@tokenfactory/acc-runner 0.6.0 → 0.6.2

package/dist/task-runner.js

@@ -16,11 +16,13 @@
 import os from "node:os";
 import path from "node:path";
 import { execa } from "execa";
-import { normalizeUsage, parseClaudeJson, priceUsdCents, } from "./cost-pricing.js";
+import { normalizeUsage, parseClaudeJson, priceUsdCents, toCliAlias, } from "./cost-pricing.js";
 import { git as defaultGit } from "./git.js";
 import { gh as defaultGh } from "./gh.js";
 import { writeMcpConfig as defaultWriteMcpConfig, } from "./mcp-spawn.js";
 import { branchForTask, prTitleForTask, renderTaskPrompt, } from "./prompt.js";
+import { acquireTaskLock as defaultAcquireTaskLock, TaskLockHeldError, } from "./runtime/locks.js";
+import { prepareTaskWorktree as defaultPrepareTaskWorktree, } from "./runtime/worktree.js";
 const LOG_BATCH_BYTES = 4 * 1024;
 /**
  * v0.6.0 REG-296: build the argv for `claude --print`. Splitting this
@@ -158,204 +160,407 @@ export function runTask(taskId, deps) {
     const gh = deps.gh ?? defaultGh;
     const spawnClaude = deps.spawnClaude ?? defaultSpawnClaude;
     const checkoutBase = deps.checkoutBase ?? defaultCheckoutBase;
+    const acquireLock = deps.acquireLock ?? defaultAcquireTaskLock;
+    const prepareWorktree = deps.prepareWorktree ?? defaultPrepareTaskWorktree;
     const postCostEvent = deps.postCostEvent ?? ((event) => defaultPostCostEvent(deps.supabase, event));
+    // Silence the unused-binding lint for `checkoutBase` — v0.11-F supersedes
+    // the v0.6.0 REG-301 pre-spawn `git checkout <baseBranch>` with the
+    // worktree's `add -B <branch> <path> <baseBranch>` start-point semantics,
+    // but the dep is still accepted for back-compat with test fixtures that
+    // inject a mock. Drop in v0.7.
+    void checkoutBase;
     let child = null;
     let cancelled = false;
-    const promise = (async () => {
-        // 1. → running (no-op if already running due to a duplicate broadcast).
-        const transition = await deps.supabase.rpc("transition_task", {
+    // v0.6.1 (v0.11-D): release lock rows on every terminal exit path
+    // below the claim. Best-effort — a release failure logs to stderr
+    // but does not change the outcome the runner reports to the caller.
+    // Calling release without first calling claim is a no-op at the
+    // RPC level, so wiring this into both pre-claim and post-claim
+    // returns would be safe; we only call it from post-claim returns
+    // to keep the code path obvious to a reader.
+    const releaseLocks = async () => {
+        const { error } = await deps.supabase.rpc("release_task_locks", {
             p_task_id: taskId,
-            p_new_status: "running",
         });
-        if (transition.error) {
-            const msg = transition.error.message;
-            // 22023 = invalid_task_transition. The task may already be past
-            // 'running' (e.g. needs-review) — log and bail rather than crash.
-            await appendEvent(deps.supabase, taskId, "error", {
-                phase: "transition_to_running",
-                error: msg,
-            });
-            return { taskId, status: "failed", phase: "transition_to_running", error: msg };
+        if (error) {
+            process.stderr.write(`[acc-runner] release_task_locks(${taskId}) failed: ${error.message}\n`);
         }
-        // 2. Fetch task + adjacent rows.
-        const fetched = await deps.supabase.rpc("fetch_task_for_runner", {
+    };
+    // v0.12-RESUME — periodic signal loop. After the claim succeeds we
+    // bump acc.tasks.last_runner_signal_at every signalIntervalMs ms so
+    // the v0.12 /5m sweep distinguishes "runner alive, work in flight"
+    // from "runner crashed, task stuck at running". Self-rescheduling
+    // setTimeout (not setInterval) so a slow RPC doesn't queue up
+    // overlapping firings; the loop stops as soon as `signalStopped`
+    // flips in the outer try/finally below.
