REL-NB-008 — Guarantee terminal state for every cell execution
| Field | Value |
|---|---|
| Status | Open; source-verified, failure injection pending |
| Architecture state | Source-backed current behavior |
| Severity | High |
| Affected surface | Queue, kernel preparation, Spark initialization, execution, and cancellation |
| Components | sparqd/oqullus; sparqd/bff-api supplies lifecycle outcomes |
| Associated issue | oqullus #517, after #516 |
Where the problem appears
Lose a terminal Jupyter message, close the channel after partial output, fail a send, prevent Spark readiness, or fail user-server startup with queued cells.
Concrete observed case
Execution completes only after both reply and idle arrive. Several failure branches remove transient bookkeeping without updating the durable cell status. Initialization and queued startup also have no overall terminal deadline.
Expected condition
Every operation reaches completed, failed, cancelled, or
execution-lost within a documented bound. Partial output remains labelled,
and queued or initializing work is cancellable.
Cause and evidence
Cell metadata, pending-request maps, and running-cell sets have separate cleanup paths. Channel close, send failure, malformed frames, readiness retry, and startup failure do not converge on one terminal transition.
Why it matters
An indefinite spinner prevents trustworthy recovery and leaves users unable to tell whether code ran, partially ran, or can be safely retried.
Existing controls and workarounds
Explicit user cancellation has a five-second fallback. No equivalent bound was found for the other execution phases.
Alternatives considered
- Recommended: one authoritative execution operation with phase deadlines and a terminal transition for every branch.
- Clear the spinner on transport close — insufficient because it loses cause and partial-output semantics.
- Automatically rerun — rejected for non-idempotent cells.
Component involvement
sparqd/oqullusowns operation state, deadlines, partial-output labels, and cancellation.sparqd/bff-apimust expose transport and lifecycle failure truthfully.
Reproduction and verification
Follow NB-S020.
Resolution conditions
Close when deterministic tests cover every queue, initialization, send, message, disconnect, timeout, and cancellation branch with one terminal state.
Validation and blockers
Controlled protocol and lifecycle fault injection is required.