@adonis-agora/durable 1.0.0-rc.0 → 1.0.0-rc.10

package/dist/src/engine.js

@@ -72,6 +72,13 @@ const isBreakpoint = (cp) => cp.status === 'pending' && cp.name.startsWith(BREAK
  * through some other path (an operator's cancel, a timeout sweep, a dead-letter) while this turn's
  * outcome was being computed from a possibly-stale snapshot.
  */
+/** Statuses a wake refused by a held lease may stamp a request for another turn on. */
+const WAKEABLE_RUN_STATUSES = ['running', 'suspended', 'blocked', 'cancelling'];
+/**
+ * Statuses a wake that finds the lease free re-drives: parked runs, and a `cancelling` run whose
+ * undo is not executing (its turn unwinds the saga).
+ */
+const PARKED_RUN_STATUSES = ['suspended', 'blocked', 'cancelling'];
 const SETTLE_ELIGIBLE_STATUSES = [
     'pending',
     'running',
@@ -139,6 +146,12 @@ const STEP_EVENTS_PER_BROADCAST = 500;
 const isStepEvent = (event) => event.type.startsWith('step.');
 /** The default {@link WorkflowEngineDeps.timerBatchSize}. */
 const DEFAULT_TIMER_BATCH = 500;
+/** The default {@link WorkflowEngineDeps.waitForRunPollMs}. */
+const DEFAULT_WAIT_FOR_RUN_POLL_MS = 250;
+/** A `waitForRun` read interval: a finite value `>= 0` (`0` = no reads), else `undefined`. */
+function validPollMs(ms) {
+    return ms !== undefined && Number.isFinite(ms) && ms >= 0 ? ms : undefined;
+}
 /** {@link WorkflowEngine.sweepBufferedSignals}: rows read per page. */
 const BUFFERED_SWEEP_PAGE = 500;
 /** {@link WorkflowEngine.sweepBufferedSignals}: pages per call, so one tick stays short. */
@@ -241,7 +254,13 @@ function isNewerVersion(a, b) {
     return a.localeCompare(b, undefined, { numeric: true }) > 0;
 }
 /** The statuses a run can be skipped in for an unregistered workflow — every non-terminal one. */
-const UNREGISTERED_DEAD_LETTER_FROM = ['pending', 'running', 'suspended', 'blocked'];
+const UNREGISTERED_DEAD_LETTER_FROM = [
+    'pending',
+    'running',
+    'suspended',
+    'blocked',
+    'cancelling',
+];
 /** Thrown by {@link WorkflowEngine.resume} when the run belongs to a different namespace. */
 export class NamespaceMismatch extends Error {
     constructor() {
@@ -313,6 +332,7 @@ export class WorkflowEngine {
     remoteRedispatchMs;
     remoteRedispatchMax;
     remoteAdvanceSilenceMs;
+    waitForRunPollMs;
     webhookUrl;
     traceparent;
     context;
@@ -589,6 +609,7 @@ export class WorkflowEngine {
         this.remoteRedispatchMax = Math.max(1, deps.remoteRedispatchMax ?? 10);
         // Opt-in: unset (or 0) keeps the unbounded wait for a remote workflow turn's decision.
         this.remoteAdvanceSilenceMs = deps.remoteAdvanceSilenceMs || undefined;
+        this.waitForRunPollMs = validPollMs(deps.waitForRunPollMs) ?? DEFAULT_WAIT_FOR_RUN_POLL_MS;
         this.webhookUrl = deps.webhookUrl;
         this.traceparent = deps.traceparent;
         this.context = deps.context;
@@ -3217,7 +3238,7 @@ export class WorkflowEngine {
             return [];
         this.#lastStalledSweepAt = now;
         const candidates = await this.store.listRuns({
-            statuses: ['suspended', 'running'],
+            statuses: ['suspended', 'running', 'cancelling'],
             namespace: this.namespace,
             updatedBefore: now - this.stalledAfterMs,
             size: 100,
@@ -3461,11 +3482,10 @@ export class WorkflowEngine {
     /**
      * Sweep a deleted run's token-keyed buffered signals — they are not run-scoped rows, so the store's
      * deleteRun can't cascade them. Without this every fire-and-forget child that was never joined leaks
-     * its buffered `child:<id>` completion FOREVER (one row per spawn), and a raced compensate-cancel
-     * can leave a `cancel:<id>` marker behind.
