ai(lifecycle): unify Stop Generation, cancellation, supersession and duplicate-request semantics

[qnbs]

Context

Dedicated Wave 0C child of #704.

WorldScript Studio now has an explicit project-incarnation correctness layer:

• PR fix(project): guard AI-generation results against a stale/switched active project #707 established fail-closed project identity/generation authority;
• ai(project): bind asynchronous image and interview side effects to originating project #708 owns remaining direct image/storage/interview side-effect authority;
• ai(project): bind Writer, Copilot and deferred AI results to originating project incarnation #713 owns Writer/Copilot/deferred apply-later AI result authority.

Those correctness layers answer:

May this result still affect this project?

They do not by themselves answer the separate lifecycle question:

Should this AI request/stream/task still be running, and what happens when it is stopped, superseded, duplicated, unmounted or abandoned?

Cancellation behavior is currently spread across hooks, thunks, provider adapters, workers, local inference paths and UI controls. #704 previously carried this as “Wave 0C”, but the umbrella is now too broad to serve as the durable implementation owner.

This issue owns the bounded AI request lifecycle contract across currently admitted WorldScript AI surfaces.

---

Core invariant

Cancellation and project authority are complementary and must remain independent:

PROJECT AUTHORITY
= may a late result/chunk mutate/apply/export to the current project?

REQUEST LIFECYCLE
= should the underlying work continue, be superseded, stop producing UI state, or release resources?

A cancelled operation may still deliver a late provider callback.
A non-cancelled operation may become stale because the user switched projects.

Therefore:

• cancellation must never replace fix(project): guard AI-generation results against a stale/switched active project #707/ai(project): bind asynchronous image and interview side effects to originating project #708/ai(project): bind Writer, Copilot and deferred AI results to originating project incarnation #713 authority checks;
• authority checks must remain correct even when cancellation cannot physically stop the provider/runtime;
• stopping work should minimize wasted inference/network/CPU and settle UX deterministically.

---

1. Inventory every production AI lifecycle

Derive the authoritative inventory from current source, not historical assumptions.

Search every production path using or wrapping:

AbortController / AbortSignal
streaming callbacks
ReadableStream / async iterator
provider SDK stream APIs
fetch cancellation
worker message cancellation
local inference cancellation
generation ids/request ids
isGenerating flags
Stop Generation buttons
cancel/stop handlers
unmount cleanup
supersession/latest-request logic
retry/fallback loops
background AI tasks

At minimum classify known surfaces such as:

• Writer generation/continuation/rewrite flows;
• legacy streamGenerationThunk;
• Global Copilot;
• Character Interviews;
• outline generation/regeneration;
• character/world generation and field regeneration;
• image generation/refinement/scene visualization;
• logline/proofread/synopsis;
• Critic/Consistency Checker;
• ProForge/HITL stages;
• provider connection tests where cancellable;
• RAG/context-assisted generation;
• plugin ai.invoke where admitted;
• browser-local WebLLM/ONNX/Transformers paths;
• Ollama/OpenAI-compatible local server paths;
• background/deferred AI work if currently reachable.

Produce a lifecycle matrix:

Surface	Starts where	Stream?	Current cancel primitive	UI Stop?	Supersession	Cleanup	Late-result guard owner	Required disposition

Do not assume every operation needs a user-visible Stop button; classify intentionally.

---

2. Canonical request lifecycle vocabulary

Establish a small explicit state vocabulary sufficient for product/runtime correctness.

Conceptually:

IDLE
STARTING
RUNNING
STREAMING
STOP_REQUESTED
CANCELLED
SUCCEEDED
FAILED
SUPERSEDED

Exact implementation may differ.

Requirements:

• terminal states are unambiguous;
• a superseded request is distinguishable from provider failure where product behavior differs;
• “cancel requested” does not falsely imply the provider has definitely stopped if the transport/runtime cannot guarantee it;
• stale late callbacks after terminal state cannot reopen the operation;
• UI derives from authoritative request state rather than multiple drifting booleans where practical.

Do not over-engineer a distributed workflow engine.

---

3. AbortSignal propagation

For every provider/runtime path that supports cooperative cancellation, propagate one admitted cancellation signal from product orchestration to the lowest practical boundary.