+    const DEFAULT_SIGNAL_MS = 30_000;
+    const signalIntervalMs = deps.signalIntervalMs ?? DEFAULT_SIGNAL_MS;
+    let signalTimer = null;
+    let signalStopped = false;
+    const updateSignal = async () => {
+        const { error } = await deps.supabase.rpc("update_task_signal", {
             p_task_id: taskId,
         });
-        if (fetched.error || !fetched.data) {
-            const msg = fetched.error?.message ?? "fetch_task_for_runner returned no data";
-            await appendEvent(deps.supabase, taskId, "error", { phase: "fetch", error: msg });
-            await deps.supabase.rpc("transition_task", {
-                p_task_id: taskId,
-                p_new_status: "failed",
-            });
-            return { taskId, status: "failed", phase: "fetch", error: msg };
-        }
-        const result = fetched.data;
-        const { task } = result;
-        const branch = branchForTask(task.id, task.title, task.branch);
-        // REG-295: per-task repo overrides — task row trumps config so one
-        // runner can service tasks across multiple repos. Env-backed config
-        // remains the fallback for tasks that don't carry a hint yet.
-        const repoPath = task.repo_path_hint?.trim()
-            ? expandHomePath(task.repo_path_hint.trim())
-            : deps.cfg.repoPath;
-        const targetRepo = task.repo?.trim() || deps.cfg.targetRepo;
-        // REG-301: branch base comes from task → cfg → main. cfg.integrationBranch
-        // already defaults to "acc/integration" so the third fallback only
-        // matters when an operator zeroed it out via env.
-        const integrationBranch = task.integration_branch?.trim() || deps.cfg.integrationBranch || "main";
-        const prompt = renderTaskPrompt({
-            task,
-            agent: result.agent,
-            model: result.model,
-            integrationBranch,
-            targetRepo,
-        });
-        // 3. Repo prep. v0.6.0 forks the task branch from the integration
-        // base (REG-301): fetch, switch to the base branch, then create the
-        // task branch from there. Prior versions ran `git checkout -B`
-        // directly from cwd HEAD, which in the dogfood loop produced a
-        // 321-commit PR.
-        try {
-            await git.fetch(repoPath);
-            await checkoutBase(repoPath, integrationBranch);
-            await git.checkout(repoPath, branch);
-        }
-        catch (err) {
-            const msg = err.message;
-            await appendEvent(deps.supabase, taskId, "error", {
-                phase: "git",
-                error: msg,
-                base: integrationBranch,
-                branch,
-                repo_path: repoPath,
-            });
-            await deps.supabase.rpc("transition_task", {
-                p_task_id: taskId,
-                p_new_status: "failed",
-            });
-            return { taskId, status: "failed", phase: "git", error: msg };
-        }
-        // 4. Spawn Claude.
-        if (cancelled) {
-            return { taskId, status: "cancelled" };
-        }
-        // 4a. Provision .mcp.json so Claude Code auto-discovers acc-mcp-server.
-        // Best-effort: a failed write must not block the task. The MCP server
-        // is a context source, not a critical dependency for v0.5-C1.
-        let mcpCleanup = null;
-        if (deps.session) {
-            const writer = deps.writeMcpConfig ?? defaultWriteMcpConfig;
-            try {
-                mcpCleanup = await writer({
-                    cwd: repoPath,
-                    taskId,
-                    runnerId: deps.session.runnerId,
-                    accessToken: deps.session.accessToken,
-                    publicUrl: deps.publicUrl ?? deps.cfg.publicUrl,
-                    supabaseUrl: deps.cfg.supabaseUrl,
-                    supabaseAnonKey: deps.cfg.supabaseAnonKey,
-                });
-            }
-            catch (err) {
-                // Don't echo the token even on failure.
-                process.stderr.write(`[acc-runner] mcp .mcp.json write failed: ${err.message}\n`);
-            }
-        }
-        child = spawnClaude(repoPath, result.model?.id);
-        if (child.stdin) {
-            child.stdin.write(prompt);
-            child.stdin.end();
-        }
-        const stdoutPromise = child.stdout
-            ? streamToEvents(child.stdout, deps.supabase, taskId, "stdout")
-            : Promise.resolve("");
-        const stderrPromise = child.stderr
-            ? streamToEvents(child.stderr, deps.supabase, taskId, "stderr")
-            : Promise.resolve("");
-        const [outcome, capturedStdout, capturedStderr] = await Promise.all([
-            child,
-            stdoutPromise,
-            stderrPromise,
-        ]);
-        // Restore .mcp.json as soon as Claude exits — its MCP subprocess
-        // tree comes down with it, so leaving our token-bearing config on
-        // disk a moment longer is pure exposure surface.
