fix(ask): preserve authorized observation until completion

AGENTS.md

@@ -386,6 +386,11 @@ exist on the post.
 
 ## CI gates
 
+Record hosted results with their exact commit and run URL, including skipped
+tests and warnings. Counts from independent PRs are not evidence that their
+changes were integrated. Preserve local failures alongside later hosted success;
+an evidence-only commit still needs its own current-head required checks.
+
 `.github/workflows/tests.yml` runs the full suite on every PR to `main`.
 Do not weaken, skip, or `continue-on-error` a failing check -- fix the
 underlying cause or, for a genuine false positive in a third-party scanner,
@@ -422,3 +427,27 @@ columns). Do not silently rewrite either historical form. The SHACL
 shapes graph (`docs/ontology/lineageweave-kg-shapes.ttl`) is the
 closed-world data-validation boundary for DB-to-RDF projections and is
 published beside the ontology.
+
+## Authorization-sensitive asynchronous UI
+
+Bind imperative result, error, and loading completion to the originating
+component authorization lifecycle. Token equality alone cannot distinguish
+retired A from current A after A → B → A. Clear prior questions, answers, and
+evidence selection when credentials change, and verify that a retired success
+or failure cannot end the current request's loading state. Keep behavioral
+regressions synthetic; UI retirement does not itself cancel a server-side job.
+
+Pass a native AbortSignal through client polling and fetch when retiring an
+authenticated screen. Preserve the abort reason instead of reporting a network
+failure, and clear delay timers/listeners. Result-admission guards remain necessary
+for already-resolved work. Verify both transport cancellation and A → B → A
+state admission; neither establishes server-job cancellation.
+
+Do not infer Ask job failure from browser observation age. Queue wait and model
+execution are distinct; follow durable terminal status or native cancellation.
+Before removing a worker execution deadline, inspect orphan recovery: an
+age-only requeue rule can duplicate a still-live computation without claim fencing.
+
+Keep transport exceptions at the diagnostic boundary. Buyer-facing error copy
+must not use String(error) or provider detail; reuse existing localized recovery
+guidance and preserve explicitly supported status-specific behavior.

docs/adr/0039-global-ask-agent-source-boundary.md

@@ -38,3 +38,51 @@ explicit next action; the agent never fabricates an answer or citation.
   response.
 - The initial context is bounded to 50 recent rows. Retrieval/reranking is a
   later upgrade if corpus size or prompt budget requires it.
+
+## Proposed amendment: client observation lifetime (2026-09-07)
+
+This amendment remains Proposed pending protected review. It does not change
+the Accepted evidence-source decision above.
+
+### Context and decision drivers
+
+The client currently abandons a durable Ask job fifteen minutes after
+submission, including queue wait. A synthetic deferred-status regression
+reproduces abandonment after a queued job becomes running, before its next
+succeeded response can be read. Elapsed observation time does not establish
+provider failure. The requested model policy has no default application limit.
+
+### Considered options and proposed outcome
+
+Retaining or increasing the fixed ceiling bounds browser polling but still
+rejects valid work solely because time elapsed. A second browser timeout setting
+duplicates policy outside contextual-orchestrator. Instead, continue the existing
+two-second polling until a terminal response, transport failure, or native
+AbortSignal cancellation. Keep credential-generation admission checks for work
+that already resolved when the screen was retired.
+
+### Consequences and confirmation
+
+The browser can observe late answers without resubmitting paid work. Polling can
+continue indefinitely while a visible screen follows a stranded job; cancellation
+on unmount or credential change still retires client I/O, not the server job.
+The regression must advance past the former ceiling, observe a nonterminal
+status, and then receive the actual completed answer. Existing cancellation
+tests must continue passing without timer or listener leaks.
+
+Only the persisted `queued` and `running` states mean observation should
+continue. A `succeeded` response without its answer, a missing/unknown state,
+or a null response is unavailable to this reader, not ongoing work. Stop
+client polling and reuse the existing localized recovery guidance without
+changing the durable job or resubmitting it. A failed response likewise must
+not expose its diagnostic detail through the client error. Synthetic regressions
+must prove prompt settlement, no remaining polling timer, no extra request,
+and restored question controls; valid late answers remain observable.
+
+This is only the client observation decision. The backend's 600-second execution
+deadline, answer socket limit, and 660-second age-based orphan recovery remain
+an unresolved policy conflict. Removing execution limits requires a separate
+worker-liveness and claim-fencing decision so recovery cannot duplicate a live
+computation. Preserve ADR 0213's rule against holding pooled database connections
+during provider work. No model administrator contract or end-to-end unlimited
+execution is established by this amendment.