One timeout across a failover

A task can name fallback harnesses, and it has a timeout. When the harness running an execution runs out of quota, or is unavailable, the execution moves to the next harness the task names. The timeout does not start again: the whole execution has one, whichever harnesses it runs on.

One timeout, from the start

An execution's timeout is counted from when the execution began. A switch to a fallback harness does not start a new one, so the next harness has only the time the timeout has left. Set the timeout for the whole execution, not for each harness: it is timeoutMinutes in the task file's execution section, 60 minutes by default.

When the timeout passes

When the timeout passes, HarmFlow asks the harness running at that moment to stop, whichever harness it is. It does not wait for a timeout of that harness's own.

How late the execution can end

A harness that does not stop when asked is ended once the grace period after the timeout is over. That is cancelGraceSeconds in the same section, 30 seconds by default, and How an attempt is stopped tells how the harness's processes are ended. So the execution ends no later than the grace period after the timeout, even when the harness ignores the request to stop.

The execution then ends as failed, and its result says that the execution timeout elapsed.