-        if (mcpCleanup) {
-            try {
-                await mcpCleanup.restore();
-            }
-            catch (err) {
-                process.stderr.write(`[acc-runner] mcp .mcp.json restore failed: ${err.message}\n`);
-            }
+        if (error) {
+            // Best-effort: a missed signal just means the sweep might pull
+            // the task back if enough of them stack up. Log and continue.
+            process.stderr.write(`[acc-runner] update_task_signal(${taskId}) failed: ${error.message}\n`);
         }
-        // Post the cost event before any later branch returns so cap tracking
-        // captures success, cancellation, and non-zero exit alike. Best-effort:
-        // a failed POST logs to stderr but never bubbles past the runner.
-        {
-            const event = buildCostEvent(taskId, capturedStdout, result.model?.id, result.runner?.id);
+    };
+    const scheduleSignal = () => {
+        if (signalStopped)
+            return;
+        signalTimer = setTimeout(async () => {
+            if (signalStopped)
+                return;
             try {
-                await postCostEvent(event);
+                await updateSignal();
             }
-            catch (err) {
-                process.stderr.write(`[acc-runner] cost-event post failed: ${err.message}\n`);
-            }
-        }
-        if (cancelled) {
-            await appendEvent(deps.supabase, taskId, "cancelled", {
-                exit_code: outcome.exitCode,
-            });
-            return { taskId, status: "cancelled", exitCode: outcome.exitCode };
+            catch { /* logged inside */ }
+            scheduleSignal();
+        }, signalIntervalMs);
+        // Detach so an in-flight signal timer doesn't keep the process
+        // alive past `watch.ts` shutdown. The outer finally clears it
+        // anyway; this is belt-and-suspenders for stray timers.
+        if (signalTimer.unref)
+            signalTimer.unref();
+    };
+    const stopSignalLoop = () => {
+        signalStopped = true;
+        if (signalTimer) {
+            clearTimeout(signalTimer);
+            signalTimer = null;
         }
-        if (outcome.exitCode !== 0) {
+    };
+    const promise = (async () => {
+        // 1. Atomic claim + transition to running. v0.11-D: replaces the
+        //    pre-v0.6.1 raw transition_task('running') call. The RPC
+        //    row-locks acc.tasks FOR UPDATE, checks file-path overlap
+        //    against other running tasks' locks, INSERTs a lock row +
+        //    transitions to running in one transaction. On overlap or
+        //    same-task race the task stays queued for another runner.
+        const claim = await deps.supabase.rpc("claim_task_with_locks", {
+            p_task_id: taskId,
+            p_runner_id: deps.session.runnerId,
+        });
+        if (claim.error) {
+            const msg = claim.error.message;
+            // Includes 22023 (invalid_task_transition surfaced through the
+            // nested acc.transition_task call) — task may already be past
+            // 'running' (e.g. needs-review). Log and bail rather than crash.
             await appendEvent(deps.supabase, taskId, "error", {
-                phase: "claude_exit",
-                exit_code: outcome.exitCode,
-                stderr_tail: capturedStderr.slice(-2000),
+                phase: "claim_locks",
+                error: msg,
             });
-            await deps.supabase.rpc("transition_task", {
-                p_task_id: taskId,
-                p_new_status: "failed",
+            return { taskId, status: "failed", phase: "claim_locks", error: msg };
+        }
+        const claimResult = (claim.data ?? {});
+        if (claimResult.ok !== true) {
+            const conflicts = Array.isArray(claimResult.conflicts) ? claimResult.conflicts : [];
+            await appendEvent(deps.supabase, taskId, "log", {
+                phase: "claim_locks",
+                stream: "stderr",
+                conflicts,
+                message: `file-lock conflict — other tasks hold overlapping paths: ${conflicts.join(", ")}`,
+                runner_id: deps.session.runnerId,
             });
+            const reason = `file-lock conflict with: ${conflicts.join(", ") || "(unknown)"}`;
             return {
                 taskId,
                 status: "failed",
-                phase: "claude_exit",
-                exitCode: outcome.exitCode,
-                error: capturedStderr.slice(-200).trim() || `claude exited ${outcome.exitCode}`,
+                phase: "claim_locks",
+                error: reason,
             };
         }
-        // 5. Push + open PR.
