[rmcdaniel]

Summary

Workflow-bound Nexus calls could lose JSON/encoded arguments or results, miss linked timeout/update outcomes, and stop following valid continue-as-new successors. Preserve typed values and namespace-scoped payload references, normalize nested Avro history envelopes, reconcile canonical same-lineage successors in bounded passes, and preserve the winning terminal/cancellation receipt.

Require authenticated HTTP replays to authorize the actual selected call and preserve already-issued activity/carrier identities. Add a transaction-aware audit factory/finalizer so Server can claim a canonical key before charging admission policy; it cannot overwrite a committed or foreign admission. Owned policy denials can carry their evaluated decision without changing generic foreign-owner denial behavior.

Refs #947 and #931; Server companion work is durable-workflow/server#794 and durable-workflow/server#796.

Verification

Exact head 1c3f95e5ad6defd0b3cfed9c0416fd7f896eac79:

• Full ECS and PHPStan pass.
• Full unit/PCOV suite passes: 5,107 tests / 72,526 assertions, 15 existing notices and 43 skips. V2 line coverage is 77.19% (59,085/76,539), above the unchanged 60% floor.
• Full PostgreSQL feature suite passes: 2,513 cases / 24,675 assertions, 18 engine-inapplicable skips.
• All 24 hosted check entries finish without failure, including PR unit contracts, MySQL features, repository contracts, quality, regression corpus and genuine SonarCloud analysis. Seven broader push-only checks are skipped on PR events.
• Focused authority/audit checks pass 91 tests / 497 assertions (4 engine-inapplicable skips). Three typed-policy regressions fail on the preceding exception contract and pass here. Foreign ownership failures expose no policy decision.
• Security accepted the Core exception/authority delta. A separate companion Server race-audit snapshot correction remains in Server TaskWatchdog and workers lock run and task in opposite order: MySQL 1213 deadlocks under queue latency (2.4.5 to 2.5.20) #796; this PR does not claim its acceptance.

The first local harness attempts exposed an APP_URL mismatch and a read-only Testbench vendor cache; both were corrected before the exact-head full runs above. Published-package/image acceptance has not run for this candidate.

Compatibility and follow-through

Prepare patch 2.15.1. Existing audit calls remain compatible; no DDL or worker-protocol change. The codec registry remains Avro-only. After normal package publication, verify the published package/platform and Laravel upgrade contracts, update Server to the actual published dependency, and run installed artifact acceptance including the still-unqualified Nexus caller/recovery tuple. The linked issues stay open until their own acceptance completes.

[sonarqubecloud]

Quality Gate passed

Issues
7 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud