Timeout errors have appropriate messaging

Vercel Hobby-tier functions time out at 10 seconds and Pro at 60 or 300 seconds — AI generation, file processing, and report exports regularly approach these limits. When they hit, users see a generic error or a permanent spinner with no indication of whether the operation is still running, failed, or timed out. CWE-755 (Improper Handling of Exceptional Conditions) applies: failing to distinguish a timeout from other errors means users can't make an informed decision about whether to wait or retry. ISO 25010 reliability.fault-tolerance requires that timeout conditions be surfaced to users with a recovery path, not collapsed into opaque generic errors.

Use AbortController with a timeout signal for all long-running fetch requests, and catch AbortError separately from other failures.

const controller = new AbortController()
const timeoutId = setTimeout(() => controller.abort(), 30000)

try {
  const response = await fetch('/api/generate', { signal: controller.signal })
} catch (error) {
  if (error instanceof DOMException && error.name === 'AbortError') {
    setError('This request timed out. Please try again — complex requests may take longer.')
  } else {
    setError('Something went wrong. Please try again.')
  }
} finally {
  clearTimeout(timeoutId)
}

For operations that routinely exceed 10 seconds on Vercel Hobby, move them to background jobs (Inngest or Trigger.dev) and poll for completion status rather than blocking on a single long-lived request.