Preserve legacy version fallback in offline replay

[rmcdaniel]

Fix

Resolve version calls before checking their history shape, matching the live executor. A legacy default consumes no history slot, so an already-recorded activity or timer can keep that position.

Owning issue: #641.

Regression coverage

• Frozen pre-marker activity and timer history used by cold worker replay, queries, live execution and offline replay.
• Pending and completed runs, missing and changed fingerprints, and older compatibility builds.
• Malformed and mismatched markers, unsupported versions, a marker conflicting with an activity, and genuine activity/timer drift still fail.
• Repeated replay preserves the bundle and executes no activity body.

Validation

• Before the fix, all 12 valid legacy replay cases fail at the version-marker shape check.
• After the fix, 65 focused replay and existing corpus tests pass with 1,909 assertions.
• Code style passes.
• Affected PostgreSQL features pass: 22 tests, 832 assertions.
• Composer validation passes. Full code-head build passes unit/coverage, MySQL/PostgreSQL/MariaDB features, regression corpus and Laravel 9–13 upgrades.
• The branch now includes Cover durable selection group query replay #642's separately qualified test files from current main. Its required PR checks pass.

Release and consumers

Workflow 2.5.1 is published at 13927608be9d4a366678a4beb477d1a3ee27a549. The normal main build 37599674154 and published verification 37601594262 pass. The independently registry-installed patch passes all 20 frozen-history cases with 216 assertions. Published Laravel 9–13 upgrade journeys pass.

Server #309 is merged and published as Server 2.5.7, manifest sha256:8a5d15512d23c63317996ca2d74e58d7cfdb59f4080850753d632008ca63af17. Both architectures and published first-run checks pass. Installed PHP/Python/Rust replay passes 31 scenarios and published schedules pass all 15 cells without findings.

Waterline #146 verifies its development dependency against the patch across all databases and Laravel 9–13, without releasing unchanged runtime UI code. Sample App #147 updates both locks and the affected tuple fields. Both applications, Compose workflows and the published PHP/Python/Rust example pass. Its published amd64/arm64 development image is verified at index sha256:037c21e2127e18a50d6d78f287055214c56614c42c462c3fc9ed3163d3e47c9c.

Website #170 is deployed, with the live manifest and rendered installation commands verified. The PHP/Python/Rust wire contract is unchanged, so this fix requires no SDK release. Consumer follow-through is complete.

The regression corpus also runs its current consumers against the base implementation to prove the new history exposes the defect.

Review

Reviewed the full production change and regression coverage against WorkflowExecutor and VersionResolver. Legacy fallback retains the shared step position without recording a marker. Recorded and fresh versions still require the marker shape. Malformed markers and actual step drift remain rejected. Wrong change IDs now use the live resolver's replay-error diagnostic.