@akagilnc/pi-workflow-roles 0.1.4620 → 0.1.4631

package/src/analyst-ledger.ts

@@ -22,6 +22,7 @@ import {
   resolveActivationLedgerHome,
 } from "./activation-ledger-topology.ts";
 import { listBookRunDirectories } from "./role-run-placement.ts";
+import { autopsyWriterLock } from "./public-cli/run-lifecycle.ts";
 import { readRunTicketNumber } from "./run-ticket-number.ts";
 import {
   extractSessionModelSequence,
@@ -87,6 +88,64 @@ async function readExistingRunLifecycleState(
   }
 }
 
+/**
+ * #855 lease check projection for ghost legs — index facts only (ADR 0049).
+ * Does not rename autopsy verdicts into stronger claims than observed.
+ */
+export type AnalystGhostLeaseCheck =
+  | { readonly kind: "holder-dead"; readonly pid: number }
+  | { readonly kind: "no-lease" }
+  | { readonly kind: "unverifiable"; readonly reason: "unreadable" | "unparseable" };
+
+export type AnalystGhostLeg = {
+  readonly runId: string;
+  readonly runState: "admitted" | "running";
+  readonly leaseCheck: AnalystGhostLeaseCheck;
+};
+
+function ghostLeaseCheckFromAutopsy(
+  autopsy: Awaited<ReturnType<typeof autopsyWriterLock>>,
+): AnalystGhostLeaseCheck | undefined {
+  switch (autopsy.verdict) {
+    case "alive":
+      return undefined;
+    case "dead":
+      return { kind: "holder-dead", pid: autopsy.pid };
+    case "absent":
+      return { kind: "no-lease" };
+    case "unknown":
+      return {
+        kind: "unverifiable",
+        reason: autopsy.reason === "unreadable" ? "unreadable" : "unparseable",
+      };
+  }
+}
+
+/**
+ * Classify one admitted|running run against writer lease liveness (#855).
+ * Alive holder → still in-flight (omit). Otherwise → ghost report fact only.
+ */
+async function classifyGhostCandidate(input: {
+  readonly runId: string;
+  readonly runState: "admitted" | "running";
+  readonly runDirectory: string;
+}): Promise<
+  | { readonly kind: "live" }
+  | { readonly kind: "ghost"; readonly leg: AnalystGhostLeg }
+> {
+  const autopsy = await autopsyWriterLock(join(input.runDirectory, "writer.lock"));
+  const leaseCheck = ghostLeaseCheckFromAutopsy(autopsy);
+  if (leaseCheck === undefined) return { kind: "live" };
+  return {
+    kind: "ghost",
+    leg: {
+      runId: input.runId,
+      runState: input.runState,
+      leaseCheck,
+    },
+  };
+}
+
 function parseRunDirectoryName(
   name: string,
 ): { runId: string; role: string } | undefined {
@@ -335,6 +394,8 @@ export type AnalystScopedRunScan = {
   readonly unreadable: readonly AnalystUnreadableRun[];
   /** C4: typed-ticket admits whose projectRoot mechanical key conflicted. */
   readonly scopeConflicts: readonly AnalystScopeConflict[];
+  /** #855: admitted|running runs whose writer lease cannot prove a live holder. */
+  readonly ghostLegs: readonly AnalystGhostLeg[];
 };
 
 async function classifyScopedRun(input: {
@@ -343,9 +404,20 @@ async function classifyScopedRun(input: {
   readonly role: string;
   readonly runDirectory: string;
 }): Promise<
-  | { readonly kind: "readable"; readonly facts: AnalystReadableRunFacts }
-  | { readonly kind: "unreadable"; readonly entry: AnalystUnreadableRun }
+  | {
+      readonly kind: "readable";
+      readonly facts: AnalystReadableRunFacts;
+      /** #855: present terminal still lists ghost when lease cannot prove live. */
+      readonly ghostLeg?: AnalystGhostLeg;
+    }
+  | {
+      readonly kind: "unreadable";
+      readonly entry: AnalystUnreadableRun;
+      /** #855: unreadable terminal still lists ghost when lease cannot prove live. */
+      readonly ghostLeg?: AnalystGhostLeg;
+    }
   | { readonly kind: "live" }
+  | { readonly kind: "ghost"; readonly leg: AnalystGhostLeg }
 > {
   const missingSources: AnalystMissingSource[] = [];
   const reasons: string[] = [];
@@ -434,13 +506,31 @@ async function classifyScopedRun(input: {
 