+     * its buffered `child:<id>` completion FOREVER (one row per spawn).
      */
     async sweepRunBufferedSignals(runId) {
-        for (const token of [`child:${runId}`, `cancel:${runId}`]) {
+        for (const token of [`child:${runId}`]) {
             for (;;) {
                 const buffered = await this.store.takeBufferedSignal(token).catch(() => null);
                 if (!buffered)
@@ -4061,6 +4081,27 @@ export class WorkflowEngine {
             // finished run) and re-enqueues it for a second execution. Only a run that still reads
             // `running` under the lease is an orphan; release the lease taken just to look at anything else.
             const run = await this.store.getRun(listed.id);
+            // A compensating cancel whose undo died with its pod (or never started: the pod that took the
+            // cancel crashed before its resume ran). Re-drive it rather than re-pend it, which would drop
+            // the cancel: any turn of a `cancelling` run unwinds the saga and settles it `cancelled`.
+            if (run?.status === 'cancelling') {
+                // Only a pod that has the workflow can run its compensations; past the grace, one that is
+                // registered nowhere is dead-lettered like any orphan.
+                if (!this.isRegisteredHere(run) && !(await this.canResolveWorkflow(run))) {
+                    const settled = await this.settleUnregistered(run, nowMs);
+                    if (settled)
+                        results.push(settled);
+                    else if (settled === undefined)
+                        this.logUnregisteredSkip(run);
+                    continue;
+                }
+                await this.store.releaseRunLock(listed.id, this.instanceId);
+                this.trackEffect(Promise.resolve(this.wake(run.id)).catch((error) => {
+                    console.error(`[adonis-durable] could not re-drive cancelling run ${run.id}; retrying on a later tick:`, error);
+                }));
+                results.push({ runId: run.id, status: 'cancelling' });
+                continue;
+            }
             if (run?.status !== 'running') {
                 await this.store.releaseRunLock(listed.id, this.instanceId);
                 continue;
@@ -4543,6 +4584,10 @@ export class WorkflowEngine {
         const run = await this.store.getRun(runId);
         if (!run)
             return null;
+        // A run undoing its saga for a compensating cancel is not retried over: re-pending it would drop
+        // the cancel. It ends `cancelled`, and can be requeued from there.
+        if (run.status === 'cancelling')
+            return { runId, status: 'cancelling' };
         // A FAILED/DEAD run's replay deterministically re-throws its recorded failures — an exhausted
         // failed checkpoint rethrows, and an awaited child's failure completion rethrows through
         // unwrapCompletion — so "retry" without resetting that state is a no-op that re-fails in
@@ -4798,15 +4843,25 @@ export class WorkflowEngine {
      * the wait continues until the run reaches an end state. This is what `BaseWorkflow.start` needs so
      * "I want the result" blocks through a suspension instead of returning early with no output. The
      * default (`terminal` unset/false) resolves on any settled state, suspended included.
+     *
+     * A `blocked` run (no live worker can take its next dispatch) is NOT settled in either mode: the
+     * engine re-drives it as soon as a capable worker appears, so the wait continues. Bound it with
+     * `timeoutMs`.
+     *
+     * The wait wakes on this run's lifecycle events, and also re-reads the run every `pollMs` (default
+     * the engine's `waitForRunPollMs`, 250 ms), so it sees a run that settles on another instance even
+     * without a control plane. `pollMs: 0` turns the re-read off.
      */
     waitForRun(runId, opts) {
         const isTerminal = (s) => s === 'completed' || s === 'failed' || s === 'cancelled' || s === 'dead';
         // A run `suspended` while it awaits a dispatched remote workflow turn's decision
         // (`awaitingDecisionTaskId` set) is mid-turn, not settled: that suspend is the engine's re-drive
-        // marker, not a sleep/signal the body asked for. Keep waiting until the decision lands.