+        // v0.6.1 (v0.11-D): every exit path below the successful claim
+        // must release the lock row so the same paths free up for the
+        // next runner. try/finally captures returns AND uncaught throws
+        // alike — strictly stronger than explicit pre-return release at
+        // each of the seven completion sites, and the runner CLI never
+        // recovers from a thrown error inside runTask, so the lock
+        // would otherwise leak until a future sweep job clears it.
         try {
-            await git.push(repoPath, branch);
-        }
-        catch (err) {
-            const msg = err.message;
-            await appendEvent(deps.supabase, taskId, "error", { phase: "push", error: msg });
-            await deps.supabase.rpc("transition_task", {
+            // v0.12-RESUME: prime the signal column immediately on claim so
+            // the sweep window resets from "now" and the first periodic tick
+            // (after signalIntervalMs) refreshes it. Without this prime, a
+            // task whose run takes < signalIntervalMs from claim to first
+            // tick could race the sweep on borderline updated_at values.
+            // Placed inside the outer try so an unexpected throw from the
+            // RPC still runs the finally (stop loop, release locks).
+            await updateSignal();
+            scheduleSignal();
+            // 2. Fetch task + adjacent rows.
+            const fetched = await deps.supabase.rpc("fetch_task_for_runner", {
                 p_task_id: taskId,
-                p_new_status: "failed",
             });
-            return { taskId, status: "failed", phase: "push", error: msg };
-        }
-        let prUrl = "";
-        try {
-            const body = extractReportFromOutput(capturedStdout);
-            const pr = await gh.openPR(repoPath, {
-                title: prTitleForTask(task.id, task.title),
-                body,
-                base: integrationBranch,
+            if (fetched.error || !fetched.data) {
+                const msg = fetched.error?.message ?? "fetch_task_for_runner returned no data";
+                await appendEvent(deps.supabase, taskId, "error", { phase: "fetch", error: msg });
+                await deps.supabase.rpc("transition_task", {
+                    p_task_id: taskId,
+                    p_new_status: "failed",
+                });
+                return { taskId, status: "failed", phase: "fetch", error: msg };
+            }
+            const result = fetched.data;
+            const { task } = result;
+            const branch = branchForTask(task.id, task.title, task.branch);
+            // REG-295: per-task repo overrides — task row trumps config so one
+            // runner can service tasks across multiple repos. Env-backed config
+            // remains the fallback for tasks that don't carry a hint yet.
+            const repoPath = task.repo_path_hint?.trim()
+                ? expandHomePath(task.repo_path_hint.trim())
+                : deps.cfg.repoPath;
+            const targetRepo = task.repo?.trim() || deps.cfg.targetRepo;
+            // REG-301: branch base comes from task → cfg → main. cfg.integrationBranch
+            // already defaults to "acc/integration" so the third fallback only
+            // matters when an operator zeroed it out via env.
+            const integrationBranch = task.integration_branch?.trim() || deps.cfg.integrationBranch || "main";
+            const prompt = renderTaskPrompt({
+                task,
+                agent: result.agent,
+                model: result.model,
+                integrationBranch,
+                targetRepo,
             });
-            prUrl = pr.url;
-            await appendEvent(deps.supabase, taskId, "pr-opened", { url: prUrl });
+            // v0.11-F: acquire the per-task PID lock before any worktree
+            // side-effect. Same-machine parallel runners that picked up the same
+            // task_id (e.g. two `acc-runner watch` processes seeing the same
+            // broadcast) race here; the second one bails on TaskLockHeldError.
+            let lock;
+            try {
+                lock = await acquireLock(taskId);
+            }
+            catch (err) {
+                if (err instanceof TaskLockHeldError) {
+                    await appendEvent(deps.supabase, taskId, "error", {
+                        phase: "worktree_lock",
+                        error: err.message,
+                        held_by_pid: err.heldByPid,
+                    });
+                    await deps.supabase.rpc("transition_task", {
+                        p_task_id: taskId,
+                        p_new_status: "failed",
+                    });
+                    return { taskId, status: "failed", phase: "worktree_lock", error: err.message };
+                }
+                throw err;
+            }
+            // Worktree gets assigned inside the git-prep block; cleanup in the
+            // outer finally handles both the success path and every early
+            // return that follows.