Audit:

UI/hook
→ thunk/service/orchestrator
→ routing/fallback
→ provider adapter
→ fetch/SDK/worker/runtime

Required properties:

• no accidentally-created inner AbortController severs caller cancellation;
• provider adapters do not swallow AbortError and convert it into generic failure;
• fallback/retry loops stop when caller cancellation is authoritative;
• a cancelled primary request must not silently trigger a fallback provider unless explicitly defined and safe;
• local-only/privacy modes remain intact;
• cleanup releases listeners/controllers/stream readers.

Where a provider SDK cannot truly cancel remote generation, stop local consumption and rely on mutation/project guards for late data.

---

4. Stop Generation product contract

Inventory every visible Stop/Cancel control and define what it guarantees.

A correct Stop Generation action should normally mean:

user requests stop
→ request transitions to stopping/cancelled semantics
→ transport/runtime cancellation attempted
→ no subsequent late chunk/result is admitted to active UI/project state
→ loading/streaming indicator settles
→ controls return to a usable state
→ partial output policy is explicit

For each surface decide whether partial output is:

DISCARD
KEEP_READ_ONLY
KEEP_EDITABLE
KEEP_AND_ALLOW_APPLY_IF_ORIGIN_STILL_VALID

Do not let individual hooks invent incompatible semantics accidentally.

Do not report cancellation as a provider/network error toast unless cancellation itself genuinely failed in an actionable way.

---

5. Supersession / latest-request semantics

Rapid repeated user actions can start overlapping work.

For each applicable surface decide explicitly:

REJECT_DUPLICATE_WHILE_RUNNING
CANCEL_PREVIOUS_AND_START_NEW
ALLOW_CONCURRENT_WITH_SEPARATE_IDS
QUEUE

Examples to inspect:

• Writer regenerate/rewrite actions;
• Copilot send while prior response streams;
• outline/field regeneration;
• portrait/world/scene image retry/refinement;
• logline/proofread/synopsis repeated clicks;
• provider connection tests;
• ProForge stage actions.

Requirements:

• a newer request must not accidentally receive chunks/status from an older request;
• late completion from request N must not overwrite request N+1 UI/result state;
• cancellation of N must not cancel unrelated N+1;
• duplicate clicks cannot create unbounded billable/network work;
• same-project authority remains separately enforced by ai(project): bind asynchronous image and interview side effects to originating project #708/ai(project): bind Writer, Copilot and deferred AI results to originating project incarnation #713.

Use explicit request IDs/generation tokens where needed, but do not create a second project-incarnation authority.

---

6. Streaming admission

Streaming paths require stronger lifecycle discipline than one-shot requests.

For every stream:

chunk arrives
→ request identity still current?
→ lifecycle still admits chunks?
→ project/result authority still valid where mutation/apply-capable?
→ then update admitted state

At minimum audit:

• Writer;
• Global Copilot;
• Character Interviews;
• provider-native text streaming;
• any local model token streaming.

After Stop/Supersede/Unmount:

• late chunks are ignored deterministically;
• no UI state reopens;
• no stale transcript/history mutation occurs;
• stream-reader/iterator resources are released where possible.

#708/#713 remain the source of project ownership truth.

---

7. Component unmount / navigation lifecycle

Audit what happens when users:

• navigate away from a view;
• close a modal/panel;
• switch feature modes;
• disable a feature flag;
• close Global Copilot;
• leave Character Interviews;
• switch projects;
• reset/import/restore;
• log out of a provider-like integration if applicable;
• close/reload the application.

Do not indiscriminately cancel every operation on every UI unmount if the product intentionally supports background completion.

Instead classify each operation:

VIEW_SCOPED_CANCEL_ON_UNMOUNT
PROJECT_SCOPED_CONTINUE_WITH_AUTHORITY
APP_SCOPED_BACKGROUND
PERSISTENT_TASK
NOT_ALLOWED_BACKGROUND

Any operation that continues after view unmount must have an explicit result destination and ownership contract.

---

8. Error taxonomy: cancelled is not failed

Normalize cancellation-related error handling so user-visible behavior is truthful.

Distinguish at minimum:

USER_CANCELLED
SUPERSEDED
PROJECT_STALE_REJECTED
TIMEOUT
NETWORK_ABORTED
PROVIDER_ERROR
RATE_LIMITED
AUTH_ERROR
CAPABILITY_UNSUPPORTED
LOCAL_RUNTIME_TERMINATED

Do not expose raw provider exception strings containing sensitive metadata.

Do not count intentional cancellation as ordinary feature failure in diagnostics/telemetry-like local evidence.