-        const isSettled = (run) => run.status !== 'pending' &&
-            run.status !== 'running' &&
-            !(run.status === 'suspended' && run.awaitingDecisionTaskId !== undefined);
+        // marker, not a sleep/signal the body asked for. Keep waiting until the decision lands. A `blocked`
+        // run is parked on the fleet, not on anything the body asked for, and is re-driven on its own.
+        // A `cancelling` run is still undoing its saga: it settles once it is `cancelled`.
+        const isSettled = (run) => run.status !== 'cancelling' &&
+            (isTerminal(run.status) ||
+                (run.status === 'suspended' && run.awaitingDecisionTaskId === undefined));
         const shouldResolve = (run) => opts?.terminal ? isTerminal(run.status) : isSettled(run);
         const toResult = (run) => ({
             runId,
@@ -4814,37 +4869,56 @@ export class WorkflowEngine {
             output: run.output,
             error: run.error,
         });
+        const pollMs = validPollMs(opts?.pollMs) ?? this.waitForRunPollMs;
         return new Promise((resolve, reject) => {
             let done = false;
             let off = () => { };
-            const timer = opts?.timeoutMs != null
-                ? setTimeout(() => {
+            let poller;
+            let reading = false;
+            let timer;
+            const stop = () => {
+                done = true;
+                if (timer)
+                    clearTimeout(timer);
+                if (poller)
+                    clearInterval(poller);
+                off();
+            };
+            if (opts?.timeoutMs != null) {
+                timer = setTimeout(() => {
                     if (done)
                         return;
-                    done = true;
-                    off();
+                    stop();
                     reject(new Error(`waitForRun(${runId}) timed out after ${opts.timeoutMs}ms`));
-                }, opts.timeoutMs)
-                : undefined;
+                }, opts.timeoutMs);
+            }
             const finish = (run) => {
                 if (done)
                     return;
-                done = true;
-                if (timer)
-                    clearTimeout(timer);
-                off();
+                stop();
                 resolve(toResult(run));
             };
+            // Swallow a transient store error: the next event or poll re-checks, and the timeout still
+            // bounds the wait. Unhandled, one hiccup here was a process-fatal unhandled rejection.
+            const read = () => this.store
+                .getRun(runId)
+                .then((run) => {
+                if (run && shouldResolve(run))
+                    finish(run);
+            })
+                .catch(() => undefined);
             const check = () => {
-                // Swallow a transient store error: the next settling event re-checks, and the timeout still
-                // bounds the wait. Unhandled, one hiccup here was a process-fatal unhandled rejection.
-                void this.store
-                    .getRun(runId)
-                    .then((run) => {
-                    if (run && shouldResolve(run))
-                        finish(run);
-                })
-                    .catch(() => undefined);
+                if (!done)
+                    void read();
+            };
+            // The poll skips a tick while its previous read is still out, so a slow store never stacks reads.
+            const poll = () => {
+                if (done || reading)
+                    return;
+                reading = true;
+                void read().finally(() => {
+                    reading = false;
+                });
             };
             // React only to this run's settling events (not its every step event), and subscribe BEFORE the
             // initial read so a run that settles in between isn't missed.
@@ -4854,6 +4928,12 @@ export class WorkflowEngine {
                     check();
                 }
             });
+            // Events only reach this instance for runs it executes (or over a control plane, best-effort):
+            // the poll is what sees a run that settles on another pod.
+            if (pollMs > 0) {
+                poller = setInterval(poll, pollMs);
+                poller.unref?.();
+            }
             check();
         });
     }
@@ -5270,6 +5350,9 @@ export class WorkflowEngine {
      * cancelled. Without it, cancellation is immediate (no undo).
