[rmcdaniel]

Fixes #248. This is the parity follow-up General asked for in the #246 clearance: replay refuses a recorded condition-wait reopen that is longer than the wait's first open, as sdk-php#271 does.

Rule (_assert_reopen_within_first_timeout, workflow.py)

When replay links a later ConditionWaitOpened to the same logical wait (same key or fingerprint; has_reopened_same_wait), the reopen must satisfy the sdk-php#271 rule. Either both timeouts are absent, or both are integers and the reopen's is no longer than the first open's.

• Anything else is refused: a longer reopen, or a reopen that adds or drops the timeout. It raises NonDeterministicReplayError at the reopen's sequence, with detail condition_wait_reopen_timeout_exceeded: a reopen records a longer timeout than the wait's first open, or adds or drops it. Neither recorded value appears in the message.
• Still replays:
  • reopens with the full timeout (every SDK before 2.13.2);
  • remaining-time reopens (2.13.2 and later);
  • a reopen of 0;
  • untimed reopens of an untimed wait.
• Aligned with PHP at head 8ad21a87 (General's question). The first head treated a missing timeout as unbounded, so a timed reopen of an untimed wait was linked as shorter. That could give a Python-only replay result: an untimed authored wait could see a recorded timeout fire and get False. That history comes only from changed code, so it is now refused, as in PHP.
  • Two existing signal-routing tests (test_signal_received_before_reopened_wait_uses_next_wait_when_sequence_absent / _is_stale) recorded a 30 s reopen of an untimed wait, which an untimed workflow never writes. Their histories drop that timeout and its timer. Both still pass on main's source, so the edit doesn't depend on this change.

Evidence

• New tests (TestReopenTimeoutBound, 8 cases):
  • equal (300), shorter (179) and 0 reopens replay, each giving 120;
  • longer reopens (301, 600) are refused at sequence 2, with the value absent from the message;
  • an untimed reopen of an untimed wait replays;
  • adding or dropping the timeout is refused.
• Fail-before against an origin/main source export: the 4 refusal tests fail, and the 4 controls pass.
• Corpus fixture condition-wait-reopen-longer-timeout-refused (300 then 400) expects a NonDeterministicReplayError at sequence 2 containing condition_wait_reopen_timeout_exceeded. It passes here and fails on main's source.
• CHANGELOG: an Unreleased Fixed entry.

Local runs at 8ad21a8 (lab2, Python 3.13, this branch's source)

• ruff check src tests is clean, and mypy src/durable_workflow reports no issues.
• Full unit suite (excluding tests/integration): 4877 passed, 4 skipped.
• validate-regression-corpus.py --base-ref origin/main: status: pass.

Not merged or released.

🤖 Generated with Claude Code

Review fixes

• a66bdc9a: the bound no longer runs after a timeout. A longer grace wait (300 s timed out, then 400 s) is a separate call. test_a_longer_grace_wait_after_a_timeout_is_a_separate_call fails on f7a8d7a5.
• 01ddd0db (General's hold on a66bdc9a): _assert_reopen_within_first_timeout now runs only in the two branches that consume next_wait_index as a reopen, which are the ones where the predicate is still false.
  • A same-key wait following one whose predicate was true is a separate call with its own timeout, whether or not ConditionWaitSatisfied is recorded.
  • test_a_separate_wait_after_a_satisfied_one_keeps_its_own_timeout covers longer, added and dropped timeouts, with and without Satisfied recorded. All 6 cases fail on a66bdc9a and pass on main and here.
  • It also merges main (Redact map keys in typed-value errors and refuse dataclass errors as typed #252), with no conflict. Full suite: 4932 passed.
• Coherence with Replay a condition wait whose orphaned duplicate's timer fires #254 (Replay a condition wait whose orphaned duplicate's timer fires #253): Replay a condition wait whose orphaned duplicate's timer fires #254 adds a third branch that consumes a reopen (an orphan whose later timeout is superseded). Whichever PR merges second calls the bound there too, with a test.

[rmcdaniel]

General interim review (Security unavailable): HOLD at a66bdc9 (independent reviewer)

Verified:

• The change since f7a8d7a is only the resolution != "timed_out" guard plus the longer-grace test. That test fails on f7a8d7a's src and passes on main's.
• The refusal tests and the corpus fixture fail on main.
• Full suite passes (4923). CI 21/21.
• Full-timeout (pre-2.13.2) and remaining-time (2.13.2) reopens replay.
• Dropping the 30 s reopen from the two SignalCounterUntilFinished histories is legitimate, because that workflow's only wait is untimed.

Blocking: the bound still runs before the wait's outcome is known. has_reopened_same_wait matches any later open with the same key. So a wait that was satisfied with its predicate true, followed by a separate same-key wait with a longer, added or dropped timeout, is refused. Main replays all of these; this head raises condition_wait_reopen_timeout_exceeded:

• wait_condition(key="approval", timeout=60) satisfied, then wait_condition(key="approval", timeout=300);
• the same with an untimed second wait;
• the same before ConditionWaitSatisfied is recorded.

sdk-php's isConditionReopen treats a longer timeout as "not a reopen", which makes it a separate call rather than a refusal, and it requires the key and the fingerprint to match. sdk-rust links reopens only within one call occurrence.

Please run _assert_reopen_within_first_timeout only in the two branches that consume next_wait_index as a reopen (predicate still false). Add the satisfied-then-longer cases as tests.

[sonarqubecloud]

Quality Gate passed

Issues
9 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

General interim review (Security unavailable): CLEAR at 01ddd0db313d4d11f66e13f2453949c26ee518cf (independent reviewer)

• The merge of main is exactly Redact map keys in typed-value errors and refuse dataclass errors as typed #252's diff.
• The fix moves _assert_reopen_within_first_timeout to the only two branches that consume next_wait_index as a reopen (workflow.py:7743, :7771). The timed-out branch and both predicate-true branches correctly leave the next open as a separate call. Tampered 301/600, added and dropped reopens are still refused.
• Counterfactual: the 6 test_a_separate_wait_after_a_satisfied_one_keeps_its_own_timeout cases fail with a66bdc9's source and pass with main and the head. Full suite 4932 passed. CI 21/21.
• Informational: at the workflow's end, _consume_terminal_condition_reopens skips leftover unresolved same-key opens without the bound. They cannot change the result, so this doesn't block.

Merge order: merge this PR first, at this SHA, with a readback. #254 then refreshes onto it and adds the bound to its orphan branch (see the #254 review).

[rmcdaniel]

Merged at General's clearance of exact head 01ddd0db313d4d11f66e13f2453949c26ee518cf (21/21 green).

• Merge commit: 318eeda4312a33cfac722ab413347b3d07d65ea3, with parents main c5d64b21 and head 01ddd0db.
• Merge tree: 288bc424, identical to the head tree.
• Refuse a condition-wait reopen longer than the authored timeout on replay #248 is closed, and the remote head branch is deleted.
• Replay a condition wait whose orphaned duplicate's timer fires #254 is refreshed next, with the bound in its orphan branch.