[reka18]

What this change does

Guards, actions and reducers now get the context of the step running them, so a host can tell when one of them calls back into it.

• GuardCtx, ActionCtx and AssignCtx have a new Ctx field: the context the Fire was given. Outside a Fire, such as during PlanPath, it's context.Background(), never nil. A Fire nested inside a callback on the same instance restores the outer context when it returns.
• The in-process bindings pass the context they're given (EvalGuard, EvalAction, EvalAssign) through to the function they wrap.
• WithContext sets the context Cast gives the guards, actions and reducers that settle the initial state.
• ActorSystem.RegisterContext registers a ContextActorBehavior, an actor factory that gets the context of the step spawning or restoring the actor, so it can Cast its child WithContext. A child's own callbacks already get the context its delivery carries. Register is unchanged.
• A guard registered with BindGuard gets the Fire's context through EvalGuard, where it used to get a background one, and callbacks see the context as the middleware chain passes it down.

It's additive: no existing signature changes.

CI on drafts. This PR also stops CI and CodeQL running on draft PRs. A draft runs only the required gate check, which fails in a few seconds with "Draft PR: CI runs when it's marked ready for review". Marking a PR ready runs the full CI and CodeQL, as does every later push to it. The gate fails rather than skips on a draft: a skipped required check counts as passing for that commit, so a PR could otherwise be marked ready and merged before its CI ran. CONTRIBUTING says so.

Why

#243 makes a durable Handle hold a lock for each step. Code that runs under that lock and calls back into the same Handle would wait forever. A service gets the step's context, so #243 can recognize a call carrying it and return ErrReentrantStep instead. Guards, actions, reducers and actor factories had no context to pass back, so the same mistake there still deadlocked. With this change, a callback that passes in.Ctx back into its Handle gets ErrReentrantStep too. Once both land, #243's docs will say so.

It also lets work under review stay a draft without spending CI time, as agreed with the maintainers.

Relates to: #214, #243

Evidence

On GOTOOLCHAIN=go1.27.3:

Check	Result
go test -race ./state/... ./durable/... ./cluster/...	Pass
go test ./... in examples/dispatch and e2e	Pass
go vet ./... in every workspace module	Clean
Pinned golangci-lint on state	0 issues
actionlint on ci.yml and codeql.yml	Clean
This PR as a draft, after the CI change	Only gate ran (3 s, failed with the draft message); CodeQL skipped

The new tests in state/callback_context_test.go cover a guard, an action and a reducer seeing the Fire's context, an entry reducer on a later Fire, Cast with and without WithContext, PlanPath, a nested Fire, and RegisterContext through spawn, Cast and delivery, a BindGuard binding, middleware, an eventless transition settling during Cast, and a parallel region. Each fails when the code it covers is removed.

Checklist

• Commits are signed off (git commit -s) per the DCO
• Conventional commit messages (type: subject)
• mage check passes locally (lint + race tests + govulncheck): not run as a whole; the parts above were run individually
• Tests added/updated for the change
• Public API changes documented (godoc) and, if applicable, noted for the changelog

[reka18]

Review

Each dimension was attacked by an AI reviewer working from a clean context. The reviewers could only read code; they traced paths by hand. I ran the tests and mutation checks. All seven dimensions are confirmed.

Dimension	Round 1	Round 2	Status
Correctness	0 blockers	Not rerun	Confirmed
Concurrency discipline	1 blocker	0 blockers	Confirmed
API compatibility	0 blockers	Not rerun	Confirmed
Regression safety	1 blocker	0 blockers	Confirmed
Missed context	1 blocker	0 blockers	Confirmed
Human readability	0 blockers	Not rerun	Confirmed
CI gating (the workflow change)	0 blockers	Not rerun	Confirmed

Fixed

• Blocker, found by three reviewers: a guard registered with BindGuard, the seam CEL and wasm guards use, was adapted with context.Background(), so it never saw the step's context. Its EvalGuard now gets the Fire's context, and a test proves it.
• Callbacks now see the context as the middleware chain passes it down.
• Cast restores its context with defer, as Fire does.
• Tests added for an eventless transition settling during Cast and a transition in a parallel region.
• Docs: WithContext reaches the guards and actions settling the initial state, not just its reducers; Cast settles to completion even if that context has ended; the ActorSystem doc says the parent Instance still needs one goroutine at a time; the guards, actors, actions and assigns pages mention Ctx; CONTRIBUTING says CI runs on ready PRs.