   // 3) typed terminal artifact — absence is no-receipt only for terminal runs.
   // Live admitted/running/resumable runs (existing run-state) are not dead legs.
+  // #855: writer-lease ghost check is independent of terminal artifact status.
+  // present → still emit metrics; unreadable → still enter missingSources;
+  // admitted|running + non-live lease → still list in ghostLegs (ticket #4).
+  const lifecycle = await readExistingRunLifecycleState(input.runDirectory);
+  let ghostLeg: AnalystGhostLeg | undefined;
+  if (lifecycle === "admitted" || lifecycle === "running") {
+    const ghost = await classifyGhostCandidate({
+      runId: input.runId,
+      runState: lifecycle,
+      runDirectory: input.runDirectory,
+    });
+    if (ghost.kind === "ghost") ghostLeg = ghost.leg;
+  }
+
   try {
     const artifact = await readRunTerminalArtifact(input.runDirectory);
     if (artifact.status === "unreadable") {
       missingSources.push("terminal-artifact");
       reasons.push(`${artifact.file}: ${artifact.reason}`);
     } else if (artifact.status === "absent") {
-      const lifecycle = await readExistingRunLifecycleState(input.runDirectory);
+      if (lifecycle === "admitted" || lifecycle === "running") {
+        // No terminal yet: ghost report only, or live in-flight omit.
+        if (ghostLeg !== undefined) return { kind: "ghost", leg: ghostLeg };
+        return { kind: "live" };
+      }
       if (lifecycle !== undefined && LIVE_RUN_STATES.has(lifecycle)) {
         return { kind: "live" };
       }
@@ -479,6 +569,7 @@ async function classifyScopedRun(input: {
         firstFrameAt,
         lastFrameAt,
       },
+      ...(ghostLeg !== undefined ? { ghostLeg } : {}),
     };
   }
 
@@ -510,6 +601,7 @@ async function classifyScopedRun(input: {
         firstFrameAt: { status: "present", at: frameSpan.startedAt },
         lastFrameAt: { status: "present", at: frameSpan.endedAt },
       },
+      ...(ghostLeg !== undefined ? { ghostLeg } : {}),
     };
   }
 
@@ -525,6 +617,7 @@ async function classifyScopedRun(input: {
       models,
       gateCycles,
     },
+    ...(ghostLeg !== undefined ? { ghostLeg } : {}),
   };
 }
 
@@ -588,11 +681,12 @@ export async function scanAnalystIssueRuns(input: {
   }
 
   if (bookNames.length === 0) {
-    return { runs: [], unreadable: [], scopeConflicts: [] };
+    return { runs: [], unreadable: [], scopeConflicts: [], ghostLegs: [] };
   }
 
   const runs: AnalystReadableRunFacts[] = [];
   const unreadable: AnalystUnreadableRun[] = [];
+  const ghostLegs: AnalystGhostLeg[] = [];
   // scopeConflicts retained on the scan face for page envelope compat; book×ticket
   // scope no longer emits projectRoot dual-key conflicts on the CLI path.
   const scopeConflicts: AnalystScopeConflict[] = [];
@@ -638,9 +732,19 @@ export async function scanAnalystIssueRuns(input: {
         role: parsed.role,
         runDirectory,
       });
-      if (classified.kind === "readable") runs.push(classified.facts);
-      else if (classified.kind === "unreadable") unreadable.push(classified.entry);
+      if (classified.kind === "readable") {
+        runs.push(classified.facts);
+        if (classified.ghostLeg !== undefined) ghostLegs.push(classified.ghostLeg);
+      } else if (classified.kind === "unreadable") {
+        unreadable.push(classified.entry);
+        if (classified.ghostLeg !== undefined) ghostLegs.push(classified.ghostLeg);
+      } else if (classified.kind === "ghost") {
+        ghostLegs.push(classified.leg);
+      }
       // live in-flight runs are omitted from legs and unreadable (not failure/death).
+      // #855 ghost legs are reported separately — not counted as in-flight.
+      // Lease check is independent of terminal artifact: present/unreadable may
+      // still carry a ghostLeg alongside metrics or missingSources.
     }
   }
 
