Workflow now() exposes a mutable replay clock and can expire deadlines immediately

[rmcdaniel]

Observed Defect

In the published Workflow 2.0.13 package (PHP 8.4), Workflow\V2\now() returns the mutable Carbon instance held by WorkflowFiberContext. Deriving a deadline with now()->addHour() mutates the clock itself. A subsequent now() is already at that deadline, despite no history event advancing time.

Minimal reproduction against the installed package:

require 'vendor/autoload.php';

$fiber = new Fiber(function () {
    \Workflow\V2\Support\WorkflowFiberContext::setTime(
        \Carbon\Carbon::parse('2026-01-01T00:00:00Z')
    );
    $before = \Workflow\V2\now()->getTimestamp();
    $deadline = \Workflow\V2\now()->addHour();
    echo json_encode([
        'clock_advanced_seconds' => \Workflow\V2\now()->getTimestamp() - $before,
        'deadline_already_reached' => \Workflow\V2\now()->greaterThanOrEqualTo($deadline),
    ]);
});
$fiber->start();

Observed: {"clock_advanced_seconds":3600,"deadline_already_reached":true}.
Expected: 0 and false.

Also reproduced in a real database-backed workflow before its first activity. Later history replay can replace the stored clock, which makes the symptom depend on where deadline arithmetic occurs.

Fix And Qualification

• Return an isolated clock value (defensive copy or immutable instance) without exposing mutable executor state.
• Inspect setTime() ownership too: retaining a caller-owned mutable object can expose the same alias in the opposite direction.
• Preserve deterministic history timestamps; do not replace workflow time with wall time.
• Cover two consecutive clock reads, mutation of an earlier returned value, mutation of the supplied clock object, and separate fibers.
• Prove an ordinary deadline workflow remains pending initially and crosses its deadline only after durable time advancement and replay.
• Review affected consumers and run focused published-artifact conformance after release.

Immediate application-level mitigation: derive deadlines from now()->toImmutable(). This does not replace the engine fix.

No public API or private infrastructure change is requested.

[rmcdaniel]

Implementation is visible in #512. Both mutable-object directions are reproduced: mutating a returned clock and mutating the timestamp supplied to setTime. The fix copies at both boundaries. The database regression fails on main because a one-hour deadline completes immediately; with the fix it remains pending until two durable 30-minute timers fire, and fresh model replay ignores a far-future wall clock. Focused tests and static analysis pass; broader CI and published-consumer follow-through are in progress.

[rmcdaniel]

Delivered in Workflow 2.0.14 via #512. Both setter and getter now copy the clock; mutable/immutable Carbon types, timezone and microseconds are preserved.

Verification:

• Source regressions: 79 tests / 319 assertions, including fresh database/model replay and durable timer advancement. Full MySQL/PostgreSQL/MariaDB CI and all 16 published Laravel/PHP upgrade combinations passed.
• Independent Composer-installed consumer: 2.0.13 reproduced the defect (5 failures); 2.0.14 passed all 8 tests / 33 assertions.
• Server 2.3.12 and Helm 0.1.91 include the fix. Release image/readiness/Compose/protocol/Helm qualification passed; the published image independently passed clock-ownership and package-provenance checks.
• Sample App #91 updates its lockfile and published artifact tuple. PHP/Python/Rust smoke checks and both prepared Codespaces image architectures passed; the main image channel is published.

No SDK/wire contract changed, so unchanged SDKs and Waterline do not need synchronized releases. Closing the public defect as fixed and available in published artifacts.