Enforce original query deadlines and retained result receipts in Rust

[rmcdaniel]

Native query tasks must stop authorizing work at their original deadline, including when poll delivery, codec work or database admission is delayed. This implements Server #433's UTC6 admission/deadline/server-time fields, capped claim leases, inclusive expiry and non-renewing protocol-1.20 authority status. Missing legacy timing fails explicitly. Receipt retention is fixed at admission; matching committed query receipts reconcile before fresh authority, codec and writer fences while conflicting outcomes remain refused.

Controls cover lease/namespace/registration boundaries, held writers and codec capacity, query/continuation interaction and named timers. A separate normally installed PHP 2.4.2 / Python 2.5.15 / Rust 3.5.5 cohort uses immutable published Server 2.8.0 and the native candidate, preserving original four-second query and thirty-second observation budgets. Delayed polls and late synchronous/asynchronous handlers preserve canonical identity without late result submissions. Established original expiry may refuse immediately without redundant status HTTP; unexpired authority-enabled work still observes before execution.

Current head 083419709e701f6f122c06a57c4af03c5305e175, whole 98775e68b78edaeec54e867ac06baca797b5c50a, passes every applicable ordinary check and all 13 shared jobs in 38729792013. All six independently audited execution summaries have 29 passing comparisons and 20 zero exit records, matching whole/native/binary identities. Conditional prepared-local/cancellation source qualification is skipped. Earlier failed run 38692717327 remains failed with unresolved MySQL 8.4/PostgreSQL 17 client failures.

This integrates qualified release-workflow-only main 28914d25. Strict up-to-date protection remains enabled. Exact merged-main acceptance is separate. Remaining external-loading, pressure/route/continuation boundaries and full query-family acceptance remain open. Published native images, migration, performance and Cloud adoption are unqualified. Frozen actor tuples remain unchanged.

[rmcdaniel]

Actual local cleanup completed 2026-10-15 04:52:33 UTC, before 05:10: both APIs stopped with exit 0/no OOM, isolated SQLite databases and network retired, compiler/Cargo/vendor/target, raw records and all phase scratch deleted. Only clean pushed source remains. Installed ten-original outcome is Server #433 comment 6184690034; earlier failed originals remain failed. This draft now owns fresh hosted all-six qualification; no inherited pass or promotion claim.

[rmcdaniel]

Current 8e4cb2e Public Boundary is failed at Docker workflow isolation: the new cleanup script aliases its job-scoped container name to a generic variable that the existing checker cannot prove scoped. This is not a secret-leak finding or an observed foreign cleanup. I am making every stop/removal name explicitly start with RESOURCE_SCOPE, preserving the ownership guards and identical cleanup behavior; no checker relaxation. Local syntax and policy checks are running. The already admitted exact-head fixture originals continue unchanged, and this failed head will not be promoted.

[rmcdaniel]

Prospective cleanup-only revision passes the existing Docker isolation checker and all 72 policy controls locally; shell syntax also passes. Stop/removal operands now show their exact RESOURCE_SCOPE prefix directly, and redirection remains attached to its filename so the checker does not misread a log path as a container operand. No checker, timeout, native runtime or observer behavior changed. The admitted 8e4cb2e all-six run continues; its failed boundary check is not relabeled. The fix remains local until those originals terminate, then the next pushed head will qualify independently.

[rmcdaniel]

The missing timer namespace binding is now reproduced on real SQLite/MySQL8.4/PG17 and corrected locally at a78956c. The same strengthened cooperative-cancellation test fails all three before correction: network delivery503 with protocol errors, SQLite original timer task still ready. It passes all three after correction, preserving the same original timer task identity, canonical cancellation, original cleanup deadlines, duplicate outcomes and cold-pool controls. Both cancellation delivery and terminal cleanup now derive the timer lookup namespace from the already selected canonical run row. Fresh corrected-source SQLite passes75 library tests (18 existing database-only ignores) and125 execution tests, with zero failures. The old named-timer-refusal assertion is independently corrected to the still-unqualified child-command refusal; its actual namespace/lease/atomicity control passes all three databases. No PHP/SDK, timeout, resource or wire contract change. Current396a hosted attempt2 remains immutable and unqualified; no push until its terminal result. This is an unpublished native regression, not an explanation for historical PHP503 records.

