Guard PHP workflow-update dispatch with replay corpus growth

[rmcdaniel]

Problem

Commit 5514526d13724c9c56ee464df7320e641cc70939 extends the official replay consumer to execute workflow updates through Worker::executeUpdate(). However, regression-corpus-policy.json scopes src/Worker.php replay changes only to completeHistory() and executeWorkflowTask(). The validator attributes a body-only edit to the changed function header, so edits inside executeUpdate() do not match either selector.

Changes to how UpdateAccepted history selects the update name or arguments, or how update results become complete_update and fail_update commands, can therefore remain related_change=false and land without new defect-specific replay evidence.

How to fix

Add a function-scoped replay guard for Worker::executeUpdate(). Add adversarial policy coverage showing that a body-only update-dispatch change is rejected without corpus growth while unrelated Worker.php changes stay replay-neutral. Include a workflow-update fixture that proves base-fail and candidate-pass through the official PHP worker consumer.

Acceptance criteria

• A body-only change inside Worker::executeUpdate() is classified as replay-related and cannot pass without a newly added replay fixture.
• A defect-specific workflow-update fixture fails on the base SDK and passes on the candidate through the unchanged official PHP worker consumer.
• Unrelated Worker.php functions remain exempt from replay corpus growth.
• Existing selector, immutability, duplicate-evidence, and counterfactual checks remain enforced.

Delete when

Delete when PHP workflow-update history handling and command dispatch cannot change without defect-specific replay corpus growth, while unrelated worker edits remain neutral.

[rmcdaniel]

Completed in 84cd677bd04a on main.

No package release was required for this source-only change.

Required public qualification passed: https://github.com/durable-workflow/sdk-php/actions/runs/30574048995