[cursor]

Summary

Startup checked its state timeout only when a pass returned to the top of the control loop. Fuel and oxidizer admission wait inside the pass after the valve is already open. A command or sensor read that never completed left that valve at the last commanded position: the deadline was not consulted again, and the loop task never reached the next check.

A pass now arms the remaining state budget. When the deadline expires first, the sequence fail-closes and commands every valve shut without waiting for the in-flight call. The closed-state loop keeps retrying that shutdown. Stopping the loop still propagates cancellation. A sensor or actuator timeout raised on its own token is unchanged: a startup sensor-read timeout still leaves the pass, and an actuator-command timeout still fail-closes inside the command helper.

Related issues

None.

Type of change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation only
• Refactor / chore (no behavior change)

How to test

1. dotnet test Tests/HelloblueGK.Tests.csproj -c Release --filter FullyQualifiedName~StartupSequenceControllerTests
2. Confirm FuelFlow_InFlightCommandPastTheDeadline_FailClosesWithoutWaiting returns in well under the one-second flow wait, latches Error, and closes the fuel valve.
3. Confirm FuelFlow_InFlightCommandPastTheDeadline_LeavesTheControlLoopRunning keeps IsRunning true and continues shutdown retries after the fuel deadline.

Checklist

• I read CONTRIBUTING.md and followed the development workflow
• dotnet build succeeds locally (or I ran the equivalent CI steps)
• dotnet test Tests/HelloblueGK.Tests.csproj passes (or tests are not applicable)
• I added or updated tests for behavior changes
• I updated documentation when behavior, APIs, or setup changed
• My commit messages are clear and descriptive
• I did not commit secrets, credentials, or .env files
• First PR / docs-only work stays out of Certification/ unless the issue asked for it

Screenshots / logs (optional)

Release startup-sequence tests passed, including the two new deadline cases. Full Release suite: 1574 passed, and LargeDataSet_ShouldHandleEfficiently failed once at 21s while a package audit ran in parallel, then passed alone in about 1s. dotnet list package --vulnerable --include-transitive reported no vulnerable packages for HelloblueGK, HelloblueGK.WebAPI, and HelloblueGK.Tests.

  

---

Note

High Risk
Changes real-time engine startup valve timing and fail-closed behavior; incorrect deadline/cancellation handling could close propellants early or leave them open.

Overview
Fixes a safety gap where startup state timeouts were only evaluated between control-loop passes, so a hung fuel/oxidizer valve command or sensor read could leave propellants open indefinitely.

Each pass now bounds in-flight state work to the remaining per-state deadline (Task.WhenAny + CancelAfter on a linked token). When the budget expires first, the sequence fail-closes immediately—commands valves shut and latches Error—without awaiting I/O that ignores cancellation. Hung work is torn down via ReleaseStatePass so the loop keeps running shutdown retries. State dispatch moves into ExecuteCurrentStateAsync; tests gain SetStateEnteredAt and two cases for never-returning fuel open commands.

^{Reviewed by Cursor Bugbot for commit 8fb5e4e. Bugbot is set up for automated code reviews on this repo. Configure here.}