fix(gateway): keep timeout cleanup in the routed profile

[poijygfdyy]

Invariant

Every timeout/abandon cleanup for a routed gateway turn must execute under the same contextvars.Context / profile scope as the turn it owns. Neither the event-loop-independent inactivity watchdog nor the asyncio fallback reaper may fall back to the process-launch HERMES_HOME while reaping that turn's processes.

Current-main RED

Audited against upstream main at 6005aa1fd9aac8b1024ace50fec8cd1c85a04bae. A final refresh immediately before publication still shows the same main SHA.

gateway/run_turn.py crosses two bare threading.Thread boundaries from a routed turn:

1. _run_agent_start_turn_worker() starts _watch_gateway_turn_inactivity on a fresh daemon thread.
2. _run_agent_await_turn_worker() starts _abandon_timed_out_gateway_turn on a fresh daemon thread when the loop-side inactivity poll reaches the timeout first.

Fresh Python threads start with an empty Context, so both paths can enter timeout cleanup without the caller's profile-scoped HERMES_HOME. The cleanup reaches profile-sensitive process-registry/checkpoint/result/config paths.

The first commit adds focused regressions for both production spawn boundaries. Each binds process HERMES_HOME to a launch home, enters a different served-profile override, drives the real watchdog/reaper spawn site, and requires the child to observe the served home. The bare-thread mechanism observes the launch home instead.

A standalone real-thread mechanism probe reproduces the same boundary deterministically: caller=served, bare child=launch; running the same body through copy_context().run yields child=served.

Fix

Capture the caller's full Context at each existing timeout-cleanup spawn boundary and execute the unchanged body inside it:

threading.Thread(
    target=copy_context().run,
    args=(_watch_gateway_turn_inactivity,),
    ...,
).start()

and likewise for _abandon_timed_out_gateway_turn.

Timeout thresholds, inactivity detection, run-generation ownership gates, process baselines, cleanup locking, hard-interrupt behavior, and reaping semantics are unchanged. This is the same profile-sensitive thread-hop pattern already used elsewhere in the repository.

Collision audit

Refreshed immediately before marking this ready across open/recent/historical PRs, issues, commits, exact function names, root-cause terms, and gateway/run_turn.py.

• Merged Served-profile children and background threads run with their own profile's env/scope; kanban never kills a recycled PID #111617 explicitly recorded these two gateway/run_turn.py watchdog/timeout-reaper thread hops as residual profile-scope leaks after its multiplex audit; it did not modify them.
• Merged fix: background thread hops keep the routed profile scope (salvage #112845 #112599 #112593 #112938) #113063 fixed the sibling /stop//new and API-disconnect reaper spawn sites (gateway/run_agent_cache.py, gateway/platforms/api_server.py) by preserving the caller Context, but not these timeout paths.
• fix(gateway): reap only the background processes an abandoned turn created #76188 owns turn-process baseline/reaping semantics, not profile Context propagation.
• fix(gateway): avoid reusing timed-out agents #107143 owns post-timeout cached-agent retirement; fix(agent): keep /stop responsive while a large-session compression commit is in flight #98366 owns hard-stop admission during compression; fix(gateway): keep silent in-flight tools alive #84514/fix(tools): refresh activity heartbeat while a tool call is in flight (#84491) #84522 own activity/liveness semantics. They are adjacent but independent.
• Exact PR searches for _watch_gateway_turn_inactivity, _abandon_timed_out_gateway_turn copy_context, and gateway/run_turn.py + timeout/profile Context found no competing implementation.
• Exact commit search for _watch_gateway_turn_inactivity copy_context returned no commit; recent _abandon_timed_out_gateway_turn commits concern hard-stop/reaping semantics rather than Context propagation.

Final diff

Two files, two commits, preserving RED regression → production fix:

• gateway/run_turn.py: only the two existing thread targets are wrapped in copy_context().run.
• tests/gateway/test_timeout_reaper_profile_scope.py: deterministic regressions for both timeout-cleanup spawn boundaries.

The final diff was audited after implementation; no unrelated runtime behavior is included.

Validation

• Current-main source audit (6005aa1fd9aac8b1024ace50fec8cd1c85a04bae)
• Deterministic real-thread RED mechanism: bare child loses the caller Context
• Deterministic copied-Context GREEN mechanism: child observes the served Context
• Test-only regression committed before production changes
• Pre-implementation collision search
• Fresh pre-publication PR/issue/commit/function/file collision search
• Final two-file diff audited
• Exact-head upstream workflows created
• Repository pytest / Ruff / full suite executed in this environment
• Hosted CI executed

This contribution environment does not have a repository checkout and outbound GitHub clone/DNS access is unavailable, so repository pytest/Ruff results are not claimed. Exact head 872cb33ce27b105b0ab0f4b828d4ed6b7dd13cdc has upstream CI, Docker Build, Test, and Publish, and Nix flake check runs, but all currently conclude action_required; no jobs executed and no CI pass or failure is claimed.