fix(workspace, transport): invokes can no longer freeze a pane silently — deadlines + receipt logging land

The search frontend froze "with no recourse" (gh #58 recurrence): a lost
invoke had NO client-side timeout anywhere, so the pane spun forever.
Two of the issue's four named probes ship:

- transport.ts: default per-invoke deadline — 120s for normal
  capabilities, 660s (dispatch ceiling + headroom) for crawl/scan/pack
  shapes. On expiry the pending entry clears, any queued copy is dropped,
  and the caller gets a retryable error naming the capability. The
  eternal spinner is structurally impossible now.
- ws.ts: invoke_received / invoke_result_sent / invoke_result_stashed
  logs (capability + invoke id) — "the frame never reached the server"
  becomes one grep instead of an inference.

Post-instrumentation reproduction: the full 🔍 path works (search.fire
received → dispatched → 10 searxng results rendered, full connector
palette) after the workspace rebuild + fresh page — confirming the
freeze is intermittent, tied to long-degraded sessions. When it recurs,
the logs decide client-vs-server in seconds and the UI errors instead of
freezing.

Also observed in the operator's logs and reported: the Anthropic API
account is OUT OF CREDITS (all crawls failing 400) and didi_session had
expired (didi_id null on every connect; id-didi-sh itself is healthy).

Refs #58.

Files changed:
- packages/workspace/src/transport.ts
- services/workspace/src/ws.ts

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RW28dw3kQAKXr2ZNefCukE

Author: mpstaton

packages/workspace/src/transport.ts

@@ -185,11 +185,35 @@ export function createTransport(config: TransportConfig): Transport {
     }, backoff);
   }
 
+  // Default client deadline (gh #58 probe 4): a lost invoke previously hung
+  // its pane FOREVER — no timeout anywhere client-side. Crawl/scan-shaped
+  // capabilities get the server dispatch ceiling (600s) plus headroom;
+  // everything else fails loud at 120s with the capability named, so the
+  // operator sees an error and can retry instead of a frozen spinner.
+  const DEADLINE_DEFAULT_MS = 120_000;
+  const DEADLINE_LONG_MS = 660_000;
+  const deadlineFor = (capability: string): number =>
+    /crawl|scan|pack\./.test(capability) ? DEADLINE_LONG_MS : DEADLINE_DEFAULT_MS;
+
   async function invoke(capability: string, args: unknown, via?: string): Promise<unknown> {
     const id = genId();
     const frame: InvokeFrame = { kind: 'invoke', id, capability, args, ...(via ? { via } : {}) };
     const promise = new Promise<unknown>((resolve, reject) => {
-      pending.set(id, { resolve, reject });
+      const ms = deadlineFor(capability);
+      const timer = setTimeout(() => {
+        if (!pending.has(id)) return;
+        pending.delete(id);
+        // Drop any still-queued copy so a later flush doesn't resend a
+        // frame whose caller already gave up.
+        const qi = sendQueue.findIndex((fr) => fr.kind === 'invoke' && fr.id === id);
+        if (qi >= 0) sendQueue.splice(qi, 1);
+        console.warn(`[workspace] invoke deadline (${ms}ms): ${capability} (${id})`);
+        reject(new Error(`${capability} timed out after ${Math.round(ms / 1000)}s — the workspace did not reply; retry the action`));
+      }, ms);
+      pending.set(id, {
+        resolve: (v) => { clearTimeout(timer); resolve(v); },
+        reject: (e) => { clearTimeout(timer); reject(e); },
+      });
     });
     if (ws && ws.readyState === WebSocket.OPEN) {
       ws.send(JSON.stringify(frame));

services/workspace/src/ws.ts

@@ -201,6 +201,9 @@ export async function registerWebsocket(app: FastifyInstance): Promise<void> {
       // hanging the caller forever.
       if (f.kind === 'invoke' && f.id && f.capability) {
         const invokeId = f.id;
+        // Receipt log (gh #58 probe 2): "the frame never reached ws.ts" is
+        // now fact, not inference — grep for invoke_received.
+        app.log.info({ capability: f.capability, invoke_id: invokeId }, 'invoke_received');
         // Actor attribution envelope (build-order step 4) — the verified
         // didi.sh identity rides beside the args into dispatch(), never
         // client-asserted. See [[Workspaces-as-Tenant-Primitive]] §
@@ -223,11 +226,14 @@ export async function registerWebsocket(app: FastifyInstance): Promise<void> {
         if (socket.readyState === 1 /* OPEN */) {
           try {
             socket.send(resultFrame);
+            app.log.info({ capability: f.capability, invoke_id: invokeId }, 'invoke_result_sent');
           } catch {
             stashResult(invokeId, resultFrame);
+            app.log.warn({ capability: f.capability, invoke_id: invokeId }, 'invoke_result_stashed (send threw)');
           }
         } else {
           stashResult(invokeId, resultFrame);
+          app.log.warn({ capability: f.capability, invoke_id: invokeId, readyState: socket.readyState }, 'invoke_result_stashed (socket not open)');
         }
         return;
       }