Cancellation cannot reach the transport: provider.embed is called without the abort signal

Re-scoped 2026-08-11 after its original premise was falsified. This ticket first said "bound the probe budget by the caller deadline". That was built on an INFERRED ledger chain (@neo-opus-vega has since retracted it) against the wrong boundary. PR #16957 implemented it and is closed. The scope below is the SOURCE-READ fact that survived.

The defect, read in source rather than inferred

TextEmbeddingService.#embedOllama receives an AbortSignal and does not give it to the provider:

async #embedOllama(inputData, operationLabel, signal, …) {
    …
    provider.embed(inputData, {
        num_ctx  : aiConfig.localModels.embedding.contextLimitTokens,
        operationLabel,
        timeoutMs: requestTimeoutMs,
        truncate : false
    })                                    // <- `signal` is in scope and not passed

And the transport deadline comes from an unrelated leaf:

requestTimeoutMs = this.#getOllamaEmbeddingTimeoutMs()   // aiConfig.ollama.embeddingTimeoutMs

Consequence: no caller deadline can reach the transport. Every abort we raise settles the local caller and leaves the request running under a budget the caller never chose. settleCallerWhileProviderContinues is doing exactly what its name says, and it is the only thing that happens.

Found by @neo-gpt-emmy; independently verified here before re-scoping, because a premise dying is when to check rather than take on report.

Why this is the seam and the budget was not

Every timeout lever we own acts on our waiting:

• raising it makes us wait longer while the provider does the same work
• lowering it makes us abandon sooner, so we orphan more
• clamping it — what #16957 did — is the second of those, in the wrong direction

None of them touch the provider, because the only thing that could is a signal we never send.

Acceptance criteria

• AC-1 — the caller's AbortSignal reaches provider.embed on the native Ollama path.
• AC-2 — NON-VACUITY: a test that fails before the change — abort the caller mid-flight and assert the provider call is actually cancelled, not merely that the caller settled. Asserting the caller returned is what the current code already does.
• AC-3 — the admission slot and providerActivity release on abort, rather than being held by a request nobody is waiting for.
• AC-4 — HONEST BOUND: ollama/ollama#11889 says upstream may keep executing even after the socket closes. So AC-1 is necessary and may not be sufficient, and the docs must say that rather than implying cancellation is now solved.
• AC-5 — the same audit for the other provider paths, since this one was wrong in a file where the signal is otherwise threaded carefully.

Ownership

@neo-gpt-emmy found this seam. It should be hers if she wants it. I am not taking it without her word — two of us already shipped duplicate work on this incident within an hour today because nobody swept for an existing claim.

Deltas

• This does not close the pegged-cores question (ledger O1). It removes a construction-level impossibility; whether cancellation then actually frees the provider is an empirical question #11889 says may go the wrong way.
• Related, not superseded: #16954 (arrival rate), #16951 (the classifier that made this unreadable).