#551 owns broader structured diagnostic architecture; reuse its semantics where available rather than creating a disconnected logging taxonomy.

---

9. Timeout semantics

Cancellation and timeout are related but not identical.

Audit current timeouts across providers/local inference.

Required policy:

• timeout values are workload/provider appropriate rather than one arbitrary global constant;
• timeout aborts the request when supported;
• timeout produces an actionable TIMEOUT state, not USER_CANCELLED;
• fallback after timeout follows explicit routing policy;
• no retry storm;
• image/long-form/local-model workloads may legitimately need different thresholds;
• mandatory tests use deterministic fake clocks/controlled transport where possible rather than sleeping for real timeout durations.

Do not tune production timeouts merely to make CI pass.

---

10. Provider/fallback-chain cancellation

#704 owns model/provider correctness; this issue owns lifecycle propagation through routing.

Verify:

cancel before provider attempt
cancel during primary
cancel between primary failure and fallback
cancel during fallback
cancel during retry/backoff

Cancellation must short-circuit further attempts unless the product explicitly defines otherwise.

A user pressing Stop must not result in another cloud provider being contacted because the aborted request was misclassified as a retryable network error.

Preserve privacy/local-only boundaries.

---

11. Local inference lifecycle

Audit currently admitted local runtimes:

Ollama / OpenAI-compatible local server
WebLLM
ONNX Runtime Web
Transformers.js

Where applicable verify:

• request cancellation;
• token-stream stop;
• worker termination vs reusable worker state;
• model remains loaded when appropriate after one request cancellation;
• no model/device resource leak per cancel/retry cycle;
• device-lost/OOM remains a separate failure state;
• cancelling inference does not delete downloaded model artifacts;
• editor/autosave responsiveness recovers promptly.

Coordinate broad browser-local model lifecycle with #483/#556; do not duplicate model catalogue or artifact-storage work here.

---

12. Images and non-streaming long operations

Image generation may not expose token streaming but still needs lifecycle correctness.

Audit Character/World/Scene image paths for:

• duplicate generation clicks;
• refinement superseding prior generation;
• cancellation support of provider request where available;
• UI loading state cleanup;
• late result after Stop/Supersede;
• project authority before persistent commit (ai(project): bind asynchronous image and interview side effects to originating project #708).

Cancellation alone must never authorize a late persistent write.

---

13. ProForge / agentic workflows

ProForge can have multi-stage or HITL semantics.

Do not apply a naive single-request AbortController if the pipeline has meaningful stage boundaries.

Derive current production behavior and define:

• cancel current stage;
• cancel whole run;
• pause/wait at HITL;
• superseding a run;
• background continuation policy;
• partial artifacts/state after cancellation;
• rollback/non-mutation guarantees;
• provider calls already in flight.

Keep this bounded to lifecycle semantics; do not redesign the entire ProForge architecture.

---

14. Plugin ai.invoke

If currently production-admitted for plugins, ensure plugin-triggered AI requests cannot create unbounded uncancellable work.

Required where applicable:

• bounded timeout;
• cancellation/termination when plugin execution is terminated;
• plugin does not receive provider credentials;
• provider/privacy policy remains authoritative;
• late result cannot apply project mutation without the plugin side-effect authority contract.

Coordinate marketplace/security evolution with #348; do not broaden this issue into plugin distribution.

---

15. Background AI tasks

Inventory any background AI/task paths currently reachable.

Each must explicitly classify lifecycle:

foreground-only
continue after view close
continue after project switch only if project-owned and authority-bound
cancel on app/page lifecycle
persistent resumable task

Do not invent persistent background execution for browser/PWA merely to make cancellation architecture uniform.

PWA deferred work remains constrained by #488.

---

16. UI concurrency / control semantics

For every user-visible generation surface verify:

• Start/Generate cannot spawn accidental uncontrolled duplicates;
• Stop is available only when meaningful;
• disabled/loading controls reflect actual request lifecycle;
• Stop then immediate Regenerate is deterministic;
• project switching does not leave permanently disabled controls;
• feature disable/reenable does not resurrect old request state;
• partial result policy is clear;
• screen-reader/live-region status is meaningful where existing accessibility architecture supports it.

Coordinate broader accessibility requirements with #557.

