[witbrock]

What changed

• Propagate each internal MCP handler's remaining hard deadline into PyMongo's client-side operation timeout (CSOT).
• Reserve a small bounded unwind interval so legacy handlers that catch database exceptions still resolve to the terminal typed timeout.
• Classify PyMongo CSOT expiry and proactive admission refusal as tool_timeout, including caught error mappings, without changing ordinary earlier database errors.
• Preserve the bounded worker-pool fallback, cooperative cancellation, explicit late-result policy, and represented recovery affordances for non-database handlers.
• Document the generic runtime semantics and add regression coverage through gateway, workflow, opportunity-preservation, and durable telemetry surfaces.

Root cause

The existing transport deadline bounded the caller but did not propagate the same budget into nested PyMongo operations. A timed-out Vontology read could therefore continue through independent driver timeouts while retaining one of the bounded handler workers. Some legacy handlers also catch every database exception and return an error mapping, which could make a CSOT expiry appear to be a completed handler result.

User and developer impact

Slow internal MCP database reads now terminate within the generic tool deadline, release their isolation worker, remain a typed and recoverable non-success, and cannot later rewrite the turn. This is transport support code only; it adds no arXiv, paper, entity-retrieval, or other domain-specific policy.

Validation

• Focused cross-layer suite: 31 passed.
• Broader related suite: 135 passed; one pre-existing unrelated telemetry fixture failure for max_prompt_char_count remains unchanged.
• Ruff and git diff --check: passed.
• Final real-path slow read: request live-kb-prompt-b4f058a0-1e05-459f-adf5-65d2b148ec5f, execution mcp_ab1f822c66184bbc85d3717311e245c8; typed tool_timeout in 19.929 s, terminal turn completion, recovery affordances retained, and no late-result record.
• Neighbouring real-path success: request live-kb-prompt-a20bf740-8d6e-43f0-95c7-55c430077ac0; get_predicate_incidence completed successfully in 1.182 s.

[Copilot]

Pull request overview

This PR enforces that internal MCP transport hard deadlines also bound nested MongoDB work by propagating the remaining deadline into PyMongo’s client-side operation timeout (CSOT), ensuring timed-out database handlers release their bounded worker promptly and cannot later rewrite a terminal turn outcome.

Changes:

• Wrap internal MCP handlers in a PyMongo CSOT context using the remaining transport budget, reserving a small unwind interval to avoid swallowed database timeouts presenting as “completed” payloads.
• Classify Mongo CSOT expiry/admission refusal as terminal tool_timeout outcomes and ensure these do not produce late-result records.
• Add regression tests and document the runtime semantics in the VWL manual; adjust an orchestrator timing assertion to key off transport span duration.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
tests/backend/test_orchestrator_tool_call_validation.py	Updates timeout timing assertion to use transport duration to avoid first-run module-init noise.
tests/backend/test_internal_mcp_transport_deadlines.py	Adds regression coverage for CSOT deadline propagation, classification, and worker release semantics.
src/backend/integrations/internal_mcp/transport.py	Implements CSOT propagation/reserve logic and deadline-based timeout reclassification.
docs/engineering/von_workflow_language_manual.md	Documents the new CSOT propagation and unwind-reserve semantics in workflow runtime behavior.