validation and package authority. The source-release generator check passes. No issue is found in the source review. Exact-head normal checks and subsequent main, image and published deadline checks remain required for delivery.

[rmcdaniel]

Confirmed #409 is based on merged Rust/child source 748e01bd46b0ab1f98665417b9384392e287c60e and preserves #408. Workflow 2.5.12's published release/tag resolves to 19a7a1cf33604c66f1f838e8b3db22563041f6b2.

The existing child/runtime cohorts remain frozen. Native/shared Nexus qualification will use a separate exact published tuple after the qualified PHP image and #405's original-deadline, late-target and post-expiry duplicate results are available. The owning native gate must preserve the original immutable deadline and same-row expiry/completion fence; the package publication alone does not establish native compatibility. Current #408 main Shared follow-through remains running; PHP/source and boundary pass. Timer SDK/cold replay is the next separate fixture slice.

[rmcdaniel]

Server 2.5.23 and Helm 0.1.160 are published from merged #409 at fc4ab18a9717247813ffef1e1e587d6ad105a7c2, with published Workflow 2.5.12.

The protected release passes both architectures, source-free startup/Compose, protocol capabilities, source identity and clean anonymous Helm installation. Docker Hub and GHCR expose the same verified index sha256:658ba2542d93cd982165391a7d50ef1bad769871e4e355428803060883e41906. Published PHP/Python/Rust lifecycle and all four Compose cells pass.

Merged #405's main published regression passes both actual original-deadline and post-expiry duplicate cases. Sample App #201 is updating the runnable examples and its prepared playground to the qualified stable tuple. Workflow #761 remains open through that final consumer follow-through. This qualifies the deadline fix, while Workflow #753 retains the broader Nexus recovery and inspection work.