---

17. Resource cleanup

Repeated generate/stop/regenerate cycles must not leak:

• AbortControllers/listeners;
• stream readers;
• timers;
• worker message handlers;
• object URLs;
• provider SDK streams;
• queued fallback promises;
• model request buffers;
• React state updates after unmount.

Add focused leak/lifecycle assertions where deterministic; do not introduce brittle heap-size CI gates without evidence.

---

18. Deterministic regression matrix

Required source/integration coverage should include representative permutations:

One-shot

start → succeed
start → user cancel
start → timeout
start → supersede
start → unmount
cancel → late success callback

Streaming

start → chunk → stop → late chunks
start N → chunk → start N+1 → late N chunks
stream under A → switch to B → late chunks

The last case must prove lifecycle + project-authority composition rather than assigning both responsibilities to one guard.

Fallback

primary running → cancel → no fallback
primary fails → fallback starts → cancel
cancel during backoff → no next attempt

Duplicate action

rapid double click
Stop + immediate Regenerate
multiple independent surfaces concurrently

Use deterministic mocked provider/transport boundaries in mandatory CI.

---

19. Product-level E2E relationship

#710 owns the broad AI functional E2E inventory.

Once source lifecycle semantics are admitted, #710 should prove representative user journeys such as:

Writer stream → Stop → no late mutation
Character Interview → Stop → no late transcript mutation
Copilot → supersede/stop → only current result remains applicable

Do not duplicate every provider × cancellation permutation in Playwright.

Adapter/service/unit/integration tests carry the detailed lifecycle matrix.

#712 may select one production-bundle lifecycle canary only if it gives unique build/CSP/chunk signal.

---

20. Diagnostics / privacy-safe evidence

Record only lifecycle metadata needed for debugging, for example:

request kind
provider class/model id where non-sensitive
request id
start/end state
duration
cancel source
error category
application SHA/environment

Do not log:

• manuscript content;
• prompts/results;
• API keys/tokens;
• private filesystem paths;
• provider account metadata.

Coordinate structured redaction/evidence format with #551/#704.

---

21. Implementation architecture constraints

Prefer reusable request-lifecycle semantics, but avoid an invasive rewrite merely for uniformity.

Good architecture should provide:

one caller-owned cancellation path
explicit request identity
explicit terminal state
late-event admission check
provider/runtime propagation
bounded cleanup

without forcing every provider to implement unsupported primitives.

Do not:

• replace Redux/project authority with request IDs;
• move all AI orchestration to Rust;
• add a generic workflow framework unrelated to current needs;
• make provider-specific limitations appear as universal guarantees;
• silently change privacy fallback behavior.

---

Acceptance criteria

• All production AI surfaces have an explicit cancellation/supersession lifecycle disposition.
• A shared lifecycle vocabulary distinguishes success, failure, user cancellation, supersession, timeout and stale-project rejection where product behavior differs.
• Caller cancellation propagates through routing/adapters to supported transport/runtime boundaries.
• Cancellation stops fallback/retry chains unless explicit policy says otherwise.
• User Stop cannot be misclassified into an automatic cloud/provider fallback.
• Streaming callbacks verify current request lifecycle before admitting chunks.
• Late callbacks after cancel/supersede cannot reopen or overwrite current request state.
• Duplicate actions have explicit reject/cancel/queue/concurrent semantics rather than accidental races.
• Writer, Copilot and Character Interview representative streaming paths are regression-tested.
• Image/non-streaming long operations settle UI correctly and remain subject to ai(project): bind asynchronous image and interview side effects to originating project #708 persistent-write authority.
• Component unmount/navigation behavior is explicitly classified rather than relying on incidental React cleanup.
• Local inference cancellation releases request resources without unnecessarily destroying reusable model state.
• Timeout semantics are distinct from user cancellation.
• Repeated cancel/regenerate cycles do not accumulate obvious listeners/timers/stream handles.
• fix(project): guard AI-generation results against a stale/switched active project #707/ai(project): bind asynchronous image and interview side effects to originating project #708/ai(project): bind Writer, Copilot and deferred AI results to originating project incarnation #713 project-incarnation guards remain authoritative and are not weakened or replaced.
• test(ai-e2e): qualify Copilot, Character Interviews, ProForge and mutation-capable AI user flows #710 receives stable product-level Stop/supersession contracts to qualify after source fixes land.
• Mandatory CI remains deterministic, secret-free and does not require paid/live providers.
• Exact-head CI/CD, CodeQL and current-head review convergence are green before implementation PRs merge.