@@ -648,5 +752,6 @@ export async function scanAnalystIssueRuns(input: {
     runs,
     unreadable,
     scopeConflicts,
+    ghostLegs,
   };
 }

package/src/archivist-record-entry.ts

@@ -1,7 +1,7 @@
 /**
  * 司天台唯一 Pi session 记录落盘入口（ADR 0065）。
  * 调用方只声明自己是谁的什么；落点由候簿拓扑算出，签名不含任何落点/路径参数。
- * 「谁调了谁」复用 Pi parentSession + ADR 0047 correlation，不新增 caller 字段。
+ * 「谁调了谁」复用 Pi parentSession，不新增 caller 字段（#855 两面对账 correlation 键已删）。
  */
 import {
   closeSync,

package/src/pi/role-turn-host.ts

@@ -470,9 +470,6 @@ export function createPiRoleTurnHost(config: PiRoleTurnHostConfig): RoleTurnHost
       ) {
         env.AK_ROLE_AUDITOR_SUBJECT = process.env.AK_ROLE_AUDITOR_SUBJECT;
       }
-      if (request.correlationId !== undefined && request.correlationId.trim() !== "") {
-        env.AK_CORRELATION_ID = request.correlationId;
-      }
       if (
         config.recordLaunchedRolePackageIdentity !== undefined &&
         config.observeLaunchedRolePackageIdentity !== undefined

package/src/public-cli/auto-resume.ts

@@ -32,6 +32,7 @@ import {
   type RunWriterLease,
 } from "./run-lifecycle.ts";
 import { parseAutoResumeLimit } from "./config.ts";
+import { processCancelSignalName } from "./process-cancel.ts";
 import { isLawfulTypedTerminalOutcome, formatTerminalResult, type TerminalArtifactRef, type TerminalResult, type TerminalRoleName } from "./terminal.ts";
 import {
   attachRecordedSubmissions,
@@ -473,6 +474,11 @@ export async function runWithAutoResumeLoop<
    * before the first dispatch instead of silently bypassing the ceiling comparison.
    */
   autoResumeLimit?: number | undefined;
+  /**
+   * #855: process-cancel signal. Once aborted by a catchable process signal,
+   * the loop must not dispatch another turn or spawn another child.
+   */
+  signal?: AbortSignal;
   buildInitialPayload: () => TPayload;
   buildResumePayload: () => TPayload;
   dispatch: (payload: TPayload, lease: RunWriterLease, isFirst: boolean, attemptIo: CliIo) => Promise<T>;
@@ -578,6 +584,11 @@ export async function runWithAutoResumeLoop<
         if (terminal !== undefined) presentTerminal(terminal, options.io);
         return result;
       }
+      // #855: process cancel — stop even if dispatch forgot skipAutoResume.
+      if (processCancelSignalName(options.signal) !== undefined) {
+        if (terminal !== undefined) presentTerminal(terminal, options.io);
+        return result;
+      }
     }
 
     if (result !== undefined) {
@@ -616,6 +627,29 @@ export async function runWithAutoResumeLoop<
           terminal,
         } as T;
       }
+      // #855: process cancel on the throw path — do not re-dispatch; name the signal.
+      const cancelName = processCancelSignalName(options.signal);
+      if (cancelName !== undefined) {
+        const terminal = await attachDispatchExceptionTerminal(
+          options.admitted,
+          dispatchExceptionFailureTerminal({
+            role: options.admitted.role,
+            runId: options.admitted.runId,
+            causeError: lastThrownError,
+            errorFiles: retainedErrorFiles,
+            autoResumeAttempts,
+            endReason: `ak-role terminated by ${cancelName}`,
+            everyAttemptThrew,
+          }),
+          options.io,
+        );
+        await finalizeExceptionRunBestEffort(options.admitted.runDirectory, options.io);
+        presentTerminal(terminal, options.io);
+        return {
+          exitCode: 1,
+          terminal,
+        } as T;
+      }
       if (!(await isPrincipalAvailable(options.admitted.principal))) {
         const terminal = await attachDispatchExceptionTerminal(
           options.admitted,