[rmcdaniel]

The complete thin-artifact audit of run 38689876829 attempt 2 preserves two additional query-client fixture failures: PostgreSQL 17 stops at the PHP/Python synchronous-handler case with an observer error whose underlying message was not included in the thin artifact; MySQL 8.4 stops at the native/Python held-poll case because the fixture universally requires a status HTTP request. MariaDB, MySQL 8.0 and PostgreSQL 16 each retain their completed 20-client comparison, but that component result does not qualify their failed whole jobs. SQLite's obsolete namespace-refusal expectation and the separate five network cancellation failures are recorded above.

The agreed boundary in #433 comment 6186035687 permits immediate refusal on valid original expiry or an established expired monotonic budget, without a redundant status request. A corrected fixture must retain the actual expiry reason and valid canonical identity/timing, verify query_task_authority=true discovery for authority observations, and preserve status checks for unexpired work and later execution fences. Zero callbacks/submissions alone do not prove expiry. The observer error remains unexplained and must be captured rather than ignored.

Run 38692717327 is already admitted against 1738222868444f85f330ad093c7f046996bdee06; these findings are not fixed by that revision and no pass is claimed in advance. Original failures remain failed; the next fixture revision will be qualified separately after the current originals terminate. No PHP/SDK correction or historical native cause follows from this audit.

[rmcdaniel]

Prepared fixture correction 2b59918b07d5607212a4f19bafefe0185085978a (whole tree 73f76d8086a5815feab1a8c955a92654e9e23fa6) waits for actual expiry disposition before worker shutdown: an observer's pre-write delivered event alone does not prove SDK refusal. Python captures the normally installed SDK's public logging, binds its actual reason to the original task and timing, and permits no-status refusal only with expiry proof and affirmative query_task_authority=true discovery. The observer validates canonical claim identity/timing and retains bounded method/path/error diagnostics. Rust's recipe waits for an actual expired observation; an immediate local refusal without a public reason stays unqualified rather than being called an SDK defect. No SDK/runtime/frozen actor changes.

Five separate fresh published Python 2.5.15 / immutable PHP Server 2.8.0 SQLite controls PASS with original 4s query / 30s whole budgets: timely 1.20 (8 status reads), held poll (one status, actual query_task_timed_out, zero callbacks), async handler (one cancellation, query_execution_budget_expired, no submission), synchronous handler (one late return, query_execution_budget_expired, no submission), and timely 1.19 (zero status reads). Every 1.20 control observes actual affirmative discovery, every observer exits 0/no OOM, and the API exits 0/no OOM under explicit SIGTERM. Query history hashes remain unchanged for each original. This phase does not exercise a no-status expiry path, native/Rust recipe changes or PostgreSQL; their qualification remains ahead.

The earlier PostgreSQL observer error did not recur here and remains unexplained. This does not establish why the prior MySQL fixture lacked status. Original hosted failures remain failed, and current run 38692717327 stays unchanged until terminal before this revision is integrated. All local runtime/data/dependencies/raw resources are being retired immediately; only active source will remain.

[rmcdaniel]

The PostgreSQL 17 job in 38692717327 fails in the installed query-client phase at source 1738222868444f85f330ad093c7f046996bdee06, tested merge 3c05f8175eb57656a81404ffaebaf9d987034816. Artifact 11955168266 preserves 12 passing PHP SDK controls against the separate PHP/native targets and ten passing Python/Rust consumer controls against PHP. It records profile exit 1 before the native consumer comparison is produced. The failing client error was omitted when the 128-entry exporter limit was reached. The hosted job log also lacks that error. Cause is unestablished; this does not prove a Server or SDK defect. The other admitted cells continue unchanged.

Prepared fixture source 1f78f6b975c09b8de9589e50b8f9200464601497, tree bbd2c6c3f6974145ab124f8e6a390fd1d4ef8b2a, now prints bounded client/observer failure tails in the job log and prioritizes those diagnostics over completed setup logs in failed artifacts. Limits remain 128 entries, 64 KiB per file and 2 MiB total. Its six exporter tests pass; the new saturation regression fails against the unchanged parent exporter with the missing error file. Bash syntax and diff checks pass. This is a separately pushed preparation branch, not a new full-matrix submission or a qualification of the revised whole fixture. Earlier actual component checks remain scoped to their original sources. Downloaded diagnostic ZIP and temporary files are removed after this audit.

