Native test race: anchored past-A reopen test can lose its unfired timer to the maintenance loop #1105

Summary

occurrence_deadlines::a_reopen_after_the_anchor_is_due_immediately_at_the_anchor (added by #1098, on main at M 2a15179f) races the runtime's maintenance loop and can fail with 409 condition_wait_occurrence_timed_out instead of the intended 200 reopen. This is a test defect, not a runtime defect. The runtime behaviour it hits is correct and is pinned separately by a_wake_turn_finishing_after_its_fired_deadline_is_refused.

Observed

• PR Stabilize parity downloads and retain deterministic failure evidence #1104 head f2b02690, run 42474309384, job 128713597029, mysql-execution (existing-php-mysql-matrix, native-tests-b), 2026-11-08T11:21:39Z.
• The failure:

  panicked at tests/execution/occurrence_deadlines.rs:165:5
  assertion `left == right` failed: {"reason":"condition_wait_occurrence_timed_out",...}
  test result: FAILED. 373 passed; 1 failed
  

• rust/ on that head is byte-identical to M, so the same race exists on main.

Cause (source at M 2a15179f)

1. The test moves A into the past with UPDATE workflow_run_timers SET fire_at=<run started_at> WHERE sequence=1. Its comment says the timer task "stays far in the future, so the engine does not fire it first". That is not true: firing is keyed on the timer row.
2. TimerScheduler::start (rust/src/runtime/execution.rs:84–101) calls fire_due_timers every 250 ms. That query (rust/src/runtime/store.rs:4137) selects t.status='pending' AND t.fire_at<=now on workflow_run_timers alone. The moved timer is therefore due at the next tick.
3. The first timer stays pending until the wake turn's completion commits. That completion cancels it at wait_timeouts.rs:170 and reopens in the same transaction. Any tick between the UPDATE and that commit fires it: TimerFired is recorded and status='fired' is set (store.rs:4210–4235).
4. The completion's occurrence_anchor then sees fired_at on the chain (wait_timeouts.rs:254–255) and refuses condition_wait_occurrence_timed_out.

The window spans one signal, one poll and one completion. It is usually a few milliseconds, which is why the test mostly passes. On a loaded MySQL runner it overlapped a tick.

Fix requirements

• Keep the 200 reopen at the moved (past) A while the first timer is unfired.
• Keep the separate fired-timer refusal control unchanged.
• No accepted 409, timing tolerance, retry or ignore.
• Make the interleaving deterministic with a test-only seam that release builds do not compile, following the existing runtime::poll_pauses precedent.

Related: #1015 / #1098 (the occurrence deadline feature); #1104 (the CI repair that will carry the fix after review).