package/src/public-cli/cli.ts

@@ -305,6 +305,11 @@ export type CliEnv = {
    * skip same-ticket auto-resume. Not a public flag — the verb is the choice.
    */
   freshSummons?: true;
+  /**
+   * #855: process-level cancel (SIGTERM/SIGINT/SIGHUP). Nested turns receive
+   * the same signal so hosts can gracefully stop children.
+   */
+  signal?: AbortSignal;
 };
 
 
@@ -413,6 +418,7 @@ function createRoleEnvironment(
       ? {}
       : { autoResumeLimit: options.config.autoResumeLimit }),
     ...(env.freshSummons === true ? { freshSummons: true as const } : {}),
+    ...(env.signal === undefined ? {} : { signal: env.signal }),
   };
 }
 
@@ -1168,6 +1174,30 @@ async function runConfigCommand(
   throw new CliUsageError(`unknown config subcommand: ${args[0]}`);
 }
 
+/**
+ * #855: process-cancel handlers only for commands that run a role turn
+ * (callable roles / resume / new). analyst/roles/config/help keep Node's
+ * default SIGINT/SIGTERM termination — installing handlers would swallow Ctrl+C.
+ */
+export function commandNeedsProcessCancel(argv: readonly string[]): boolean {
+  // Decision-time parse must not escape the CLI usage boundary. Malformed
+  // global flags throw CliUsageError here; return false and let runAkRole
+  // present the same structured usage reject (exit 2). Handlers are moot
+  // when parse fails — install-or-not has no subsequent effect.
+  let parsed: ParsedGlobal;
+  try {
+    parsed = parseArgv(argv);
+  } catch (error) {
+    if (error instanceof CliUsageError) return false;
+    throw error;
+  }
+  if (parsed.help || parsed.command === undefined || parsed.command === "help") {
+    return false;
+  }
+  if (parsed.command === "resume" || parsed.command === "new") return true;
+  return isPublicCallableRole(parsed.command);
+}
+
 export async function runAkRole(
   argv: readonly string[],
   env: CliEnv,

package/src/public-cli/main.ts

@@ -34,6 +34,28 @@ process.env.AK_ROLE_PACKAGE_ROOT = packageRoot;
 // The host-provided runtime must be resolvable before the CLI module graph loads it.
 ensureHostPiRuntimeResolvable(packageRoot);
 
-const { runAkRole } = await import("./cli.ts");
-const result = await runAkRole(process.argv.slice(2), { packageRoot });
-process.exitCode = result.exitCode;
+const { runAkRole, commandNeedsProcessCancel } = await import("./cli.ts");
+const { installProcessCancelHandlers } = await import("./process-cancel.ts");
+
+// #855: catchable signals only for role-turn commands. analyst/roles/config/help
+// keep Node default termination — global handlers would swallow Ctrl+C.
+const argv = process.argv.slice(2);
+const processCancel = commandNeedsProcessCancel(argv)
+  ? installProcessCancelHandlers()
+  : undefined;
+try {
+  const result = await runAkRole(argv, {
+    packageRoot,
+    ...(processCancel === undefined ? {} : { signal: processCancel.signal }),
+  });
+  // Signal termination is never a successful public exit, even if a seat
+  // somehow returned zero before settlement folded the abort.
+  process.exitCode =
+    processCancel !== undefined &&
+    processCancel.receivedSignal() !== undefined &&
+    result.exitCode === 0
+      ? 1
+      : result.exitCode;
+} finally {
+  processCancel?.dispose();
+}

package/src/public-cli/post-admission.ts

@@ -87,6 +87,11 @@ import {
   type TypedProviderHttpObservation,
   type WriterLeaseDiagnosticKind,
 } from "./run-lifecycle.ts";
+import {
+  processCancelDiagnostic,
+  processCancelSignalName,
+  type CatchableProcessSignal,
+} from "./process-cancel.ts";
 import { homeFromRunDirectory } from "../activation-ledger-topology.ts";
 import {
   attemptProducedFreshSubmission,
@@ -119,6 +124,63 @@ import {
   TurnDispatchedFailure,
 } from "./auto-resume.ts";
 