[rmcdaniel]

Run 38692717327 is terminal at the unchanged 1738222 source: SQLite, MariaDB 10.11, MySQL 8.0 and PostgreSQL 16 execution jobs PASS, as do all six codec/deadline health jobs. MySQL 8.4 and PostgreSQL 17 fail in the installed query-client phase. The separately inspected MySQL 8.4 artifact 11954489734 retains the twelve passing standalone PHP SDK controls across PHP/native, but no completed installed-client comparison or failing client error. PostgreSQL 17 additionally retains ten passing installed clients against PHP as already recorded. Both failed originals remain failed, with cause unestablished. Prepared fixture 1f78f6b retains the actual expiry disposition and bounded client errors for fresh qualification; no source, budget or actor was changed in these terminal originals. No all-six pass or promotion is claimed. Downloaded audit inputs are deleted.

[rmcdaniel]

Five actual revised Python/native SQLite query originals PASS with unchanged four-second query and thirty-second whole-case budgets. This uses prepared fixture c184f28da460db4b406ecb6eef6396c768d6dc6d, normal installed Python 2.5.15 from hosted artifact 11953275864 (all 34 shipped files reverified), and the existing release binary from artifact 11952449937. Native build provenance is tested merge 3c05f8175eb57656a81404ffaebaf9d987034816 of source 17382228, subtree a633a63950d7d1e72902995b6e47156daaa419ff, binary SHA-256 c2d8ea97b3a58692708314990aeace096bb59073ed2d3ce39e98e74adcfd76ff. No compiler or new SDK source was used.

Case	Original run	Status reads	Actual outcome
Timely 1.20	01M4Z8YRZK60XPQAHTGJCZM40M	8	Exact int64/null/Unicode result, one callback
Timely 1.19	01M4Z8YWHRFQM77C0XC5BNAM8H	0	Same typed result, one callback
Held real poll reply	01M4Z8Z04T2ZKFZ13SR3HA84XM	1	Original query_task_timed_out, zero callbacks/posts
Late async handler	01M4Z8Z9MBVZDNV92SAP84VA89	6	One cancelled callback, original query_execution_budget_expired, zero posts
Late sync handler	01M4Z8ZH3HPQ7X2E0WT5ADXNG0	6	One late return, same original expiry reason, zero posts

Every 1.20 control observes actual query_task_authority=true; canonical original identity, microsecond timing and exact status identity are checked. Each original history hash is unchanged across the query, and each Worker exits zero. All five observers and the native API stop via explicit SIGTERM with exit 0 and no OOM. The stopped native snapshot has five still-waiting parents with four events each; this is query qualification, not five completed parent workflows. An initial optional read-only SQLite probe could not open the WAL-mode file. After verifying the sole API had exited and no sidecars remained, the corrected immutable stopped-snapshot reader succeeds without changing the database hash. No original workflow or query was rerun or rebudgeted for that reader correction.

The fixture also passes seven focused exporter/HTTP validation controls. Exact parent counterfactuals show invalid calendar dates and a one-microsecond deadline change were previously accepted. Failed artifacts now retain bounded client errors ahead of completed setup logs, within unchanged retention limits.

This is a source-specific SQLite Python component observation. It does not qualify the no-status expiry branch, revised Rust consumer, PHP component at this fixture source, the new declaration tree, migration or full hosted matrix. Earlier failed MySQL 8.4/PostgreSQL 17 and observer originals remain failed and unexplained. All local binary/dependencies/DB/raw and runtime resources are removed after this audit; code and this readable outcome remain.

[rmcdaniel]

Prepared replacement source is now 3c8589f26b924ba83ec3039c98fa823c75807bfe, whole tree b0452b00d67c8bb9795edfa984673a430f348af5, on rust-325-query-authority-observation. It incorporates #458 688ee3ea and exact qualified PHP 1f994962; PHP application/Composer/release/chart bytes match that source and Controller SHA-256 remains 12b2fb5224e2a4de32e4113c8f29f7f1901841dd49fc9b6aba66e7bd341ed208.

All seven observer/exporter controls pass after integration. The query native subtree remains a633a63950d7d1e72902995b6e47156daaa419ff. This is source preparation only: the current PR head stays 17382228, whose MySQL8.4/PG17 client failures remain failed with unknown causes. The revised diagnostics preserve actual expiry evidence and microsecond timing under the existing artifact bounds. No expected SDK status request is added to an otherwise valid immediate expiry refusal.

