Repair Timeout Budget Drift

Our checkout API has an 8-second caller deadline. The browser aborts at 8s, the gateway waits 15s, the Node service gives the inventory service 12s per attempt and retries twice, PostgreSQL has no statement timeout, and an email side effect can continue after the HTTP request has already been cancelled. We are seeing requests return 504 while server work continues and later logs show a second retry finishing after the client is gone. Repair the timeout-budget contract in the repository. Propagate cancellation, keep retries inside the supplied 8-second budget, add deterministic tests and observability hooks, and do not deploy or change production infrastructure.

Timeout-budget drift found. The 8-second caller budget is exceeded by downstream attempt limits, retries, uncancelled database work, and detached email work. The repair introduces one absolute deadline, remaining-budget propagation, retry gating, cancellation-aware database handling, durable side-effect handoff, deterministic tests, and timeout reason metrics. Production gateway and provider behavior remain unverified.