+/** #855: process-cancel settlement never re-enters auto-resume. */
+function withProcessCancelSkipAutoResume<T extends object>(
+  result: T,
+  signal: AbortSignal | undefined,
+): T & { skipAutoResume?: true } {
+  if (processCancelSignalName(signal) === undefined) {
+    return result as T & { skipAutoResume?: true };
+  }
+  return { ...result, skipAutoResume: true as const };
+}
+
+/**
+ * #855: turn already started, then a catchable process signal arrived before
+ * lawful seal — settle as named cancel failure and skip auto-resume.
+ */
+async function settleProcessCancelAfterTurn<A extends AdmittedRoleInvocation, T extends TerminalResult>(input: {
+  admitted: A;
+  cancelName: CatchableProcessSignal;
+  result: RoleTurnResult;
+  adapters: PostAdmissionAdapters<A, T>;
+  env: PostAdmissionEnv;
+  io: CliIo;
+  persistRunState: boolean;
+  deferredPersist: { needsPersist?: true } | Record<string, never>;
+  invocationScopeId: string | undefined;
+}): Promise<{
+  exitCode: number;
+  admitted: A;
+  terminal?: T;
+  skipAutoResume?: true;
+  turnDispatched?: true;
+  needsPersist?: true;
+}> {
+  const failed = await settleAfterTurnStarted(
+    input.admitted,
+    withEngineDetourInvocationScope(
+      {
+        timedOut: input.result.timedOut,
+        code: input.result.code,
+        stderr: input.result.stderr,
+        knownDiagnostic: processCancelDiagnostic(input.cancelName),
+      },
+      input.invocationScopeId,
+    ),
+    input.adapters,
+    input.env.principalAuthority,
+    input.io,
+    input.persistRunState,
+  );
+  return {
+    ...failed,
+    turnDispatched: true as const,
+    skipAutoResume: true as const,
+    ...input.deferredPersist,
+  };
+}
+
 /**
  * Nested station-child role already finished its own call-local loop.
  * Parent records that failure once and must not auto-resume into a re-summon
@@ -587,6 +649,38 @@ export async function dispatchPostAdmissionTurn<
   const finishAfterTurn = async (result: DispatchOutcome): Promise<DispatchOutcome> => {
     if (afterDispatchApplied) return result;
     afterDispatchApplied = true;
+    // #855: re-read cancel before afterDispatch finalization — never present
+    // lawful success after a catchable process signal. skipRunStateWrite: run-state
+    // may already be terminal from a prior lawful persist; do not reopen as resumable.
+    const cancelBeforeFinish = processCancelSignalName(env.signal);
+    if (
+      cancelBeforeFinish !== undefined &&
+      result.terminal !== undefined &&
+      isLawfulTypedTerminalOutcome(result.terminal.roleOutcome)
+    ) {
+      result = {
+        ...(await settleAfterTurnStarted(
+          admitted,
+          withEngineDetourInvocationScope(
+            {
+              timedOut: false,
+              code: null,
+              stderr: "",
+              knownDiagnostic: processCancelDiagnostic(cancelBeforeFinish),
+              skipRunStateWrite: true,
+            },
+            request.invocationScopeId,
+          ),
+          adapters,
+          env.principalAuthority,
+          io,
+          persistRunState,
+        )),
+        turnDispatched: true as const,
+        skipAutoResume: true as const,
+        ...deferredPersist,
+      };
+    }
     try {
       // #858: an unbound seat may assert its ticket on the existing receipt.
       // Read the original accepted payload; do not rewrite it, infer from prose,
@@ -788,20 +882,29 @@ export async function dispatchPostAdmissionTurn<
     try {
       result = await env.roleTurnHost.executeTurn(turnRequest);
     } catch (error) {
+      const processCancelName = processCancelSignalName(env.signal);
       const settled = await settleAfterTurnStarted(
           admitted,
           withEngineDetourInvocationScope({
           timedOut: false,
           code: null,
           stderr: "",
-          thrown: error,
+          thrown:
+            processCancelName === undefined
+              ? error
+              : new Error(processCancelDiagnostic(processCancelName), { cause: error }),
         }, request.invocationScopeId),
         adapters,
         env.principalAuthority,
         io,
         persistRunState,
       );
-      return await finishAfterTurn({ ...settled, turnDispatched: true as const, ...deferredPersist });
+      return await finishAfterTurn(
+        withProcessCancelSkipAutoResume(
+          { ...settled, turnDispatched: true as const, ...deferredPersist },
+          env.signal,
+        ),
+      );
     }
 
