Release stable deterministic workflow-start clocks as 2.5.13

[rmcdaniel]

Stable 2.5.13 backport of #147 fixes changing cold-replay clocks when an actual WorkflowStarted supplies canonical recorded_at without an explicit payload timestamp. now() and UUIDv7 retain the persisted workflow-start time; explicit payload timestamps keep precedence, and malformed/missing clock input is diagnosed.

The backport contains only the clock correction, focused controls/new corpus reproduction, and patch metadata. Client/Worker, the corpus guard, retained histories and pending main Nexus producer remain unchanged. Python's workflow-start clock does not adopt PHP's per-command clock advancement.

Source validation passes 310 focused checks, Ruff and mypy; normally installed published 2.5.12 fails all 27 new regressions and passes both compatibility controls. Exact stable artifact, complete source/stable CI, normally installed actual wire/worker consumers and publication verification remain required.

Refs #146 and #147.

[rmcdaniel]

Reviewed source3abe8abc and stable2467639c against their respective bases. The stable backport changes only persisted-clock replay, focused controls/corpus and2.5.13 metadata; Client/Worker and pending main Nexus are excluded. Explicit payload timestamps retain precedence and offsets. Otherwise canonical WorkflowStarted.recorded_at seeds the fixed start clock; nonempty replay never constructs a wall clock, and clock helpers refuse missing/malformed/naive persisted times. UUIDv7 uses that same validated clock. This does not adopt PHP per-command clock advancement.

Normally installed private candidate wheel with unchanged source module hashc60db124 passes159 installed clock/corpus/marker controls with pytest-asyncio present, including all three formerly runner-blocked async cases. Genuine PHP bridge wire9f7c4c75 is unchanged; two separate interpreter executions yield identical typed output/start clocks/UUIDv7 against its original03:04:16.944938Z start. Source originals and old published2512 counterfactual failures remain retained. First General test invocation used a nonexistent patch helper filename; it is retained separately and makes no product claim.

Interrupted source integration is being rerun at the exact same SHA; stable full CI38350913560 is running separately. Actual connected candidate/published Worker and complete source/stable/release gates remain required. Neither PR is merged and no2.5.13 is published yet. General owns completion after the operator reassigned the paused SDK work.

[rmcdaniel]

Reviewed exact stable head 2467639c7a456438f1d8da197922538365dfab91, tree 87adf9ef8fa99376963b21aabf7df37d935c5606, against the current maintenance base. The six-file backport contains the persisted-start clock correction, 29 focused controls, its smallest corpus reproduction and patch metadata. Client/Worker and the corpus guard are unchanged.

Full stable CI 38350913560 passes all ten jobs, including Python 3.10–3.12, integration, lint, package and regression corpus. The candidate's normally installed clock/corpus controls and two independent reads of the unchanged actual PHP bridge wire also pass. The corresponding published 2.5.12 negative controls remain recorded.

Merge is qualified. Fresh exact merged CI, stable publication, normal registry installation and actual connected worker verification remain required before the stable release is delivered. The clock remains the workflow-start clock, with explicit timestamp precedence and an explicit error for invalid persisted time.

[rmcdaniel]

Delivered in normally published Python 2.5.13, tag/source 97119f337e8db123cee5301a36797f6f49f71d7a, reviewed tree 87adf9ef8fa99376963b21aabf7df37d935c5606.

• Full source/stable/fresh-merge CI and publication38356316291 pass. Normal PyPI installation resolves the exact release; wheel SHA-256 is 8478bd7e5910d2a6afb963b70d42b079d4909a0d0e88cbf1e534370fa86cdcc2, sdist fd0f19581e64dab4266aff5a48a56f0858f48abbab4cdc39c5078f50a658f225. All 32 shipped module files match the tag and 29 installed clock controls pass.
• Two independent normally installed readers replay the unchanged original supported PHP bridge wire 9f7c4c75e45532fb1ac14d9ffc3df861e965b0590499639150384222db2a345e. Both preserve numeric decisions, original marker bounds and typed activity values, returning the same original-start clock and UUIDv7.
• Actual published Server2.6.2 / Workflow2.5.14 originals pass default1.20 and explicit1.19, each across two separate worker processes and an activity boundary. Cold replacements preserve the entire original prefix, original clocks, UUIDv7 and int64/null/Unicode output, with one activity/workflow completion and normal retirement.

The agreed clock contract is fixed workflow-start time. Valid explicit timestamps retain precedence; missing/invalid persisted replay time is diagnosed. PHP's per-command clock behavior is unchanged. Separate timer restart observations remain unqualified and retained for investigation; this release makes no timer-progress, shared/native takeover, Nexus, Cloud or query-authority claim.

This closes the reported nondeterministic clock defect. Query hydration/authority#143 and later downstream adoption remain separate work. All owned qualification resources and credentials are retired.