+            let worktree = null;
+            let workdir = repoPath;
+            try {
+                // 3. Repo prep. v0.11-F: fetch on the shared clone (worktree
+                // shares the object store) then provision an isolated worktree
+                // at ~/.cache/acc-runner/work/<task_id>/ forked from the
+                // integration branch. The redundant `git.checkout -B <branch>`
+                // is a no-op inside the new worktree — kept so the v0.6.0
+                // checkout seam stays observable in unit tests.
+                try {
+                    await git.fetch(repoPath);
+                    worktree = await prepareWorktree({
+                        repoPath,
+                        taskId,
+                        branch,
+                        baseBranch: integrationBranch,
+                    });
+                    workdir = worktree.path;
+                    // v0.12-RESUME: log resume-vs-fresh so an operator can audit
+                    // how often the resume path actually fires. `resumed: true`
+                    // means a prior runner crashed mid-task, the v0.12 sweep
+                    // returned the task to queued, and this runner picked it
+                    // back up with the prior worktree intact. Claude reads the
+                    // partially-committed state and continues; the spawn is the
+                    // same prompt either way (Claude is idempotent enough that
+                    // re-running on a partially-edited worktree converges on
+                    // the right final state).
+                    if (worktree.resumed) {
+                        await appendEvent(deps.supabase, taskId, "log", {
+                            phase: "git",
+                            stream: "stdout",
+                            event: "worktree.resumed",
+                            worktree_path: workdir,
+                            branch,
+                            runner_id: deps.session.runnerId,
+                        });
+                    }
+                    await git.checkout(workdir, branch);
+                }
+                catch (err) {
+                    const msg = err.message;
+                    await appendEvent(deps.supabase, taskId, "error", {
+                        phase: "git",
+                        error: msg,
+                        base: integrationBranch,
+                        branch,
+                        repo_path: repoPath,
+                        worktree_path: worktree?.path ?? null,
+                    });
+                    await deps.supabase.rpc("transition_task", {
+                        p_task_id: taskId,
+                        p_new_status: "failed",
+                    });
+                    return { taskId, status: "failed", phase: "git", error: msg };
+                }
+                // 4. Spawn Claude.
+                if (cancelled) {
+                    return { taskId, status: "cancelled" };
+                }
+                // 4a. Provision .mcp.json so Claude Code auto-discovers acc-mcp-server.
+                // Best-effort: a failed write must not block the task. The MCP server
+                // is a context source, not a critical dependency for v0.5-C1.
+                let mcpCleanup = null;
+                if (deps.session) {
+                    const writer = deps.writeMcpConfig ?? defaultWriteMcpConfig;
+                    try {
+                        mcpCleanup = await writer({
+                            cwd: workdir,
+                            taskId,
+                            runnerId: deps.session.runnerId,
+                            accessToken: deps.session.accessToken,
+                            publicUrl: deps.publicUrl ?? deps.cfg.publicUrl,
+                            supabaseUrl: deps.cfg.supabaseUrl,
+                            supabaseAnonKey: deps.cfg.supabaseAnonKey,
+                        });
+                    }
+                    catch (err) {
+                        // Don't echo the token even on failure.
+                        process.stderr.write(`[acc-runner] mcp .mcp.json write failed: ${err.message}\n`);
+                    }
+                }
+                // v0.12-MODEL-ALIAS (REG-303/304): translate the ACC model alias
+                // (`claude-sonnet-4`) into the wire form `claude --model` actually
+                // accepts (`sonnet` or `claude-sonnet-4-6`). Unknown ids pass
+                // through verbatim so a future model not yet in the embedded
+                // table still spawns.
+                child = spawnClaude(workdir, toCliAlias(result.model?.id));
+                if (child.stdin) {
+                    child.stdin.write(prompt);
+                    child.stdin.end();
+                }
+                const stdoutPromise = child.stdout
+                    ? streamToEvents(child.stdout, deps.supabase, taskId, "stdout")
+                    : Promise.resolve("");
+                const stderrPromise = child.stderr
+                    ? streamToEvents(child.stderr, deps.supabase, taskId, "stderr")
+                    : Promise.resolve("");
+                const [outcome, capturedStdout, capturedStderr] = await Promise.all([
+                    child,
+                    stdoutPromise,
+                    stderrPromise,
+                ]);
+                // Restore .mcp.json as soon as Claude exits — its MCP subprocess
+                // tree comes down with it, so leaving our token-bearing config on
+                // disk a moment longer is pure exposure surface.