     // `result.stderr` stays live in memory for the real classification below
@@ -917,11 +1020,13 @@ export async function dispatchPostAdmissionTurn<
       // retroactively invalidate an acceptance that already sealed this turn
       // — a resolved 429 observed earlier in the same session is exactly
       // that.
+      const processCancelName = processCancelSignalName(env.signal);
       const directHostFailureSignal =
         result.timedOut
         || result.knownFailure !== undefined
         || runnerKnownFailure !== undefined
-        || credentialFailure !== undefined;
+        || credentialFailure !== undefined
+        || processCancelName !== undefined;
       hostSignalFailed =
         directHostFailureSignal
         || (result.code !== null && result.code !== 0)
@@ -959,12 +1064,16 @@ export async function dispatchPostAdmissionTurn<
       // where a bare nonzero exit / resolution failure must not be outranked
       // by someone else's earlier success (#836 r12 class 2).
       const staleAcceptanceOutranksRealFailure = !settledIsFreshThisAttempt && hostSignalFailed;
+      // #855: re-read cancel after trySettle/attach awaits — a signal in this
+      // window must not land as lawful accepted.
+      const cancelAfterSettle = processCancelSignalName(env.signal);
       if (
         settled !== undefined
         && shouldPresent(settled)
         && !directHostFailureSignal
         && !staleAcceptanceOutranksRealFailure
         && stderrLogWriteFailure === undefined
+        && cancelAfterSettle === undefined
       ) {
         // This court sealed — drop open-court pointer (bare resume no longer continues it).
         if (
@@ -1017,6 +1126,24 @@ export async function dispatchPostAdmissionTurn<
       return await finishAfterTurn({ ...settledFailure, turnDispatched: true as const, ...deferredPersist });
     }
     if (settledOutcome !== undefined) {
+      // #855: final cancel re-read before lawful seal — settlement window may
+      // have received SIGTERM/SIGINT/SIGHUP after the earlier snapshot.
+      const lateCancel = processCancelSignalName(env.signal);
+      if (lateCancel !== undefined) {
+        return await finishAfterTurn(
+          await settleProcessCancelAfterTurn({
+            admitted,
+            cancelName: lateCancel,
+            result,
+            adapters,
+            env,
+            io,
+            persistRunState,
+            deferredPersist,
+            invocationScopeId: request.invocationScopeId,
+          }),
+        );
+      }
       if (persistRunState) {
         try {
           await persistReturnedRunState(admitted, env.principalAuthority, { lawful: true });
@@ -1045,17 +1172,24 @@ export async function dispatchPostAdmissionTurn<
             io,
             persistRunState,
           );
-          return await finishAfterTurn({ ...failed, turnDispatched: true as const, ...deferredPersist });
+          return await finishAfterTurn(
+            withProcessCancelSkipAutoResume(
+              { ...failed, turnDispatched: true as const, ...deferredPersist },
+              env.signal,
+            ),
+          );
         }
       }
       // Lawful persist + present is the caller's stop seam (auto-resume loop /
       // manual resume), not this retried host-turn function.
+      // #855 cancel re-read lives in finishAfterTurn (before afterDispatch).
       return await finishAfterTurn({ ...settledOutcome, ...deferredPersist });
     }
 