Not changed

• durable.Runner.Start doesn't pass WithContext yet, and cluster.WithActorBehaviors has no context-aware form. Both are follow-ups in those packages.
• Pre-existing and unchanged: a nested Fire on the same instance restores only the outer Fire's context, not its other per-Fire state; the actor system runs a spawn's behavior outside its mutex; a stacked PR whose base is retargeted to main gets no CI event until its next push; CodeQL's weekly scan can be cancelled by a push to main.

[joshua-temple]

Review at 1aea966. Build, vet, tests pass. One fix needed before merge.

Must fix

• state/binding.go:186-189: cancelled Fire ctx makes a bound guard return an error, counted as false
  • A fallback transition can commit before the next cancel check at fire.go:253
  • Durable replay runs with a live ctx, takes the primary branch, diverges from live
  • Fix: if Ctx.Err() != nil, surface the error, not a false verdict
  • Move the CHANGELOG entry from Added to Changed
  • Add a test: guard under a cancelled ctx

Should fix

• kernel.go:561,576, assign.go:35: Ctx godoc should say callbacks must not branch on it (replay uses the recovery ctx)
• actor_snapshot.go:279: no test for the RestoreActors path
• state/CHANGELOG.md:~728: reserved WithContext promise clashes with Cast's WithContext; reword

Nits

• fire.go:69: comment that Fire's defer restores callCtx

[reka18]

Thanks for the review. Addressed in 2f3c928 through f2eb64c.

Your must-fix: done. A BindGuard binding whose EvalGuard fails after the Fire's context ended now stops the Fire with the context's error, on event-driven and eventless transitions alike. The error names the guard and wraps both the context's error and the binding's own, so errors.Is matches either. The CHANGELOG entry is under Changed, and tests pin both kinds of transition. One correction: the divergence couldn't persist. The cancellation check after each microstep already rolled the Fire back, with nothing journaled. What the fix removes is the fallback's actions and reducers running under the ended context before that rollback.

Reviewing the fix also turned up a Cast case. Cast settles to completion and can't abort, so with an ended WithContext context, a bound guard that honoured cancellation sent the settle down another transition with no error. Cast's callbacks now get WithContext's values without its cancellation or deadline.

Your should-fix items: all done.

• The Ctx docs say not to branch on it, because a replay runs the same callbacks under a different context. The guards, actions and assigns pages say so too.
• There's now a RestoreActors test through RegisterContext.
• The reserved WithContext note in the CHANGELOG is reworded.

Your nit: done. The comment at fire.go:69 says Fire's deferred restore puts callCtx back.

Also: a cancelled guard no longer shows as a guard panic or failure in the Trace on any path. The review summary below this comment has the details.

[reka18]

Review after the maintainer's comments

The maintainer's review is addressed in 2f3c928 through f2eb64c. Each changed dimension was attacked again by an AI reviewer working from a clean context, until it had no blockers. The reviewers could only read code; I ran the tests and the mutation checks. All dimensions are confirmed.

Dimension	Rounds since the maintainer's review	Status
Correctness	2 rounds with blockers, then a verify-only round	Confirmed
Replay determinism	2 rounds with blockers, then a verify-only round	Confirmed
Regression safety	0 blockers	Confirmed
Human readability	0 blockers	Confirmed
Concurrency, API compatibility, missed context, CI gating	Unchanged since their earlier confirmation	Confirmed

Fixed

• A bound guard on an ended context: a BindGuard binding whose EvalGuard fails after the Fire's context ended stops the Fire with the context's error, on event-driven and eventless transitions. The error names the guard and wraps both the context's error and the binding's own. The fallback transition's callbacks never run.
• Cast with an ended context: Cast settles to completion, so a bound guard that honoured cancellation could quietly send the settle down another transition. Cast's callbacks now get WithContext's values without its cancellation or deadline.
• Trace outcome: a cancelled guard is no longer reported as a guard panic or failure, whether it's a named guard, a guard expression, or in a parallel region or the parallel state. A guard that panics with a value wrapping a context error is still reported as a panic.
• Docs: don't branch on Ctx, since a replay runs the same callbacks under a different context; a nested Fire clears the outer Fire's raised events; ContextActorBehavior covers restore.
• Tests: each fix has a test that fails when the fix is removed, plus RestoreActors through RegisterContext and a region's eventless transition settling during Cast.

Not changed

• A Fire stopped by a cancelled guard during eventless selection keeps the earlier outcome in its Trace instead of the cancellation outcome. The error is right; the outcome is a consistency follow-up.
• A Fire rolled back at a cancellation check keeps a Trace that reads success. This predates this PR.
• A plain guard that checks its context and returns false can still steer a transition until the rollback. That's covered by the rule against branching on Ctx.