The earlier five actual Python/native originals qualify their recorded c184f28d fixture component, not this whole tree, the Rust client, a no-status branch or the pending hosted matrix. Next is completion/promotion of the already admitted #458 parent qualification, followed by a fresh query matrix at the exact replacement source. No additional full matrix has been submitted for this preparation. Frozen actors and all failed originals remain unchanged. The one-off Node test container exited and was removed; no local runtime/cache/raw state remains.

[rmcdaniel]

The original candidate 76c6d35a4768172145ab44cf17afd9751a72d41c now passes every applicable ordinary check and all 13 shared jobs in run 38713356493. Its synthetic checkout 4c10fdf23ba63da43363dcca3498619edec75e29 has the identical candidate tree b0452b00d67c8bb9795edfa984673a430f348af5. All six execution artifacts were independently checked against their published archive digest, revision, native tree a633a63950d7d1e72902995b6e47156daaa419ff and execution-binary hash 43c83dffe7001c4aaec3684012979b466aca43fb6f8a4f6c7382c4d506a625b8. Each has 29 passing comparisons and 20 successful profile statuses. The remaining MySQL 8.0/8.4 and PostgreSQL 16 artifacts also retain 12 PHP SDK originals and 20 Python/Rust SDK originals per database, including timely 1.19/1.20, delayed delivery and late handlers. Conditional prepared-local/cancellation source qualification remains skipped. Earlier failed originals remain failed and unexplained.

After that original run became terminal, I incorporated General's fully qualified PHP security source f7d1bfc78ffaf32848aeb48bd736356cc44501c8 through merge 500299d6e8980f023972c8d3abd2326cfd87539b. New submitted head ee219c0b49926184efe4b73bf4077500259b6aa4, whole tree d665c3d9ed53e1f8c8b22f136060890c4ec57b68, preserves the native tree, shared fixtures, runner and OpenAPI. PHP application/dependency/security/release bytes match the qualified handoff. Fresh whole-tree checks are required; no previous pass carries across this integration. The PHP tag's separately rebuilt image is undergoing its own installed qualification, so the earlier image consumer pass remains bound to its earlier immutable index. No image adoption, complete native capability, performance, migration or release claim follows. Downloaded audit ZIPs were deleted after inspection.

[rmcdaniel]

Exact ee219c0b49926184efe4b73bf4077500259b6aa4 combined PHP-source candidate now passes all 13 jobs in 38721415410. All other applicable candidate checks pass; the conditional cancellation/prepared-local source job is skipped.

The executed synthetic commit is dd8836e8ff0372f46c6d72c6930546aad45beaf0, parents qualified PHP f7d1bfc7 and ee219c0b. Its whole tree d665c3d9ed53e1f8c8b22f136060890c4ec57b68 equals the candidate. Native tree is a633a63950d7d1e72902995b6e47156daaa419ff; every execution cell reports debug binary 43c83dffe7001c4aaec3684012979b466aca43fb6f8a4f6c7382c4d506a625b8.

All six bounded execution archives were independently digest-checked and read. Each contains 29 passing comparisons and 20 zero exit records with the exact revision/native/binary identities above:

Database	Artifact	ZIP SHA-256
SQLite	11968439146	8bb2ad8ec900ed13535a8d3f5399b34fd9471b8462cb66509bb1f53c5056c8ac
MySQL 8.0	11968852864	e5bcc1d918293449d7cab7bd87d1203fb22461aabd97c0cb7f63c6a9c100818b
MySQL 8.4	11969726862	726d7b65565e6013b6f5961479ee4d8699364b388a15394c01c90f6f266e5503
MariaDB 10.11	11969416061	2aeb30d211a24124cdbff08360949ba55a9adeddb0451ebe3a0e80be8463ab75
PostgreSQL 16	11968801183	19dc281b7b6cb5d2c251238de3a8a2d421337e96549393ed51bd5255a86f0e65
PostgreSQL 17	11968069856	3b95f3d19ccdec4b0c1bc6d1e5e33c1477aa1367ea5bcedf87f37e67cbe45307

The reference images, SDK tuples, original query deadlines and strict reader checks remain frozen. Earlier failed run 38692717327 remains failed with its unresolved MySQL 8.4/PostgreSQL 17 client failures; this later result supplies no historical cause.

