fix(inference): rely on AbortSignal alone for task timeout, drop pool rebuild

Address review feedback: on task timeout, destroying and recreating the
whole Piscina pool rejects all other in-flight detection tasks sharing
the pool (up to maxThreads concurrently), not just the timed-out one.
Piscina already terminates the specific worker thread when the task's
AbortSignal fires, so relying on that signal alone contains the runaway
task without collateral impact to sibling requests.

Reviewed-at: elastic#288758 (comment)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: jonwalstedt

x-pack/platform/plugins/shared/inference/server/workflow_anonymization/detection/execute_regex_rules.ts

@@ -18,7 +18,7 @@ function compileRule(rawPattern: string): CompiledRule {
   } catch {
     // RE2 does not support lookahead, lookbehind, or backreferences. Fall back to
     // native RegExp. ReDoS protection is provided by the Piscina worker timeout and
-    // pool-rebuild on abort.
+    // per-task abort via AbortSignal.
     return { engine: 'native', pattern: new RegExp(rawPattern, 'g') };
   }
 }
@@ -80,7 +80,7 @@ function findSpans(
  *
  * RE2JS is tried first for each pattern. Patterns that contain constructs RE2 does
  * not support (lookahead, lookbehind, backreferences) fall back to native RegExp.
- * The Piscina worker timeout and pool-rebuild on abort provide ReDoS protection for
+ * The Piscina worker timeout and per-task AbortSignal provide ReDoS protection for
  * native RegExp patterns.
  *
  * Zero-length matches advance one character and continue scanning; they do not

x-pack/platform/plugins/shared/inference/server/workflow_anonymization/detection/regex_worker_service.test.ts

@@ -78,12 +78,11 @@ describe('PiiRegexWorkerService', () => {
     ).rejects.toThrow();
   });
 
-  it('aborts the task and recreates the pool when taskTimeout elapses', async () => {
+  it('aborts the timed-out task and throws when taskTimeout elapses', async () => {
     service = new PiiRegexWorkerService(
       createTestConfig({ taskTimeout: { asMilliseconds: () => 1 } } as any),
       logger
     );
-    const workerBefore = (service as any).worker;
 
     // (?=a)(a+)+$ falls back to native RegExp (RE2 rejects the lookahead) and
     // backtracks catastrophically on a long all-'a' string — guaranteed timeout.
@@ -93,9 +92,6 @@ describe('PiiRegexWorkerService', () => {
         records: [{ content: 'a'.repeat(10_000) + 'b' }],
       })
     ).rejects.toThrow('timed out');
-
-    // Pool is rebuilt after abort — the new instance is a different object
-    expect((service as any).worker).not.toBe(workerBefore);
   });
 
   it('returns [] and logs when failureMode is allow_unsafe', async () => {

x-pack/platform/plugins/shared/inference/server/workflow_anonymization/detection/regex_worker_service.ts

@@ -87,8 +87,6 @@ export class PiiRegexWorkerService {
         return await this.worker.run(payload, { signal: controller.signal });
       } catch (err) {
         if (err instanceof Error && err.name === 'AbortError') {
-          await this.worker.destroy().catch(() => {});
-          this.worker = this.createWorkerPool();
           throw new Error(
             `PII regex detection task timed out after ${this.config.taskTimeout.asMilliseconds()}ms`
           );