Fence query loading and handler dispatch to original task authority

[rmcdaniel]

Query loading and handler authority

Implements the remaining worker side of #143 against the agreed authority contract. Server #456 is merged source; its published-runtime qualification is still pending.

• Preserve the original delivery budget through external loading, replay, handler dispatch and result submission. Suppress expired or unverifiable claims without invoking the handler or admitting another business query.
• Use non-renewing 1.20 status when the registered runtime advertises query authority. Keep explicit 1.19/older-Server local lease checks distinct. require_query_task_authority=True refuses unsupported registration.
• Check after replay immediately before the handler. Cancel bounded async work and active loading when authority ends. A synchronous handler already running is not forcibly interrupted.
• Reuse verified immutable references within one query response without enlarging the persistent cache.
• Keep public local query_state behavior and the caller's first canonical failure. Existing terminal receipt reconciliation remains a separate operation.

Verification

Source controls currently pass 675 tests, with two existing platform skips, including 22 focused authority controls. Ruff, mypy and the unchanged corpus policy pass; replay corpus grows from 59 to 60 without rewriting historical fixtures.

The new minimal expired-delivery command fixture passes this candidate and fails normally installed 2.5.13: the published worker invokes its handler and returns completed after the supplied original lease expiry. This is a worker-dispatch regression fixture, not invented durable history.

A broad local run exposed mock deliveries missing real lease metadata, a missing Git tool and subprocess-reaping constraints. Mock deliveries now supply ordinary lease metadata, and the old deficient parity fixture stays byte-identical and is explicitly refused. After correcting tooling/reaping, the full run reports 2,817 pass / four fail / two existing skips. The four failures concern prepared-group callback stop/admission, outside the query path. An independent unchanged-main 0e8477b control reproduces the first exact failure (prepared group callback stop remains unconfirmed), so no new query regression or underlying cause is inferred. That local full run remains failed.

Hosted checks, actual slow-input/query runtime controls, compatible stable backport/publication and normal installed consumers remain ahead. The source is not qualified by the focused tests alone.

No package version change, Nexus publication, native query capability or historical Source-cohort attribution is included. #143 remains open through those consumer gates.

[rmcdaniel]

Final review found and corrected two additional worker-boundary gaps in c8bd520:

1. Runtime payload transport discovery now consumes the original query loading budget, including when its discovery request stalls.
2. Attempt identity remains an integer: changing 1 to boolean true cannot reach the handler through an interceptor.

Both new tests fail the preceding exact source f1877ef (late discovery and a completed handler respectively). Corrected source passes 86 focused payload/authority tests, Ruff and mypy; its compatible stable backport passes 85, Ruff and mypy. The count difference is the existing branch-specific payload suite, not a skipped new control.

All ordinary hosted jobs passed on f1877ef; new exact-head checks are required after these fixes. The earlier failed broad local prepared-group run remains failed, with the unchanged-main reproduction described above. No result was replaced or reclassified.

Separate stable draft #152 starts from published 2.5.13, excludes main's pending Nexus and passes actual ordinary Worker/query compatibility controls on published Server 2.6.3 in default 1.20 and explicit 1.19. Strict authority requirement refuses before registration. New-runtime loading/handler and published artifact gates remain pending; #143 stays open.

[rmcdaniel]

Merged the independently qualified portal selector into source head 6a5cda9. Query runtime source is unchanged. Normal PR CI 38670784282 owns the new combined tree. The redundant manual dispatch 38670778493 is cancelled before any integration Server/worker admission, retaining its completed static/package results without claiming full acceptance. Published 2.5.15 and its separate real Server 2.8.0 HTTP acceptance remain unchanged; no rerun or new source release follows automatically.

[rmcdaniel]

Reviewed final 6a5cda9f21c247948d13194c02fef6547268e75c against current main and the published 2.5.15 backport. The original claim budget is retained before loading, monotonic ceilings only shorten, protocol 1.20 status is non-renewing, 1.19 stays explicit, and authority loss cancels/joins managed asynchronous work without a fabricated task failure. Direct Client receipt operations remain available. The final merge includes the already qualified selected-tag portal guard unchanged.

All final PR checks pass, including CI 38670784282 integration, corpus, Python 3.10–3.12, lint, package, portal and branch qualification. Published 2.5.15 installed HTTP acceptance and its limits are recorded on #143. Main retains its existing source-only Nexus work; this merge does not publish or advertise that work, and docs remain selected from the qualified stable tag. No further findings in this review. Downstream Sample pins remain the next consumer action.

[rmcdaniel]

Merged source alignment as abefa99b732eda958e11b6ac09ff3806ba1c537e, tree f7efbb8b94353576c577723714d7b1b998f84e0c, identical to the reviewed final head. CI 38670784282 and every applicable PR check passed. Fresh-main CI 38674083252 is separate and pending. The merged remote head is deleted and independently returns 404.

Published 2.5.15, its normal installed three-original HTTP qualification and the selected stable-tag portal remain the customer artifact. Main retains its existing unpublished work and does not replace that documentation deployment. Sample pin/build acceptance is the remaining consumer follow-through for #143.