neuron-tai/.scratch/distributed-gguf-runtime/issues/058-harden-worker-and-stream-failure-semantics.md

DGR-058: Harden worker and stream failure semantics

• Status / triage: specification only; ready-for-agent; passes: false
• Execution mode: AFK
• Milestone: M4
• Dependencies: DGR-040, DGR-042, DGR-056
• Blocks (derived): DGR-059, DGR-060, DGR-061
• Labels: area:reliability, area:failure, type:hardening, priority:p1, ready-for-agent
• Evidence class: fixture
• Hardware: none
• Model: generic
• Upstream: no

Objective / description

Fresh Ralph session: read .scratch/distributed-gguf-runtime/RALPH-CONTEXT.md, source issue .scratch/distributed-gguf-runtime/issues/058-harden-worker-and-stream-failure-semantics.md, and evidence READMEs for dependencies (DGR-040, DGR-042, DGR-056) before changing code. Inspect live source/tests rather than trusting legacy pass states. Objective: Ensure malformed input, process death, transport reset, and cancellation terminate cleanly.

Acceptance criteria

• Test worker death, stream reset, malformed bundle, checksum failure, deadline, cache miss, stale epoch, and partial fragment loss.
• Cancellation propagates across all stages and releases KV/state, queue entries, and fragment buffers.
• Duplicate steps are idempotent; uncertain mutations are never silently replayed.
• Billing/work outcomes distinguish completed, cancelled, failed, and unverified work.
• Applicable shared quality gates in prd.json pass, and the evidence handoff records exact commands/results, changed files, limitations, and dependency handoff.

Shared quality gates

• Targeted deterministic tests pass; Python changes also pass python -m compileall packages tests.
• git diff --check passes.
• Default tests are model-download-free, API-credit-free, and GPU-free.
• Evidence README records exact changed files, commands/results, limitations, and dependency handoff; no fabricated evidence or inherited completion credit.
• Native changes pass focused out-of-tree CMake build and CTest; patch changes verify clean apply/check/reverse against the exact llama.cpp pin.
• Runs are opt-in and record exact artifact/split hashes, runtime/upstream pin, backend/driver, hardware, network, commands, and raw metrics. Model artifacts use configured mounted-drive storage and never /home.
• Preserve existing Transformers behavior and backend-agnostic Tracker routing/load balancing/billing/relay semantics unless an explicit versioned contract says otherwise. One scoped story commit is expected during execution, but this specification-materialization change is not committed.

Evidence handoff

Write and verify .scratch/distributed-gguf-runtime/evidence/DGR-058/README.md. Until every criterion and applicable gate has real evidence, this story remains passes: false. Legacy evidence is provenance only, not completion credit.