      */
     async cancel(runId, opts) {
+        return this.cancelOnce(runId, opts, true);
+    }
+    async cancelOnce(runId, opts, mayRetry) {
         const run = await this.store.getRun(runId);
         if (!run)
             return null;
@@ -5282,18 +5365,35 @@ export class WorkflowEngine {
         if (TERMINAL_RUN_STATUSES.includes(run.status)) {
             return { runId, status: run.status, output: run.output, error: run.error };
         }
+        // A compensating cancel is already undoing the saga: a repeat cancel, with or without
+        // `compensate`, echoes it. Taking the instant path below would mark it `cancelled` and skip the
+        // undo still in flight. Recovery re-drives a `cancelling` run whose undo died.
+        if (run.status === 'cancelling')
+            return { runId, status: 'cancelling' };
         // Compensating cancel: resume the run with a cancellation pending — replay re-registers the saga,
         // and at the suspension point execute() runs the undo and marks it cancelled. Run that resume in
         // the BACKGROUND so the caller (e.g. an HTTP request) never blocks on replaying the workflow +
         // compensations. `execute` holds the run's lease, so this can't double-run one a live worker owns
         // (its lease acquire fails and it no-ops); the broadcast tells that worker to abort cooperatively.
         if (opts?.compensate && (run.status === 'suspended' || run.status === 'running')) {
+            // DURABLE cancel intent: the persisted `cancelling` status. It survives a crash or a pod
+            // handoff (any turn of a `cancelling` run unwinds it, a turn already executing on another pod
+            // finds it when its settle loses the status race, and crash recovery re-drives one whose undo
+            // died), and shows the dashboard/API that an undo is in progress. Conditional: a run that
+            // moved meanwhile (settled, parked) is re-read and cancelled for what it is now.
+            const marked = await this.store.updateRunIf(runId, ['suspended', 'running'], {
+                status: 'cancelling',
+                updatedAt: new Date(),
+            });
+            if (!marked) {
+                if (mayRetry)
+                    return this.cancelOnce(runId, opts, false);
+                const current = await this.store.getRun(runId);
+                return current
+                    ? { runId, status: current.status, output: current.output, error: current.error }
+                    : null;
+            }
             this.cancelRequested.add(runId);
-            // DURABLE cancel intent: the in-memory flag above only survives on this pod, this boot. The
-            // buffered `cancel:<id>` marker is what lets the compensating unwind survive a crash or be
-            // picked up by ANOTHER pod (its resume replays into the WorkflowSuspended catch, which checks
-            // the marker when the flag is absent). Consumed there once `cancelled` is durably recorded.
-            await this.store.bufferSignal(`cancel:${runId}`, true).catch(() => undefined);
             if (this.controlPlane) {
                 void this.controlPlane
                     .publishControl({ kind: 'cancel', runId, from: this.instanceId }, runTarget(run.namespace))
@@ -5311,7 +5411,7 @@ export class WorkflowEngine {
             // needed covering. The one-microtask defer is preserved; the promise is registered synchronously.
             this.trackEffect(Promise.resolve().then(() => this.resumeImplicit(runId).then(() => this.notifyCancelled(runId))));
             await this.cancelChildren(runId, opts);
-            return { runId, status: run.status };
+            return { runId, status: 'cancelling' };
         }
         const error = { message: 'cancelled' };
         // Clears a remote turn's decision marker too: a cancelled run awaits no decision.
@@ -5648,7 +5748,7 @@ export class WorkflowEngine {
                 publishedAt: this.clock(),
             })
                 .catch(() => undefined);
-            const marked = await this.store.updateRunIf(runId, ['running', 'suspended', 'blocked'], {
+            const marked = await this.store.updateRunIf(runId, WAKEABLE_RUN_STATUSES, {
                 wakeRequestedAt: this.clock(),
             });
             return marked ? 'stamped' : 'gone';
@@ -5687,7 +5787,7 @@ export class WorkflowEngine {
         if (!(await this.store.tryLockRun(runId, this.instanceId, nowMs + this.leaseMs, nowMs)))
             return;
         const fresh = await this.store.getRun(runId);
-        if (fresh?.status !== 'suspended' && fresh?.status !== 'blocked') {
+        if (!fresh || !PARKED_RUN_STATUSES.includes(fresh.status)) {
             await this.store.releaseRunLock(runId, this.instanceId);
             return;
         }
@@ -5787,7 +5887,7 @@ export class WorkflowEngine {
         }
         // Free, and `pending` (its dispatch or the pending-run poll runs it) or `running` with no lease
         // (a holder that died mid-turn: crash recovery takes it): nothing for a wake to do.
