[rmcdaniel]

An opening row with a numeric-string sequence can claim the same workflow step in legacy replay while disappearing from the strict business-clock index. A valid-looking duplicate then falsely allows ctx.replay_now() to prove a time. The same gap can hide a child opening associated with another call.

Use the existing resolver's sequence claims for index visibility, then require an actual matching integer on every implicated row before proving time. This preserves the legacy parser, values, selected failures and original errors; coercion never becomes clock authority. Later independently proved boundaries can still recover.

Adds 36 controls for activity/timer/child duplicates, numeric strings, Boolean counters, alias conflicts/fallbacks, cold replay, unchanged parser errors and unrelated unclaimed rows. One new official corpus fixture records unavailable time while preserving legacy observations; old fixtures and validators are unchanged.

Validation:

• 184 focused checks, Ruff and mypy pass.
• The identical 106-case official consumer runs on immutable base 3634612 with exactly one behavioral clock-value failure; final candidate eb233bfa passes all106, with no collection/import errors on either revision.
• Corpus policy passes: replay inventory109→110, codec inventory43 unchanged.
• Full source suite: 5,771 passed, three optional skips and130 integration tests deselected. All21 final-head hosted checks pass, including Python3.10–3.15, integration/teardown and protected target-branch qualification; direct Sonar PR issue inventory is zero.

Related: durable-workflow/.github#215. This is an unreleased source correction; broader clock conformance remains open.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Normally merged at 46ebdad, tree 21aac50efe9b4b42735c3eb40393985a528a9e22, ordered parents 3634612367a2bcd6445c67e667d034bf911b5828 + eb233bfa9da8918eaa2f12ad2aed6c03c35277a5.

The clock now sees every sequence claimed by the unchanged legacy resolver, then requires strict matching integer counters on every implicated row before proving time. Numeric strings, Boolean counters and conflicting/fallback aliases cannot disappear from the ambiguity check. Legacy values, selected failures and original parser/replay errors are preserved; independently proved later boundaries can recover.

• Local full source suite: 5,771 passed/three optional skips/130 integration tests deselected. Final 36 controls pass; 184 combined clock checks, Ruff and mypy pass. The final test-only revision places the unrelated-row control on a distinct resource; production, official consumer/helper and fixture bytes match the full-suite-tested source.
• Identical official 106-case consumer on immutable 3634612 has exactly one behavioral failure: expected unavailable, observed 2026-11-01T00:00:03.123456+00:00. Final eb233bfa passes106/106, with no collection/import errors. New 2,735-byte fixture SHA-256 71446b72bbdc8f10509f0f81c62eaf8d40f9f1c4b839211e5033a7b08a6b44c4; replay 109→110 / codec 43 unchanged. All previous fixtures, validators and guards remain intact.
• All 21 final PR checks passed, including CI42172093046, Python 3.10–3.15 and integration127742521223; direct Sonar PR issue inventory zero.
• All five original actual-main workflows succeeded, with 19 successful checks/one declared deploy skip. Main CI42173044766 and integration127745238767 passed; teardown independently reads success. No main check is failed, canceled or pending.

Main portal42173044556 build127745086625 succeeded; deploy127745589790 was skipped. Artifact 13482190741: ZIP SHA-256 c2d6a2234ef3319f2aaafbe0210e7b84070b53d898ad8b75fd323ea7e4c9230b, tar SHA-256 7c61703e7602118f2717f86175d683f34fd6e0cc0ab31c9dbc4c4534c311801b. Its 92 regular files and 45 API-source inventory rows independently bind exact main Git bytes. Audit is source-preview, docs=SDK=46ebdad/version2.15.0/published-wheel null; inventory SHA-256 8abcb44e4e0635e83f00f8ea7aff74fd2d8716613ffb432978e8de0a7be2449b.

At 06:17:11Z, five anonymous live-byte comparisons matched the stable audit, landing, SDK reference, Client and Worker pages. Published presentation remains d3e72974 + SDK dc47958c / 2.14.1; the preview was not deployed.

Remote feature ref independently returns 404; local feature branch is removed; shared main and detached review checkout are clean. Owned local test/watch processes are terminal. SDK Python owns this change's retained public diagnostics through 2026-11-13 07:00UTC, then removes them. This accepts the concrete source correction; original central #215's remaining source/published conformance and authority gaps remain open.