[chuiwenwei]

Summary

Boundary detection is the only memorize stage that runs before the
memcell/session-buffer write, so a provider failure there leaves nothing
behind. Wrap it in BoundaryLLMError and give the queue a separate
boundary_max_attempts budget (default 3); every other failure keeps the
caller's max_attempts, which stays 1 because a re-run is not replay-safe.

The sync path needs no handler change: BoundaryLLMError is an
LLMServiceError, so it already returns 503.

Refs #516 — this is the issue's "possible first step"; per-memcell resume
remains open.

Verification

make lint passed
58 targeted tests passed

[gloryfromca]

Blocking: the application-level boundary timeout must use the safe boundary retry budget.

I reviewed the repository rules, full diff, boundary and queue callers, relevant history, backward compatibility/config defaults, test changes for weakening, and architecture constraints. The typed provider-error path is safe, but the ordinary configured timeout path remains outside it.

Verification: all underlying make lint checks passed (Ruff, format, 14 import contracts, repository policy checks, datetime/singleton checks, OpenAPI drift); make itself is unavailable in this environment. Targeted tests: 58 passed. Full unit suite: 3,468 passed, 4 skipped.

[chuiwenwei]

Addressed: the application-level per-attempt timeout is now caught and raised as BoundaryLLMError too, so the queue's boundary retry budget covers it. Added a test that makes adetect_boundaries exceed attempt_timeout and asserts BoundaryLLMError. 60 targeted tests pass;
rebased onto current main.

[gloryfromca]

No blockers; this can merge as far as I am concerned.

The prior timeout blocker is fixed and its thread is resolved. I reviewed the current origin/main...HEAD diff, the delta from the prior revision, repository rules, boundary/queue callers, relevant history, backward compatibility and configuration defaults, test changes for weakening, and the architecture constraints. The rebase onto the atomic session-cut implementation does not change the retry-safety conclusion: both provider errors and the configured application timeout are typed before the first write.

Verification: 60 targeted tests passed. All direct lint gates passed, including Ruff and formatting, all 14 import-architecture contracts, repository policy checks, datetime/singleton checks, and OpenAPI drift.