fix(1468): a timed-out ack stops being reported as a failed mutation

[artokun]

Claims #1468.

panel_civitai_search and panel_exit_subgraph return isError:true after the command was applied. The reporter proved both: renderRev had advanced and the grid reported loading:true; the next panel_graph_outline showed scope root.

The mechanism I first published on the issue was wrong

Corrected publicly in the thread. Measured, not assumed:

• driveSearch does not await the CivitAI fetch — it fires void reload(...) and returns {dispatched:true, renderRev} with no await in the handler. That is panel agent-drive: civitai_search can time out during the first docked open (10s bridge timeout vs cold fetch) #282, shipped at panel 0.11.0; panel_civitai_search and graph_exit_subgraph time out after commands are successfully applied #1468 was filed from 0.11.44, so the reporter already had it.
• graph_exit_subgraph's own receipt (confirmCanvasNavigation) budgets 25 polls × 40 ms ≈ 1 s and returns early on success — 15 s already clears its worst case by 15×.

Neither was coupled to a slow operation. Both are the #357/#694 shape: a busy-but-alive main thread missing a tighter-than-default bound. Which makes raising the bound — the fix I had argued against — the right one for the first.

Changes

1. civitai_search: private 10000 → BRIDGE_DEFAULT_TIMEOUT_MS. Half this codebase's own default, fencing an external wait that no longer exists.

2. exit_subgraph: settle a no-reply with one scope read. Its effect is locally observable, so it asks instead of handing back "may have been applied" plus homework.

Observation	Reported as
scope:"root"	decisive — the goal state holds
scope:"subgraph"	not decisive; stays a failure, names the open question
probe unanswerable	today's message, untouched (#1473's rule)

The ambiguous case is ambiguous on purpose: exit pops to the immediate parent (#412), so "inside a subgraph" is equally consistent with "never landed" and "landed, from a nested subgraph". Resolving that by guessing would be the same harm as the false failure, pointed the other way.

Two overclaims caught while self-reviewing and fixed:

• the success payload says at_root, not exited — the read establishes where the canvas is, never that this command put it there;
• the ambiguous note originally said "do NOT retry blindly", which lands directly beneath the retry_of instruction ctx.call appends for every RETRY_TOKEN_CMDS timeout. Verified against the panel's ledger: a token retry is answered from the original's entry with no second executor run (Mutation retry needs an explicit caller retry-identity (the #683 revert's unsolved half) #694); a bare repeat executes fresh. The note now draws that distinction instead of contradicting the line above it.

Only a no-reply takes this path. A relayed executor verdict already reasoned about the same uncertainty with the canvas in front of it.

Verification

• Timeout strings measured against a real UiBridge + frozen tab, not transcribed from the template — graph_exit_subgraph does reach dispatch (it is fence-inert, panel_find_nodes is misclassified as mutating and blocked on older panels #778) rather than being refused pre-dispatch, which is the trap that would have made the whole path dead code.
• The fixture drives the real ctx.call token-minting branch (tagged reply-timeout + dispatched rid), so the assertions run against the production message shape.
• 6 new tests. 5/5 mutations killed, including deleting the call-site wiring while leaving the helper intact — the one that survives a helper-only suite.
• Full suite: 490 files, 9224 passed. lint, check:vocabulary, check:unknown-collapse, vocab:export --check, asset-counts --check, docs:gen all clean.

Found while measuring, not in scope here

panel_civitai_results is the command that genuinely awaits the fetch (await state.activeReloadPromise), on the same 10 s bound. It is a read, so its timeout is not the false mutation failure this issue is about — filed separately rather than folded in.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[artokun]

Scope note — panel_enter_subgraph is deliberately not included.

It sits two lines away from exit_subgraph, carries the same 15 s bound, and goes through the same confirmCanvasNavigation receipt, so leaving it out is a choice rather than an oversight and is worth stating.

Two reasons:

1. The issue names exit, and the reporter's evidence is about exit. I have no measurement that enter misbehaves.
2. enter is actually the easier case to settle — its goal state is fully checkable, since viewing.owner_node_id should equal the node_id that was requested, whereas exit's "inside a subgraph" reading is irreducibly ambiguous under comfy_cli_search_nodes fails instead of falling back when comfy CLI is absent #412. That makes it a clean follow-up, but it also means widening this PR would ship a second, differently-shaped verification on the back of one review.

If enter turns out to need it, the settle helper generalises to it directly — the only new part is comparing owner_node_id against the requested node rather than testing for root.

[artokun]

Codex gate: three rounds, all findings closed.

Round	Verdict	Finding	Status
1	NO-SHIP	P1 — settling read uncorrelated; ctx.call can silently rebind to another tab, so a different tab at root becomes success	fixed — probe pinned to the dispatch tab
1	NO-SHIP	P1 — loose text predicate could promote an acked error to success	see round 2
2	NO-SHIP	rebind closed; the "canonical" predicate still cannot separate an acked error reproducing the sentence verbatim	fixed at the cause — see below
3	NO-SHIP	P1 — inner retry catch dropped the tag	fixed (found independently in the same audit)

Round 2 is the one that changed the design. Codex rejected message-text matching twice and was right both times: acked panel errors arrive as arbitrary msg.error text and ctx.call flattens both kinds into the same text-only result, so any sentence the bridge can write, a panel error can also contain. No regex separates them.

The bridge already answers this exactly — markReplyTimeout / isReplyTimeoutTagged, on the error object, at the only place that knows. It was simply being dropped in translation. ctx.call now carries it onto the result as a non-enumerable symbol and the settle path keys on that; no text is parsed anywhere in the new path. isAckTimeout is byte-identical to main again.

The evidence that finding was real rather than theoretical: mutation M8 re-implements the text predicate and is killed by a fixture carrying the canonical sentence verbatim.

Round 3's finding, honestly scoped: it was a completeness gap, not a correctness one — graph_exit_subgraph is not retry-safe so it cannot reach that branch, and an unmarked result fails closed. Fixed anyway, because it would have silently switched the settle off for a real sequence.

One correction to my own earlier claim in this PR: I said the symbol is invisible downstream. Measured: invisible to JSON.stringify, Object.keys, for..in and spread — but Reflect.ownKeys/getOwnPropertySymbols can see it. No consumer does that, and the wire payload is unchanged, but "non-enumerable" is not "unreachable".

Final: 490 files / 9227 tests, tsc clean, all six repo gates clean, 8/8 mutations killed.