---

Non-goals

• provider/model catalogue refresh (ai: requalify current model catalog, defaults and end-to-end AI functionality across all providers #704);
• fixing project-incarnation ownership already owned by ai(project): bind asynchronous image and interview side effects to originating project #708/ai(project): bind Writer, Copilot and deferred AI results to originating project incarnation #713;
• paid real-provider calls in mandatory CI;
• rewriting all AI orchestration into one new framework;
• adding persistent browser background execution;
• starting Qt implementation;
• changing project storage/encryption;
• broad ProForge redesign;
• treating cancellation as proof that stale writes/results are impossible.

---

Priority / sequencing

P1 lifecycle correctness after/alongside terminal Wave 0B authority fixes.

Recommended dependency graph:

#708 direct/persistent/stream project authority
      +
#713 deferred/apply-later project authority
      ↓
THIS ISSUE — Wave 0C request lifecycle
      ↓
#710 functional AI E2E
#711 opt-in admission where Stop/network policy matters
#712 selected production canaries
      ↓
#623 evidence-based required/advisory graduation

Bounded implementation PRs are preferred by surface/lifecycle primitive rather than one repository-wide mega-PR. Preserve current work and rebase sequencing on live repository state before execution.

[qnbs]

Requalified from successor PR #734: Character Interview currently passes the thunk cancellation signal to streamText, but a project-incarnation change only marks the stream stale in the chunk callback; it does not itself abort the provider transport. This is a valid request-lifecycle/resource-release gap owned by #714, not #708 direct mutation authority. Keep #734 scoped to rejecting stale chunks/completion; address abort/supersession propagation in the bounded #714 lifecycle slice.

[qnbs]

v1.28.7 release-gate relationship

#743 is now the durable AI / Local-AI pre-release PASS/FAIL tracker.

#714 remains the implementation authority for request lifecycle/cancellation/supersession. For v1.28.7, only the subset required by currently admitted local runtimes is a hard release prerequisite:

• caller cancellation reaches the lowest practical runtime/transport boundary;
• USER_CANCELLED is distinct from ordinary provider failure;
• TIMEOUT is distinct from user cancellation;
• cancellation cannot accidentally trigger retry/provider/cloud fallback;
• late stream chunks/results after cancel or supersession are rejected;
• older requests cannot overwrite newer request state;
• repeated Stop → Generate remains functional;
• request-specific readers/listeners/workers/timers are cleaned up;
• cancellation does not unnecessarily destroy reusable downloaded/model state;
• OOM/device-lost/runtime-terminated states remain recoverable/actionable.

This does not require every cloud/ProForge lifecycle edge in #714 to be completed before v1.28.7 unless promoted by #743's P0/P1/release-critical-P2 rule. Preserve #707/#708/#713 project authority independently; request lifecycle must not replace it.

[qnbs]

Lifecycle checkpoint — #745 terminal; #747 split preserves follow-up evidence — 2026-09-14

PR #745 (fix(ai): propagate duplicate cancellation signals) is terminal for its bounded #714 lifecycle slice.

• final exact head: 796f5f8c0dff85e8649526b807963e98e3f2a8f3
• exact-head CI/CD #3146: PASS
• exact-head CodeQL SAST #2994: PASS
• merged resulting main: 505574dc97e411530c61dfc1f444bc87ec113752
• fix(ai): propagate duplicate cancellation signals #745 source/review convergence was clean; the later resulting-main CI failure was not a lifecycle regression: the Security Audit discovered newly-known RUSTSEC-2026-0285 in transitive rustls 0.23.40.
• bounded security follow-up fix(security): update rustls to patched release #746 updated rustls to the fixed 0.23.45, merged as 3e94cfb2a23fef6e19b8afe1a26d9742f9c6286e, and resulting-main CI/CD #3150 + CodeQL #2998 are PASS. The post-fix(ai): propagate duplicate cancellation signals #745 main line is therefore terminally verified again.

#745 lifecycle contract now present on main

This slice advances #714 by propagating duplicate-request/service cancellation through the AI provider path and relevant downstream work while preserving caller-owned cancellation. In particular, the accepted behavior includes:

• caller/service duplicate cancellation reaches provider work rather than stopping only at the façade;
• cancellation is fenced from late chunk/result publication;
• expected AbortError / user-cancel paths are not surfaced as ordinary provider failures;
• cancellation must not continue into retry/provider fallback;
• duplicate-request ownership remains scoped so unrelated project/entity work is not intentionally coupled;
• affected embedding/RAG/image/provider paths retain cancellation propagation rather than severing the caller signal.