-        if (run.status !== 'suspended' && run.status !== 'blocked')
+        if (!PARKED_RUN_STATUSES.includes(run.status))
             return;
         if (this.runQueue) {
             this.enqueueRun({
@@ -5800,7 +5900,7 @@ export class WorkflowEngine {
         if (!(await this.store.tryLockRun(runId, this.instanceId, nowMs + this.leaseMs, nowMs)))
             return;
         const fresh = await this.store.getRun(runId);
-        if (fresh?.status !== 'suspended' && fresh?.status !== 'blocked') {
+        if (!fresh || !PARKED_RUN_STATUSES.includes(fresh.status)) {
             await this.store.releaseRunLock(runId, this.instanceId);
             return;
         }
@@ -5875,6 +5975,11 @@ export class WorkflowEngine {
             // A remote (e.g. Python) workflow is advanced by dispatching workflow tasks, not by running an
             // in-process body — but everything around it (lease, recovery, timers, the resume that lands us
             // here on a step result) is identical, so it branches here under the same lease.
+            // A `cancelling` run is a compensating cancel in flight, maybe re-driven by crash recovery or
+            // by another pod that never saw the in-memory flag: re-derive the intent from the status, so
+            // this turn unwinds the saga and settles `cancelled` at whichever exit it reaches.
+            if (run.status === 'cancelling')
+                this.cancelRequested.add(run.id);
             const result = registered?.remote
                 ? await this.runRemoteExecution(run, registered)
                 : await this.runExecution(run, fn, registered);
@@ -6265,7 +6370,7 @@ export class WorkflowEngine {
         // settle — and it must happen even while a dispatched turn is still out (the hold below would
         // otherwise swallow the cancel's resume, and the in-flight turn's decision would carry the run on
         // as if it was never cancelled). The late decision then finds the run cancelled and is dropped.
-        if (await this.takeCancelIntent(run.id))
+        if (this.takeCancelIntent(run.id))
             return this.compensateAndCancel(run, []);
         // A dispatched turn is still out and within its liveness window: whatever woke the run (a step
         // result, a signal, a wait recheck) must not dispatch a second turn over it — that would supersede
@@ -6358,13 +6463,17 @@ export class WorkflowEngine {
             // with its lease released, so crash recovery re-drives it (replaying completed steps; bounded by
             // `maxRecoveryAttempts`).
             if (err instanceof RemoteWorkflowTimeout) {
-                await this.store
+                const reset = await this.store
                     .updateRunIf(run.id, ['running', 'suspended'], {
                     status: 'running',
                     updatedAt: new Date(),
                 })
                     .catch(() => false);
                 await this.releaseTurnLease(run.id);
+                // Not reset: the run moved on meanwhile (a compensating cancel made it `cancelling`, or it
+                // settled). Report what it is now, not a `running` it no longer reads.
+                if (!reset)
+                    return this.echoCurrentStatus(run.id);
                 return { runId: run.id, status: 'running' };
             }
             const error = {
@@ -7276,21 +7385,25 @@ export class WorkflowEngine {
         return wakeAt;
     }
     /**
-     * Whether a compensating cancel is pending for this run, consuming the in-memory flag. The intent
-     * lives in TWO places: the in-memory `cancelRequested` fast path (same pod, same boot), and the
-     * DURABLE buffered `cancel:<id>` marker `cancel()` persisted — so a crash or a cross-pod handoff
-     * mid-cancellation can't silently forget the cancel. The marker is peeked (take + re-buffer), not
-     * consumed: it must survive a crash mid-unwind; {@link compensateAndCancel} drains it once
-     * `cancelled` is durably recorded.