     // Host/runner true failure coexists with already-recorded payloads — never wash as accepted.
     if (hostSignalFailed) {
       const resolutionInput = controlledFailureInputFromResolution(resolution!);
+      const processCancelName = processCancelSignalName(env.signal);
       const stderrLogWriteDetails =
         stderrLogWriteFailure === undefined
           ? undefined
@@ -1067,6 +1201,9 @@ export async function dispatchPostAdmissionTurn<
           code: result.code,
           stderr: result.stderr,
           ...resolutionInput,
+          ...(processCancelName === undefined
+            ? {}
+            : { knownDiagnostic: processCancelDiagnostic(processCancelName) }),
           // Secondary fact only — never the cause. Rides on whichever channel
           // classification actually reads (knownFailure.details owns it when
           // a knownFailure exists; the top-level knownDetails otherwise).
@@ -1086,7 +1223,12 @@ export async function dispatchPostAdmissionTurn<
         io,
         persistRunState,
       );
-      return await finishAfterTurn({ ...failed, turnDispatched: true as const, ...deferredPersist });
+      return await finishAfterTurn(
+        withProcessCancelSkipAutoResume(
+          { ...failed, turnDispatched: true as const, ...deferredPersist },
+          env.signal,
+        ),
+      );
     }
 
     // Nothing else was wrong, but the durable stderr mirror itself failed to
@@ -1114,6 +1256,23 @@ export async function dispatchPostAdmissionTurn<
       await settleHostEndedNoReceipt(admitted, env.principalAuthority, courtScope) as T,
       courtScope,
     );
+    // #855: cancel during no_receipt settlement window is not lawful success.
+    const noReceiptCancel = processCancelSignalName(env.signal);
+    if (noReceiptCancel !== undefined) {
+      return await finishAfterTurn(
+        await settleProcessCancelAfterTurn({
+          admitted,
+          cancelName: noReceiptCancel,
+          result,
+          adapters,
+          env,
+          io,
+          persistRunState,
+          deferredPersist,
+          invocationScopeId: request.invocationScopeId,
+        }),
+      );
+    }
     if (persistRunState) {
       try {
         await persistReturnedRunState(admitted, env.principalAuthority, { lawful: true });
@@ -1137,9 +1296,15 @@ export async function dispatchPostAdmissionTurn<
           io,
           persistRunState,
         );
-        return await finishAfterTurn({ ...failed, turnDispatched: true as const, ...deferredPersist });
+        return await finishAfterTurn(
+          withProcessCancelSkipAutoResume(
+            { ...failed, turnDispatched: true as const, ...deferredPersist },
+            env.signal,
+          ),
+        );
       }
     }
+    // #855 cancel re-read lives in finishAfterTurn (before afterDispatch).
     return await finishAfterTurn({
       exitCode: exitCodeForTerminalOutcome(noReceipt.roleOutcome),
       admitted,
@@ -1512,6 +1677,7 @@ export async function runPostAdmissionSeatResume<
         io: input.io,
         sessionAppender: env.sessionAppender,
         autoResumeLimit: env.autoResumeLimit,
+        ...(env.signal === undefined ? {} : { signal: env.signal }),
         buildInitialPayload: (): StationChildAttempt => ({ resumeTurn: false }),
         buildResumePayload: (): StationChildAttempt => ({ resumeTurn: true }),
         // Same as public manual resume: prior-court sealed acceptance is not a
@@ -1678,6 +1844,7 @@ export async function runPostAdmissionResumable<
     io,
     sessionAppender: env.sessionAppender,
     autoResumeLimit: env.autoResumeLimit,
+    ...(env.signal === undefined ? {} : { signal: env.signal }),
     buildInitialPayload: buildScopedInitial,
     buildResumePayload: buildScopedResume,
     dispatch: async (request, lease, _isFirst, attemptIo) => {