This is a bounded lifecycle advance, not closure of #714. The full lifecycle inventory and the release-critical local-runtime subset remain open.

Review findings carried forward from the frozen #747 architecture reference

PR #747 is now intentionally Draft / superseded as a merge unit at reference head 0e511aa1543baf6c0fa83b483747ebdea10f6015 and will be reconstructed as sequential bounded PRs. Its review wave surfaced several lifecycle-related findings that must be base-compared before mutation, including:

• request-dedup identity using only a prompt prefix;
• AbortSignal.any compatibility on runtimes without that static helper;
• partial streamed output followed by fallback output;
• direct-path/dedup and fallback-state concurrency observations.

For each finding, distinguish INTRODUCED_BY_747 from PRE_EXISTING_EXPOSED_BY_747. A pre-existing lifecycle defect remains a durable #714 follow-up (and, if release-critical, #743 evidence); it must not be silently absorbed into an architectural child PR merely because extraction made it easier to see.

#714 therefore remains OPEN. Preserve the existing separation from #707/#708/#713 project-incarnation authority: request cancellation/supersession reduces wasted/stale work, but project/apply authority remains independently fail-closed.

[qnbs]

Current-main lifecycle checkpoint — 2026-09-16

The issue body remains the lifecycle contract, but several architecture references have moved and should no longer be read as current file ownership.

Current implementation foundation:

• fix(ai): propagate duplicate cancellation signals #745 is terminal for duplicate-request cancellation propagation and late-result/chunk suppression on the covered paths. It is a meaningful ai(lifecycle): unify Stop Generation, cancellation, supersession and duplicate-request semantics #714 slice, not closure of this issue.
• refactor(ai): extract provider request lifecycle #748 is terminal for shared AI request contracts, merged-signal/AbortError ownership, and request-dedup lifecycle extraction under services/ai/.
• refactor(ai): extract provider adapters #759 is terminal for Anthropic, OpenAI/Grok, and local OpenAI-compatible provider-adapter extraction.
• refactor(ai): extract connection-diagnostics and local-model-discovery #761 has now merged the connection-diagnostics/local-model-discovery extraction from a fresh current-main branch; it is structural and deliberately did not claim ai(lifecycle): unify Stop Generation, cancellation, supersession and duplicate-request semantics #714 completion.
• refactor(ai): decompose ai provider service #747 remains a frozen XXL draft/reference only. Its review findings must be semantically reclassified against current main; do not rebase/merge/cherry-pick it wholesale.
• ai(project): bind asynchronous image and interview side effects to originating project #708/direct authority is terminal; ai(project): bind Writer, Copilot and deferred AI results to originating project incarnation #713 remains the separate active owner for deferred/apply-later project authority.

Current path authority

Historical references to one monolithic services/aiProviderService.ts are no longer sufficient implementation guidance. Provider transports now live under services/ai/providers/*, lifecycle/contracts under services/ai/*, discovery under services/ai/discovery/*, while the legacy service remains a compatibility/orchestration façade pending the remaining bounded orchestration extraction.

Any #714 implementation must therefore re-fetch current source and trace cancellation from product caller through the current orchestration/provider/runtime boundaries rather than copying old line references.

Carry-forward rules

Valid pre-existing lifecycle findings exposed by #747 still belong here when they concern cancellation, supersession, retry/fallback short-circuiting, late-event admission, cleanup, timeout classification, or request identity. Structural decomposition by itself does not satisfy them.

Keep ownership split explicit:

#713 = project/result authority
#714 = general request lifecycle
#731 = Claude-specific transport budgets + genuine SSE streaming, including only the transport-level cancellation needed for that path

#731 must integrate with this lifecycle contract rather than create a competing cancellation state machine.

Remaining terminality requirement

#714 stays OPEN/P1 until the full production-surface lifecycle inventory and regression matrix in the body are satisfied, including local runtimes, Stop Generation semantics, timeout-vs-user-cancel truth, fallback/retry cancellation, supersession, unmount/background disposition, and resource cleanup.

Do not infer issue completion from #745/#748/#759/#761 being green individually.