+                if (mcpCleanup) {
+                    try {
+                        await mcpCleanup.restore();
+                    }
+                    catch (err) {
+                        process.stderr.write(`[acc-runner] mcp .mcp.json restore failed: ${err.message}\n`);
+                    }
+                }
+                // Post the cost event before any later branch returns so cap tracking
+                // captures success, cancellation, and non-zero exit alike. Best-effort:
+                // a failed POST logs to stderr but never bubbles past the runner.
+                {
+                    const event = buildCostEvent(taskId, capturedStdout, result.model?.id, result.runner?.id);
+                    try {
+                        await postCostEvent(event);
+                    }
+                    catch (err) {
+                        process.stderr.write(`[acc-runner] cost-event post failed: ${err.message}\n`);
+                    }
+                }
+                if (cancelled) {
+                    await appendEvent(deps.supabase, taskId, "cancelled", {
+                        exit_code: outcome.exitCode,
+                    });
+                    return { taskId, status: "cancelled", exitCode: outcome.exitCode };
+                }
+                if (outcome.exitCode !== 0) {
+                    await appendEvent(deps.supabase, taskId, "error", {
+                        phase: "claude_exit",
+                        exit_code: outcome.exitCode,
+                        stderr_tail: capturedStderr.slice(-2000),
+                    });
+                    await deps.supabase.rpc("transition_task", {
+                        p_task_id: taskId,
+                        p_new_status: "failed",
+                    });
+                    return {
+                        taskId,
+                        status: "failed",
+                        phase: "claude_exit",
+                        exitCode: outcome.exitCode,
+                        error: capturedStderr.slice(-200).trim() || `claude exited ${outcome.exitCode}`,
+                    };
+                }
+                // 5. Push + open PR. Both run from the worktree so the operator's
+                // shared clone never has the task branch checked out.
+                try {
+                    await git.push(workdir, branch);
+                }
+                catch (err) {
+                    const msg = err.message;
+                    await appendEvent(deps.supabase, taskId, "error", { phase: "push", error: msg });
+                    await deps.supabase.rpc("transition_task", {
+                        p_task_id: taskId,
+                        p_new_status: "failed",
+                    });
+                    return { taskId, status: "failed", phase: "push", error: msg };
+                }
+                let prUrl = "";
+                try {
+                    const body = extractReportFromOutput(capturedStdout);
+                    const pr = await gh.openPR(workdir, {
+                        title: prTitleForTask(task.id, task.title),
+                        body,
+                        base: integrationBranch,
+                    });
+                    prUrl = pr.url;
+                    await appendEvent(deps.supabase, taskId, "pr-opened", { url: prUrl });
+                }
+                catch (err) {
+                    const msg = err.message;
+                    await appendEvent(deps.supabase, taskId, "error", { phase: "pr_open", error: msg });
+                    // Don't transition to failed — the push succeeded, the user can
+                    // open a PR manually. Webhook will pick it up.
+                }
+                return { taskId, status: "ok", prUrl, exitCode: 0 };
+            }
+            finally {
+                // v0.11-F: tear down the per-task worktree and release the PID
+                // lock on every completion path (success, failure, cancellation,
+                // unexpected throw). Both legs are best-effort — leaking either
+                // resource is preferable to masking the original return value.
+                if (worktree) {
+                    try {
+                        await worktree.cleanup();
+                    }
+                    catch (err) {
+                        process.stderr.write(`[acc-runner] worktree cleanup failed: ${err.message}\n`);
+                    }
+                }
+                try {
+                    await lock.release();
+                }
+                catch (err) {
+                    process.stderr.write(`[acc-runner] lock release failed: ${err.message}\n`);
+                }
+            }
         }
-        catch (err) {
-            const msg = err.message;
-            await appendEvent(deps.supabase, taskId, "error", { phase: "pr_open", error: msg });
-            // Don't transition to failed — the push succeeded, the user can
-            // open a PR manually. Webhook will pick it up.
+        finally {
+            // v0.12-RESUME: stop the periodic signal loop before releasing
+            // locks so a late-firing signal can't bump the column after the
+            // task transitions to a terminal status (the RPC is no-op on
+            // non-running rows anyway, but stopping early avoids the extra
+            // RPC round-trip).
+            stopSignalLoop();
+            await releaseLocks();
         }
-        return { taskId, status: "ok", prUrl, exitCode: 0 };
     })();
     return {
         taskId,