Cancellation, timeouts, and defensive invariants
Production reliability comes from every boundary reporting truthful state, not from hoping errors do not happen
request stop ≠ fully stoppedWhy can a timeout not simply Promise.race and forget the still-running work?
A fire alarm announcing evacuation does not mean the building is empty. The system must distinguish request issued, evacuation in progress, and verified clearance.
Mechanism
DeepSeek Harness uses structured error codes, AbortSignal, deadlines, and holder-owned disposal to separate stop requests from resource release.
The invariants service lets each package register verifiable conditions. Dispatchers isolate observer exceptions and report orthogonal outcomes independently so notification failure cannot falsify the primary operation.
Create deadline
Child operations share remaining budget instead of resetting timeout.
What extensions must preserve
- Cancellation cause is first-wins
- Completed dispose means resources are truly released
- Observer failure cannot revoke an authoritative committed operation
The tempting wrong turns
- ×Restarting a full timeout at every layer
- ×Catching every error and returning plain text
- ×Following a symlink outside the boundary before unlink
Do not trust the conclusion—verify it
These anchors are pinned to official deepseek-harness@47f9438; account for later breaking changes when reading current upstream.
Pause for ten seconds before revealing
Why must observer failure not make Session.append() fail?
The reliable single-agent spine is complete. Next we add replayable collaboration state: goals, plans, and todos.