Enforce original Nexus call deadlines and fence late results

[rmcdaniel]

Original Nexus call deadlines

Addresses #761 after the published regression accepted one-second policies but delivered late success in both namespaces. Keep the issue open through package publication, HTTP validation and the published Server regression. The deadline contract is coordinated with the Rust owner on #761. This PR changes the PHP package and embedded implementation, with native/shared rewrite work retained by its owner.

The implementation defines strict policy validation and resolves call_deadline_at from the original acceptance instant. It preserves the stored snapshot through duplicate/deferred dispatch and catalog edits, stores the deadline in UTC with microseconds, and fences completion, failures and cancellation under the same call lock. The existing background repair pass enforces expiry without an API poll, including calls without a queue-owned run. Late target history remains legitimate without replacing the original timeout or delivering another caller result.

The versioned migration backfills stored original policies and acceptance timestamps using the existing Laravel timezone convention. It preserves null policies, safely repeats an interrupted backfill, and rejects unsupported historical policies with the affected call identity. Operator docs require a database backup and replacement of old application/worker processes. The existing discovery manifest publishes the precise deadline contract, with no new worker protocol.

Original boundary admission saves the acceptance timestamp and resolved deadline atomically, so a crash before dispatch remains recoverable by the existing deadline repair pass. Six admission tests pass with 40 assertions. The complete official cold-replay corpus passes locally with 57 tests and 2,956 assertions. Earlier affected verification passes 163 tests / 7,811 assertions, with focused deadline, precision and pure-contract checks. Static analysis passes across src/tests and affected files are formatted.

All normal PR checks pass at b84b59010ea183119cc68b85f4a66c13838a0b68, including quality, official regression corpus with its counterfactual proof, unit contracts, MySQL feature cases and public boundary checks. The full main database, Laravel upgrade and coverage gates must pass before a stable package release. Publication and the installed Server #405 reproduction remain required before closing #761. The PHP HTTP catalog validation and final published-image follow-through are part of that remaining delivery. Native/shared implementation remains coordinated on #761.

Null policy retains linked-target timeout behavior. A call deadline does not silently cancel the target. Catalog edits, retries, duplicates and migration cannot restart the budget. Expiry wins at the transition boundary and late target results cannot overwrite the original caller's typed timeout.

[rmcdaniel]

Implementation review

Source d54da76c0a075a912b92ddb59d04618e517f22da, tree d9c2ca5d775ebf2efa027a6f7ba6b3cdb90fee46.

• Policy resolution rejects ambiguous, invalid and unbounded input before acceptance. UTC storage and wire timestamps retain six fractional digits. Null policies retain target limits.
• The original acceptance, policy and deadline survive deferred dispatch and later catalog edits. Completion, late failure, cancellation and linked terminal history use the same call row fence. Expiration wins at the boundary.
• Repair expiration is bounded and queue/run scoped, including unlinked calls without a queue owner. Caller delivery uses the existing durable admission and task claim mechanism, retaining original call/run/sequence and preventing a second result.
• Migration derives deadlines from stored acceptance, preserves already resolved values, and rolls back invalid backfill input instead of using upgrade time. Docs require backup, stopped old workers/app processes and unchanged original Laravel timezone interpretation.
• The additive discovery contract changes no worker protocol. Interface report additions are optional for existing custom MatchingRole implementations.
• The new immutable fixture is consumed by the official replay runner and embedded executor. Hosted counterfactual validation passes. No native Server rewrite or reserved agent changes are included.

Remaining merge gate: full exact-source database, upgrade, coverage and repository checks. Remaining delivery gate: package publication, PHP HTTP policy validation and rebuilt published Server regression/conformance. Issue #761 must remain open through those gates.

[rmcdaniel]

Final admission review

Source b84b59010ea183119cc68b85f4a66c13838a0b68, tree 47ecea5333cb2733e0b31db6023869a756b4b0fa. This supersedes the preceding exact source review with the two-file admission delta.

Server boundary admission uses ServiceBoundaryAuditRecorder before dispatch. It now resolves and writes the deadline together with the original acceptance instant. Unsupported policy input cannot persist an accepted audit row. Null policy remains null. A stopped process between acceptance and dispatch therefore leaves an inspectable immutable deadline that the normal bounded repair pass expires without an API poll.

Six focused admission tests / 40 assertions pass, all src/tests static analysis passes and the complete local file-backed replay corpus passes 57 tests / 2,956 assertions. Current hosted official counterfactual corpus, source quality, repository and PR unit contracts pass. The PR MySQL feature gate remains required before merge; normal main database, upgrade and coverage checks remain required before release. No published delivery claim yet.