+     * Whether a compensating cancel is pending for this run, consuming the in-memory flag. The flag is
+     * set by `cancel()` on this pod, and at turn start for a run that reads `cancelling` (the durable
+     * intent: a cancel from another pod, or one re-driven by recovery). A cancel another pod persists
+     * while this turn runs is found at the settle instead: the run no longer reads a settle-eligible
+     * status, and {@link settleOrUnwind} unwinds it.
      */
-    async takeCancelIntent(runId) {
-        if (this.cancelRequested.delete(runId))
-            return true;
-        const marker = await this.store.takeBufferedSignal(`cancel:${runId}`);
-        if (!marker)
-            return false;
-        await this.store.bufferSignal(`cancel:${runId}`, marker.payload).catch(() => undefined);
-        return true;
+    takeCancelIntent(runId) {
+        return this.cancelRequested.delete(runId);
+    }
+    /**
+     * Settle this turn's `outcome` — unless a compensating cancel was persisted on another pod while the
+     * turn ran: the settle's status check then reads `cancelling`, and this turn (which still holds the
+     * lease and the saga it registered) undoes it and settles `cancelled` itself.
+     */
+    async settleOrUnwind(run, outcome, compensations) {
+        const settled = await this.settleRun(run, outcome);
+        if (settled.status !== 'cancelling' || this.leaseLostRuns.has(run.id))
+            return settled;
+        return this.compensateAndCancel(run, compensations);
     }
     /**
      * Undo the registered saga compensations in reverse and settle the run `cancelled`. Shared by EVERY
@@ -7300,8 +7413,8 @@ export class WorkflowEngine {
      */
     async compensateAndCancel(run, compensations) {
         this.cancelRequested.delete(run.id);
-        // Zombie fence (as in settleRun): another instance owns the run now; the durable marker is still
-        // there for it, so this stale turn must neither undo nor write.
+        // Zombie fence (as in settleRun): another instance owns the run now; the persisted `cancelling`
+        // status is still there for it, so this stale turn must neither undo nor write.
         if (this.leaseLostRuns.has(run.id))
             return this.echoCurrentStatus(run.id);
         for (let i = compensations.length - 1; i >= 0; i -= 1) {
@@ -7316,13 +7429,6 @@ export class WorkflowEngine {
             awaitingDecisionTaskId: undefined,
             updatedAt: new Date(),
         }));
-        // The cancellation is durably recorded — consume the marker(s) so a later retry of this run id
-        // doesn't get spuriously re-cancelled.
-        for (;;) {
-            const m = await this.store.takeBufferedSignal(`cancel:${run.id}`).catch(() => null);
-            if (!m)
-                break;
-        }
         this.emit({
             type: 'run.failed',
             runId: run.id,
@@ -7367,7 +7473,11 @@ export class WorkflowEngine {
         }
         // Singleton admission gate: if this run shares its key with `limit` older in-flight runs, wait
         // (suspend on a short timer) until a slot frees instead of running now. Re-checked on each resume.
-        if (registered?.singleton && !(await this.singletons.admit(run, registered.singleton))) {
+        // A `cancelling` run skips it: it is tearing down, not competing for a slot, and parking it here
+        // would overwrite `cancelling` with `suspended`.
+        if (run.status !== 'cancelling' &&
+            registered?.singleton &&
+            !(await this.singletons.admit(run, registered.singleton))) {
             return this.singletonWaitResult(run);
         }
         // A body this instance parked on dispatched steps in an earlier turn continues from there (see
@@ -7446,10 +7556,10 @@ export class WorkflowEngine {
             }
             // A compensating cancel requested while this turn ran (or one whose resume replays straight to
             // `return`, with no suspension point left) still wins: undo + settle cancelled, never completed.