[qnbs]

Current-main addendum — partial-stream fallback corruption + vacuous Grok regression — 2026-09-16

Revalidated against current main 4137286887275ca03aa5b75906e6b529c68c786c after #761. This is still current and belongs to this lifecycle owner.

P1 — once a streaming attempt emits user-visible text, fallback must not append a second provider answer

Current services/aiProviderService.ts still contains a Grok-specific emitted-chunk guard (createGrokAttemptCallbacks) rather than a provider/attempt-generic stream-admission invariant.

An empirical current-main repro from the 2026-09-16 audit exercised:

provider = openrouter
hybrid fallback chain includes gemini
OpenRouter emits: PARTIAL-
then throws
Gemini fallback returns: FALLBACK-FULL-ANSWER

Observed callback sequence:

["PARTIAL-", "FALLBACK-FULL-ANSWER"]

with no terminal onError; the call is treated as success. That can concatenate two semantically independent answers into one logical response.

Code inspection indicates the same invariant needs to cover, not merely the reproduced OpenRouter→Gemini case:

• every provider attempt in the normal fallback chain;
• heuristic fallback after any emitted stream text;
• OpenRouter transient-failure promotion/fallback;
• retry/fallback branches introduced or moved by the later orchestration decomposition.

Required invariant

For each streaming attempt, track whether that attempt has emitted any externally visible text. Once emitted === true:

provider failure / transport error / transient classification
        ↓
NO second provider/heuristic answer may be appended to the same logical stream
        ↓
settle under the admitted partial-stream failure/cancellation contract

Do not special-case only Grok. The admission fence belongs around the orchestration attempt itself so extraction into the future services/ai/orchestration/* slice cannot preserve the current bug accidentally.

This should be fixed before or as the first correctness step of the remaining #747 orchestration residual, not after a behavior-preserving move.

P1 test gap — current Grok regression is vacuous

The existing Grok regression that configures conceptually:

{ provider: 'grok', fallbackProviders: ['gemini'] }

and asserts Gemini is not called does not actually prove the partial-output guard if resolveProviderFallbackChain currently honors explicit fallbackProviders only for local-provider routing and therefore resolves this setup to [grok].

A test that passes because the fallback is absent from the resolved chain will survive removal of the intended guard.

Required regression tests should first prove a non-empty, actually reachable fallback path, then exercise:

1. primary emits at least one chunk;
2. primary fails;
3. fallback would be reachable absent the emitted fence;
4. fallback is not invoked/appended after partial output;
5. zero-chunk failure still follows the normal admitted fallback contract;
6. heuristic and OpenRouter transient-promotion branches receive equivalent coverage.

Prefer mutation-resistant assertions: assert the resolved/attempted providers or explicit fallback-call count in addition to output.

Ownership / sequencing

This is lifecycle/stream-admission correctness under #714 and composes with #713 project-incarnation authority; it is not merely structural #747 cleanup. Treat it as release-critical for #743 because concatenating two provider answers can surface materially corrupted generated content while reporting success.

[qnbs]

Current-main recheck after #768/#769 and #747 closure — 2026-09-16

Revalidated the promoted partial-stream defect against current main:

06fa5d64cccdc451849646d40234f79fb13fbbcd

It remains present. Current services/aiProviderService.ts still has the partial-output fence as a Grok-specific helper (createGrokAttemptCallbacks) rather than an attempt/provider-generic stream-admission invariant, while streamText() still contains the broader heuristic/fallback orchestration. The existing Grok regression still configures fallbackProviders: ['gemini']; the previously documented reachability problem therefore remains part of the required test correction.

Repository state relevant to sequencing has changed:

• fix(project): reject stale deferred AI results in outline/logline/proofread/synopsis #768/fix(project): reject stale AI generations in Writer, Global Copilot, and Dashboard after a project switch #769 advanced ai(project): bind Writer, Copilot and deferred AI results to originating project incarnation #713 project-result authority but do not resolve this ai(lifecycle): unify Stop Generation, cancellation, supersession and duplicate-request semantics #714 output/lifecycle defect.
• Stale architectural PR refactor(ai): decompose ai provider service #747 is now CLOSED, unmerged, reference-only. Do not phrase the next work as completing or rebasing refactor(ai): decompose ai provider service #747.
• If orchestration decomposition remains useful later, reconstruct it selectively from the then-current verified main only after this correctness invariant is fixed or as part of the same bounded correctness-first slice.

