Buyer-visible gap
The Ask browser no longer abandons valid queued/running work on an elapsed observation timer, and #974 makes post-chat transport timeout default-null. The backend Ask path still owns an explicit ~570 s socket limit, a 600 s execution deadline, and age-based orphan recovery. That means valid long-running model/tool work can still be terminated or reclaimed based primarily on elapsed wall time, while an immediate provider TimeoutError and an actual worker deadline have different meanings.
This conflicts with the LineageWeave/CO boundary: provider/model transport policy belongs to released contextual-orchestrator contracts, while LineageWeave owns durable task state, cancellation, settlement, recovery, and buyer-visible status. Removing the timers blindly is unsafe because the current orphan-recovery path lacks an execution-owner fence.
Required RED
Use realistic PostgreSQL-backed worker tests, not synthetic sleep-only assertions:
- Worker A claims an Ask job; after the historical orphan age, worker B attempts recovery. Without an ownership/lease generation fence, B can reclaim while A can still later settle the same request. This must reproduce as RED before repair.
- A provider-origin
TimeoutError must remain a provider/unavailable failure and must not be labeled as LineageWeave worker deadline expiry.
- Native cancellation must propagate through active orchestration/HTTP work and settle exactly once with the preserved reason.
- A legitimate operation running beyond the old 600 s policy boundary must remain owned/running when liveness evidence is current; elapsed time alone must not terminate it.
Do not make the suite wait ten real minutes. Drive the domain clock/lease timestamps deterministically while preserving the real DB claim/settlement transaction and cancellation path.
Minimal causal design target
Introduce an explicit execution ownership token/generation (or equivalent compare-and-set lease identity) on claim and settlement. Heartbeat/liveness renewal must be bounded, idempotent, and transactionally tied to the current owner. Recovery may reclaim only an expired owner generation and a stale worker-liveness condition; the old owner must be unable to settle afterward. Cancellation is a distinct terminal intent, not a synthetic timeout.
After fencing is GREEN, remove the hard-coded LineageWeave 600 s execution expiry and 570 s model socket policy unless a released contextual-orchestrator contract explicitly supplies a bounded administrator/provider timeout. Default model transport remains null. User cancel, provider end/failure, administrator policy, worker loss, and recovery must be distinguishable in status/evidence.
Boundaries / acceptance
- No provider/model/group/paid fallback is introduced in LineageWeave.
- No elapsed-time-only reasoning/tool-call termination.
- No cross-service SQL or mutable contextual-orchestrator dependency; consume only released CO API/client/schema.
- PostgreSQL claim/heartbeat/recovery/settlement invariants are executable and idempotent under retry.
- Exact-head backend suite GREEN; owned task/recovery production code and edge branches at 100% coverage without denominator weakening.
- Failure/cancellation diagnostics remain bounded and do not disclose prompts, model response bodies, credentials, or arbitrary provider headers.
- Operability/recovery docs and ADR decision record problem, alternatives, chosen fencing invariant, rejected timer-only recovery, rollback, and exact evidence.
- k6/async buyer path must not add a p95 >20 ms control-plane regression to ordinary status/claim operations; profile DB locks/I/O if it does.
#974 is prerequisite evidence, not automatic succession: its current exact-head hosted GREEN does not transfer to this issue's future implementation.
Buyer-visible gap
The Ask browser no longer abandons valid queued/running work on an elapsed observation timer, and #974 makes post-chat transport timeout default-null. The backend Ask path still owns an explicit ~570 s socket limit, a 600 s execution deadline, and age-based orphan recovery. That means valid long-running model/tool work can still be terminated or reclaimed based primarily on elapsed wall time, while an immediate provider
TimeoutErrorand an actual worker deadline have different meanings.This conflicts with the LineageWeave/CO boundary: provider/model transport policy belongs to released contextual-orchestrator contracts, while LineageWeave owns durable task state, cancellation, settlement, recovery, and buyer-visible status. Removing the timers blindly is unsafe because the current orphan-recovery path lacks an execution-owner fence.
Required RED
Use realistic PostgreSQL-backed worker tests, not synthetic sleep-only assertions:
TimeoutErrormust remain a provider/unavailable failure and must not be labeled as LineageWeave worker deadline expiry.Do not make the suite wait ten real minutes. Drive the domain clock/lease timestamps deterministically while preserving the real DB claim/settlement transaction and cancellation path.
Minimal causal design target
Introduce an explicit execution ownership token/generation (or equivalent compare-and-set lease identity) on claim and settlement. Heartbeat/liveness renewal must be bounded, idempotent, and transactionally tied to the current owner. Recovery may reclaim only an expired owner generation and a stale worker-liveness condition; the old owner must be unable to settle afterward. Cancellation is a distinct terminal intent, not a synthetic timeout.
After fencing is GREEN, remove the hard-coded LineageWeave 600 s execution expiry and 570 s model socket policy unless a released contextual-orchestrator contract explicitly supplies a bounded administrator/provider timeout. Default model transport remains null. User cancel, provider end/failure, administrator policy, worker loss, and recovery must be distinguishable in status/evidence.
Boundaries / acceptance
#974 is prerequisite evidence, not automatic succession: its current exact-head hosted GREEN does not transfer to this issue's future implementation.