-            if (await this.takeCancelIntent(run.id)) {
+            if (this.takeCancelIntent(run.id)) {
                 return await this.compensateAndCancel(run, compensations);
             }
-            return await this.settleRun(run, { kind: 'completed', output });
+            return await this.settleOrUnwind(run, { kind: 'completed', output }, compensations);
         }
         catch (err) {
             if (err instanceof ContinueAsNew) {
@@ -7458,7 +7568,11 @@ export class WorkflowEngine {
                 if (this.leaseLostRuns.has(run.id))
                     return await this.echoCurrentStatus(run.id);
                 // A cancel in flight wins over continue-as-new: undo + cancel instead of forking the next run.
-                if (await this.takeCancelIntent(run.id)) {
+                // The run is re-read here (continue-as-new is rare) so a cancel another pod persisted during
+                // this turn usually stops the fork; one that lands after the read loses the conditional
+                // completion below instead.
+                if (this.takeCancelIntent(run.id) ||
+                    (await this.store.getRun(run.id))?.status === 'cancelling') {
                     return await this.compensateAndCancel(run, compensations);
                 }
                 const nextId = nextContinuationId(run.id);
@@ -7473,12 +7587,23 @@ export class WorkflowEngine {
                 // `dispatch: false`: the tracked handoff below owns the pickup. The continuation inherits
                 // the parent RUN's namespace so a tenant's chain stays in its worker-pool partition.
                 await this.startCore(run.workflow, err.input, nextId, { namespace: run.namespace }, false);
-                await this.store.updateRun(run.id, {
+                // Conditional, like every settle: a cancel persisted after the re-read above (`cancelling`, or a
+                // plain `cancelled`) must win over this completion. The continuation already exists then, and
+                // nothing has handed it off: cancel it, and unwind this run if the cancel compensates.
+                const completed = await this.store.updateRunIf(run.id, SETTLE_ELIGIBLE_STATUSES, {
                     status: 'completed',
                     output: undefined,
                     error: undefined,
                     updatedAt: new Date(),
                 });
+                if (!completed) {
+                    await this.cancel(nextId);
+                    const current = await this.store.getRun(run.id);
+                    if (current?.status === 'cancelling' && !this.leaseLostRuns.has(run.id)) {
+                        return await this.compensateAndCancel(run, compensations);
+                    }
+                    return await this.echoCurrentStatus(run.id);
+                }
                 this.emit({
                     type: 'run.completed',
                     runId: run.id,
@@ -7502,10 +7627,10 @@ export class WorkflowEngine {
             if (err instanceof WorkflowSuspended) {
                 // A compensating cancel resumed this run to reach here: the replay re-registered the saga,
                 // so undo the completed steps in reverse and mark it cancelled instead of re-suspending.
-                if (await this.takeCancelIntent(run.id)) {
+                if (this.takeCancelIntent(run.id)) {
                     return await this.compensateAndCancel(run, compensations);
                 }
-                const settled = await this.settleRun(run, { kind: 'suspended', wakeAt: err.wakeAt });
+                const settled = await this.settleOrUnwind(run, { kind: 'suspended', wakeAt: err.wakeAt }, compensations);
                 const stamp = this.suspendStamps.get(run.id);
                 this.suspendStamps.delete(run.id);
                 if (parkedTurn && cont && settled.status === 'suspended' && stamp !== undefined) {
@@ -7530,7 +7655,7 @@ export class WorkflowEngine {
             }
             // A cancel in flight that surfaced as a thrown error settles `cancelled`, not `failed`: the saga
             // undo runs either way; this keeps the terminal status faithful to the cancel request.
-            if (await this.takeCancelIntent(run.id)) {
+            if (this.takeCancelIntent(run.id)) {
                 return await this.compensateAndCancel(run, compensations);
             }
             const error = {
@@ -7548,7 +7673,8 @@ export class WorkflowEngine {
                     continue;
                 await this.runCompensation(run, comp, i);
             }
-            return await this.settleRun(run, { kind: 'failed', error });
+            // The saga is undone already: a cancel persisted meanwhile only needs the `cancelled` settle.
+            return await this.settleOrUnwind(run, { kind: 'failed', error }, []);
         }
         finally {
             // Release the recovery lease once the run reaches a terminal/suspended state, so the