Next bounded #714 slice

1. make emitted-output tracking generic per stream attempt/provider;
2. once any externally visible text has been emitted, prohibit provider/heuristic full-answer fallback for that logical stream;
3. preserve zero-chunk fallback behavior;
4. define/test explicit partial-output + failure semantics;
5. replace the vacuous Grok setup with a test construction where the second provider is provably reachable if the guard is removed;
6. add deterministic coverage for OpenRouter, heuristic fallback, and transient-promotion paths identified by the current audit.

This remains P1 / #743 pre-PASS work.

[qnbs]

Reopening — auto-closed in error, full lifecycle matrix remains open

This issue was closed automatically when PR #770 merged, because that PR's body used "Fixes #714" — GitHub's linked-closing-keyword parser doesn't distinguish that from a genuine full closure. Correcting now; reopening.

What #770 actually satisfied

PR #770 (fix(ai): stop appending fallback text after any provider emits a partial stream, merged cf809d81) is exactly the specific bounded slice this issue's own 2026-09-16T09:38:48Z checkpoint scoped as "next":

• generic per-attempt emitted-output tracking (not Grok-special-cased) across the fallback chain and the OpenRouter-promoted-fallback attempt;
• zero-chunk fallback behavior preserved;
• the previously-vacuous Grok regression corrected to a genuinely reachable fallback config;
• new deterministic coverage for OpenRouter-primary, promoted-fallback, and heuristic-suppression paths.

Exact-head CI/CD/CodeQL and resulting-main were verified green (per this repo's standing governance) before merge. This closes Section 6/10's "once emitted, no second answer" invariant for the streaming fallback chain specifically — nothing more.

What remains open

Per this issue's own still-valid 2026-09-15T22:13:44Z "Remaining terminality requirement": "#714 stays OPEN/P1 until the full production-surface lifecycle inventory and regression matrix in the body are satisfied... Do not infer issue completion from #745/#748/#759/#761 being green individually." The same now applies to #770. None of Sections 1–2 (inventory/vocabulary), 4–5 (Stop Generation contract, supersession semantics), 7 (unmount/navigation classification), 8–9 (error taxonomy, timeout-vs-cancel), 11–17 (local-inference/image/ProForge/plugin/background/UI-concurrency/resource-cleanup lifecycle), or 18 (the deterministic regression matrix) have been addressed. The 18-item acceptance checklist remains almost entirely unchecked.

#771-deferred finding — classified, stays here, not release-critical

PR #771 (ProForge/HITL project-incarnation authority) surfaced and deliberately deferred a genuine finding, out of that PR's #713 scope:

After a project-incarnation change invalidates currentRun, an already in-flight orchestrator stage execution (executeStage/executeStageWithSupervision) is not itself aborted/fenced. If the user starts a new pipeline before the old one settles, the old orchestrator can dispatch an unscoped stageCompleted/stageFailed into the new currentRun.

Classification:

• Owner: this issue, not a new one — squarely Section 5 ("a newer request must not accidentally receive chunks/status from an older request... same-project authority remains separately enforced by ai(project): bind asynchronous image and interview side effects to originating project #708/ai(project): bind Writer, Copilot and deferred AI results to originating project incarnation #713") and Section 13 ("superseding a run"). Not a ai(project): bind Writer, Copilot and deferred AI results to originating project incarnation #713 project-authority defect: fix(proforge): reject stale project-incarnation HITL review edits #771's apply-time submitReview identity/run-id/status checks independently prevent this from ever corrupting the persisted manuscript — the exposure is limited to ProForge's own ephemeral stage-progress bookkeeping for whatever run is live when the straggler arrives.
• Release impact per release(ai): gate v1.28.7 on curated local-model and runtime qualification #743's Finding promotion rule: does not qualify as P0/P1, and doesn't meet any P2-promotion criterion (no data-integrity, privacy, security, crash, or hidden-fallback impact; ProForge is default-off/opt-in, not "active-default usability"; cannot corrupt persisted state). Not a v1.28.7 release blocker — ordinary ai(lifecycle): unify Stop Generation, cancellation, supersession and duplicate-request semantics #714 backlog item, to be addressed as part of Section 13's general ProForge lifecycle classification (cancel-stage / cancel-run / supersession / background-continuation policy) rather than as a standalone patch.

No competing lifecycle-tracking issue will be created for this; #714 remains the canonical owner per the established #713 = project/result authority / #714 = general request lifecycle split.