fix(transaction): use non-panicking elapsed checks in the reaper

The reaper captures `now` once per pass, then snapshots and rechecks
the live registry. A transaction created, claimed, or rolled back
after that capture can have a created_at/claimed_at/dormant_since
later than `now`. std::time::Instant::duration_since panics when its
argument is later than self (the current toolchain returns 0 instead,
but that is undocumented behavior), which would permanently terminate
the one-shot reaper task and let abandoned objects exhaust the live
transaction quota.

Use saturating_duration_since so a timestamp newer than now is
treated as zero elapsed: a freshly created/claimed/rolled-back
transaction is never expired on the current pass. Same fix in
claim_expired. Adds regression coverage for timestamps newer than
now. All 37 unit tests pass in debug and release.

Author: eatradish

src/transaction/live.rs

@@ -303,8 +303,15 @@ pub(crate) async fn remove_for_destroy(
 /// 一次回滚的时刻）为基准，未记录时退回 `created_at`。回滚会重置
 /// dormant_since，保证"授权/入队失败后回到休眠"的对象获得完整的重试
 /// 窗口，而不是在下一个清扫周期被立即回收。
+///
+/// 显式用 `saturating_duration_since` 而非 `duration_since`：reaper 捕获
+/// `now` 之后、快照/复查之前并发创建/回滚会写入晚于 `now` 的
+/// `created_at`/`dormant_since`。标准库文档承诺 `duration_since` 在参数
+/// 晚于 self 时 panic（当前工具链实测返回 0，但那是未文档化的实现细节，
+/// 不应依赖）；显式 saturating 语义明确（晚于 `now` → Duration::ZERO →
+/// 刚创建/回滚的对象不过期、不回收）且跨 Rust 版本稳定。
 pub(crate) fn dormant_expired(dormant_since: Option<Instant>, created_at: Instant, now: Instant) -> bool {
-    now.duration_since(dormant_since.unwrap_or(created_at)) >= DORMANT_TIMEOUT
+    now.saturating_duration_since(dormant_since.unwrap_or(created_at)) >= DORMANT_TIMEOUT
 }
 
 /// 周期清扫超时的事务对象，释放配额槽位。覆盖创建者断开或放弃对象
@@ -483,7 +490,13 @@ pub(crate) async fn claim_expired(
         // 已入队/运行中：不回收。
         return false;
     }
-    if now.duration_since(claimed_at) >= CLAIM_TIMEOUT {
+    // 显式用 saturating 而非 duration_since：reaper 捕获 now 之后、快照前
+    // 并发 begin 声明会写入晚于 now 的 claimed_at。标准库文档承诺
+    // duration_since 在参数晚于 self 时 panic（当前工具链实测返回 0，但
+    // 那是未文档化的实现细节，不应依赖）；显式 saturating 语义明确
+    // （晚于 now → Duration::ZERO → 刚 claim 的不算超时、不回收）且跨
+    // Rust 版本稳定。
+    if now.saturating_duration_since(claimed_at) >= CLAIM_TIMEOUT {
         // claim 超时：无论创建者是否还在线，都视为放弃。
         return true;
     }

src/transaction/tests/live.rs

@@ -459,6 +459,18 @@ fn dormant_expired_uses_reset_baseline() {
     // 重置后再次超过 DORMANT_TIMEOUT：判 stale。
     let stale_reset = now - DORMANT_TIMEOUT - Duration::from_secs(1);
     assert!(dormant_expired(Some(stale_reset), created, now));
+
+    // 回归：时间戳晚于 now（reaper 捕获 now 后并发创建/回滚）不得 panic，
+    // 且按"刚创建/回滚"处理——不过期、不回收。
+    let future = now + Duration::from_secs(1);
+    assert!(
+        !dormant_expired(Some(future), created, now),
+        "dormant_since newer than now must not be expired"
+    );
+    assert!(
+        !dormant_expired(None, future, now),
+        "created_at newer than now must not be expired"
+    );
 }
 
 /// 代际校验：Cancel 回滚旧 claim 后用户 re-trigger（新 claim、新代际），
@@ -631,6 +643,37 @@ async fn claim_expired_requires_dead_sender_or_timeout() {
         .await,
         "enqueued-but-not-cleaned-up transaction must not be reclaimed"
     );
+
+    // 回归：claimed_at 晚于 now（reaper 捕获 now 后并发 begin 声明）不得
+    // panic。saturating 把时间差视为 0，不走 CLAIM_TIMEOUT 分支；死 sender
+    // 仍走 sender 检查被回收（合理：claim 无法完成），活 sender + 刚 claim
+    // 则两个条件都不满足、不回收。
+    assert!(
+        claim_expired(
+            &mgr,
+            &dbus,
+            false,
+            8,
+            ":1.999999999",
+            now + Duration::from_secs(1),
+            now,
+        )
+        .await,
+        "dead sender must be reclaimed even with future claimed_at (and must not panic)"
+    );
+    assert!(
+        !claim_expired(
+            &mgr,
+            &dbus,
+            false,
+            8,
+            self_name.as_str(),
+            now + Duration::from_secs(1),
+            now,
+        )
+        .await,
+        "live sender + future claimed_at must not be reclaimed (and must not panic)"
+    );
     let _ = release_tx.send(());
 }