This qualifies the exact ee219c0b / PHP f7d1bfc7 source tree. Main has since received qualified release-workflow-only #475 at 28914d25; that tree is not covered by this run. Strict up-to-date branch protection remains enabled. Next is narrow current-main integration and its required qualification before promotion, followed by fresh-main acceptance. No release, migration, performance or full query-family claim is made. Audited transport ZIPs were deleted immediately or streamed without a host file.

[rmcdaniel]

Exact current-main integration 083419709e701f6f122c06a57c4af03c5305e175 now passes all 13 shared jobs in 38729792013, every applicable normal source check and boundary checks. Conditional prepared-local/cancellation qualification remains skipped.

All six bounded execution archives were independently streamed and checked against published byte counts and SHA-256. Each contains 29 passing comparisons and 20 zero status records. The five network-database logs each report 125 execution tests passed with zero failures/ignores. Synthetic merge f8964fad4fcabfe0d6a29875f94d32eedd78fb0b has exact parents 28914d25 / 083419709 and whole tree 98775e68b78edaeec54e867ac06baca797b5c50a. All six bind native tree a633a63950d7d1e72902995b6e47156daaa419ff and binary 43c83dffe7001c4aaec3684012979b466aca43fb6f8a4f6c7382c4d506a625b8.

Database	Artifact	SHA-256
SQLite	11973472878	6375a71c88f5a2e1cde84451080e8c71b5eefedc3c4b39fce97755e18f94ea5b
MySQL 8.4	11974063819	fac4e474b8b2d9aca0e7821c46cdd52144cc14be4ef3a3cec6eee6410775afa3
MySQL 8.0	11974653703	d4944c14a2ead09a6d9c18ba0c7bcec6b97ae0e9f26d90d106f97e0a61e66ad2
MariaDB 10.11	11974332595	80ca061c06611108f70e335e571b4f059c893775354f25845b1174b1891a3ced
PostgreSQL 16	11974756534	144146035f5d8bcfad321f4a7b2b4c2159bd20285ddd7c7dee3ae68b949de211
PostgreSQL 17	11973538735	22409fc59d4e068251a8b7d8637a0097b50eb99247388f74989f45cb41cf1804

The source and contracts were reviewed for original UTC6 deadline/lease preservation, non-renewing status, registration/namespace fencing, receipt-before-fresh-fence ordering and refusal of conflicting outcomes. Valid established expiry may refuse before redundant status HTTP; unexpired authority-enabled work still observes before dispatch. Frozen published actors and all failed originals remain unchanged. This qualifies this source integration, not every query-family boundary, a native release, migration, performance or Cloud adoption. Merge and exact fresh-main checks are next. No archive/extraction collection was retained locally.

[rmcdaniel]

Merged as 0934c46d493a5ec4e4978c52d4fb8a38bb0a56a1. Its whole tree 98775e68b78edaeec54e867ac06baca797b5c50a is identical to the reviewed candidate and tested synthetic merge; parents are exact 28914d25 / 083419709. The remote head is deleted and independently returns 404.

Separate fresh-main Shared Server fixtures 38738455163, Feature 38738455170 and boundary checks are admitted and pending. Candidate passes are not reported as fresh-main acceptance. No native release, published-image or full #433 closure follows.

[rmcdaniel]

DELIVERED source/main: merged0934c46d493a5ec4e4978c52d4fb8a38bb0a56a1 / whole98775e68b78edaeec54e867ac06baca797b5c50a / nativea633a63950d7d1e72902995b6e47156daaa419ff now has independent fresh-main Shared38738455163 ALL13/all-six PASS. Feature38738455170 and boundary38738455188 also PASS. Every database summary was streamed and digest/source/binary audited:29passing comparisons and20zero exit records each; all six execute125 native HTTP tests without failures/ignores. SQLite library75PASS/18existing explicit ignores. All report exact0934 and binary43c83dffe7001c4aaec3684012979b466aca43fb6f8a4f6c7382c4d506a625b8. Artifacts11978502224(SQLite),11977003584(PG16),11978542109(PG17),11978819905(My80),11980331793(My84),11978601304(Maria); originals remain in GitHub and no local ZIP/extraction is retained. The tested whole tree equals the reviewed candidate/merge; merged remote head is absent. This delivers this query-authority source slice, not a released native image, full query-family/325 acceptance, migration or cutover. Targeted-result470 d83 and metadata476062 retain independent gates and their failed originals; earlier query failures remain failed/unexplained. Frozen PHP/SDK actors and budgets are unchanged.