Guard native saga controls with their canonical deadline

Bound each healthy control job by its own persisted deadline and the
configured hold delay. Preserve deliberate early stale-job rejection and
all durable-job authorization, revision and completion assertions.

Current full Release solution build: 0 warnings, 0 errors. Canonical
whole-solution formatter and governance passed. Full Aspire unit v3 is
running after runtime-option repairs; prior unit v1 failed186 cases and
v2 was aborted by an AppHost stop request. Runtime, scalar, recovery, RF3,
source-bound coverage and exact-source Linux qualification remain open.

Author: KSemenenko

docs/implementation/status.json

@@ -4873,20 +4873,20 @@
     "status": "in_progress",
     "feature": "docs/Features/CodeQuality.md",
     "decision": "docs/ADR/ADR-113-centralized-runtime-options.md",
-    "sourceStage": "runtime_policy_migration_runtime_failures_under_repair_final_canonical_refresh_pending",
-    "canonicalBuildPassed": false,
+    "sourceStage": "runtime_repairs_complete_canonical_release_and_format_v5_passed_full_Aspire_unit_v3_running",
+    "canonicalBuildPassed": true,
     "runtimeQualified": false,
     "fullTaskComplete": false,
     "remaining": [
       "Pass full Aspire-owned unit/scalar/recovery and native RF3 execution, retaining original reports",
       "Pass required source-bound coverage and delivered-source Linux qualification",
       "Review any actual runtime failures without weakening diagnostics, contracts or assertions"
     ],
-    "canonicalFormatterPassed": false,
+    "canonicalFormatterPassed": true,
     "developmentEvidence": {
       "directory": "artifacts/code-quality/general-runtime-options-development-20261006",
-      "canonicalRelease": "keyload-general-options-full-release-v4.log",
-      "canonicalFormat": "keyload-general-options-canonical-format-v3.log",
+      "canonicalRelease": "keyload-general-options-full-release-v5.log",
+      "canonicalFormat": "keyload-general-options-canonical-format-v5.log",
       "analyzers": {
         "suite": "analyzers",
         "passed": 340,

tests/KeyLoad.UnitTests/Features/Messaging/Cases/NativeSagaTimeoutFunctionalTests.cs

@@ -42,7 +42,7 @@ public async Task NativeJobObservesCompletionCommittedAfterScheduling()
         NativeSagaTimeoutTestData.CompleteSaga(fixture, stale);
 
         var control = NativeSagaTimeoutTestData.CreateWaitingSaga(fixture, SagaPrincipalId);
-        var controlDueAt = staleJobDueAt.Add(fixture.TestProfile.HeldJobDelay);
+        var controlDueAt = ControlJobDueAt(staleJobDueAt, control);
         await fixture.JobHarness.ScheduleAsync(control.Hint, controlDueAt, CancellationToken.None);
         var controlShards = await fixture.JobHarness.CaptureOwnedShardsAsync(controlDueAt, CancellationToken.None);
         await Assert.That(await NativeSagaTimeoutJobHarness.CountScheduledJobsAsync(controlShards)).IsGreaterThan(NoScheduledJobs);
@@ -68,7 +68,7 @@ public async Task NativeJobObservesSagaCancellationBeforeTimeout()
         NativeSagaTimeoutTestData.CancelSaga(fixture, stale);
 
         var control = NativeSagaTimeoutTestData.CreateWaitingSaga(fixture, SagaPrincipalId);
-        var controlDueAt = staleJobDueAt.Add(fixture.TestProfile.HeldJobDelay);
+        var controlDueAt = ControlJobDueAt(staleJobDueAt, control);
         await fixture.JobHarness.ScheduleAsync(control.Hint, controlDueAt, CancellationToken.None);
         var controlShards = await fixture.JobHarness.CaptureOwnedShardsAsync(controlDueAt, CancellationToken.None);
         await Assert.That(await NativeSagaTimeoutJobHarness.CountScheduledJobsAsync(controlShards)).IsGreaterThan(NoScheduledJobs);
@@ -95,7 +95,7 @@ public async Task NativeJobObservesPersistedCreatorRevocationBeforeTimeout()
         NativeSagaTimeoutTestData.RevokeCreator(fixture);
 
         var control = NativeSagaTimeoutTestData.CreateWaitingSaga(fixture, SagaPrincipalId);
-        var controlDueAt = staleJobDueAt.Add(fixture.TestProfile.HeldJobDelay);
+        var controlDueAt = ControlJobDueAt(staleJobDueAt, control);
         await fixture.JobHarness.ScheduleAsync(control.Hint, controlDueAt, CancellationToken.None);
         var controlShards = await fixture.JobHarness.CaptureOwnedShardsAsync(controlDueAt, CancellationToken.None);
         await Assert.That(await NativeSagaTimeoutJobHarness.CountScheduledJobsAsync(controlShards)).IsGreaterThan(NoScheduledJobs);
@@ -120,7 +120,7 @@ public async Task NativeJobObservesFutureCanonicalDeadlineBeforeTimeout()
         await Assert.That(await NativeSagaTimeoutJobHarness.CountScheduledJobsAsync(staleShards)).IsGreaterThan(NoScheduledJobs);
 
         var control = NativeSagaTimeoutTestData.CreateWaitingSaga(fixture, SagaPrincipalId);
-        var controlDueAt = staleJobDueAt.Add(fixture.TestProfile.HeldJobDelay);
+        var controlDueAt = ControlJobDueAt(staleJobDueAt, control);
         await fixture.JobHarness.ScheduleAsync(control.Hint, controlDueAt, CancellationToken.None);
         var controlShards = await fixture.JobHarness.CaptureOwnedShardsAsync(controlDueAt, CancellationToken.None);
         await Assert.That(await NativeSagaTimeoutJobHarness.CountScheduledJobsAsync(controlShards)).IsGreaterThan(NoScheduledJobs);
@@ -135,6 +135,13 @@ await Assert.That(fixture.Database.Database.InspectMessage(SagaPrincipalId, futu
             NativeSagaTimeoutTestData.TimeoutMessageId(future.Id, RevisionOne))).IsNull();
     }
 
+    private DateTimeOffset ControlJobDueAt(DateTimeOffset previousJobDueAt, NativeSagaTimeoutCase control)
+    {
+        var plannedDueAt = previousJobDueAt.Add(fixture.TestProfile.HeldJobDelay);
+        var canonicalDueAt = control.Deadline.Add(fixture.TestProfile.HeldJobDelay);
+        return plannedDueAt >= canonicalDueAt ? plannedDueAt : canonicalDueAt;
+    }
+
     private async Task<SagaInspection> WaitForTimedOutSagaAsync(QueueLaneRef lane, Guid sagaId)
     {
         using var deadline = new CancellationTokenSource(fixture.TestProfile.CompletionTimeout);