@ultimat3/jobs 30.3.0 → 30.5.0

package/CLAUDE.md

@@ -122,7 +122,7 @@ Tier 3. The `job` + `task` primitives, durable steps, transactional outbox, queu
   `backoffDelayMs`): `docs/history/jobs.md`, "Moved 2026-10-01 — retry and bounds".
 - **The claim loop re-arms on the PASS, never the jobs**; `tick()` resolves with that pass's executions.
 - **A deadline CANCELS, then fails the attempt**, never the reverse (`raceTimeout`, `withStepTimeout`);
-  the attempt is cancelled in `executeJob`'s `finally`.
+  `ctx.signal` aborts unless the body completed AND its ack landed; steps fence on `ended`.
 - **A cancelled runner writes NOTHING** — `put()` in `steps.ts` (`X_ABORTED`) — save a fenced
   `X_DRAINING` on a live attempt: a step done in the drain is recorded once. The STORE fences
   the claim (`StepFence`, `SQL_STEP_PUT` as `SQL_ACK`: `X_JOB_LEASE_LOST`). `executeJob` passes it.
@@ -143,13 +143,12 @@ Tier 3. The `job` + `task` primitives, durable steps, transactional outbox, queu
 - **`step.run` hydrates the run's steps from ONE `store.list(runId)`**; `sleep` and `waitForEvent`
   record replays through `trace()`. **`claimName` reads a Set**; `usedNames()` keeps
   `MAX_TRACE_NAMES` (200).
-- **`x jobs cancel` binds to `cancelJob(driver, id, reason?)`, which refuses** a finished job or a
-  driver with no `cancel` (`X_JOB_NOT_CANCELLABLE`).
 
 ## Rules — long form in `docs/history/jobs.md`
 
 - "Moved out 2026-11-03": operator verbs on BOTH drivers; an idle round touches no store.
 - "Moved out 2026-11-06": `demand` with no worker registry; how the claim seeks.
+- "Moved out 2026-11-07": `cancelJob`'s refusals; why a completed attempt's signal stays live.
 - "Plan 101 wave 6c": compensate ONLY failed for good; `once` writes `started` BEFORE `fn`; a
   waking publish is ONE statement; payload org = enqueue org (`X_JOB_TENANT_MISMATCH`).
 
@@ -213,8 +212,8 @@ Long form: [`docs/history/jobs.md`](../../docs/history/jobs.md), "Moved 2026-10-
 | `consumer.ts` / `consumer-loop.ts` / `consumer-types.ts` | `consumer()` — a job + `.supervisor` task; one run's turns; the shapes |
 | `consumer-registry.ts` / `consumer-guard.ts` / `consumer-errors.ts` | the `origin` stamp + `registeredConsumers`; the self-enqueue refusal; `X_CONSUMER_*` |
 | `register.ts` | `registerJobs`/`registerTasks` over a module namespace + the registrar announcements; an `action-job` projection is `X_ACTION_JOB_UNBRIDGED` |
-| `describe.ts` | the JSON projection one handle emits; `describeJobs()` is a map over it |
-| `steps.ts` / `-core.ts` / `-wait.ts` / `-unwind.ts` | replay runner; shared core; `waitForEvent`; compensation |
+| `describe.ts` | one handle's JSON projection; `describeJobs()` maps it |
+| `steps.ts` / `-core.ts` / `-wait.ts` / `-unwind.ts` / `step-scope.ts` | replay runner; core; `waitForEvent`; compensation; `currentStep()` |
 | `steps-timeout.ts` / `steps-suspension.ts` | a step's ceiling; `StepSuspension`, `UnwindReached`, timeout marker |
 | `steps-api.ts` / `steps-store.ts` / `steps-output.ts` | `StepApi`, `EventLookup`; `StepRecord`, `StepFence`, `StepStore`; what a step answers, `StepOutput` and `jsonForm` |
 | `type-pins.ts` | compile-time pins for `StepOutput` and `waitForEvent` |
@@ -238,7 +237,7 @@ Long form: [`docs/history/jobs.md`](../../docs/history/jobs.md), "Moved 2026-10-
 | `retry.ts` | the dead-letter decision, and this package's option names over core's `backoffDelay` — no curve of its own |
 | `retry-classification.ts` | the other half: what the thrown error says, and the stop reason |
 | `execute-unwind.ts` / `execute-ctx.ts` | a saga failed for good; caller ctx |
-| `execute.ts` / `run-deadline.ts` | `executeJob` — one claimed job run and settled; the run's deadline: cancel, then fail |
+| `execute.ts` (+`-result.ts`) / `run-deadline.ts` | `executeJob`: one claimed job run and settled; its deadline: cancel, then fail |
 | `heartbeat.ts` | one claimed job's lease: the renewal interval and the loss it reports |
 | `renewal-timer.ts` | the renewal interval and its `stopped()` latch |
 | `worker.ts` | `worker` role, claim round, drain |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/jobs",
-  "version": "30.3.0",
+  "version": "30.5.0",
   "description": "Durable background work: steps, transactional outbox, cron tasks, one driver interface",
   "keywords": [
     "ultimate",
@@ -44,11 +44,11 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/core": "30.3.0",
-    "@ultimat3/db": "30.3.0",
-    "@ultimat3/entity": "30.3.0",
-    "@ultimat3/http": "30.3.0",
-    "@ultimat3/schema": "30.3.0",
-    "@ultimat3/time": "30.3.0"
+    "@ultimat3/core": "30.5.0",
+    "@ultimat3/db": "30.5.0",
+    "@ultimat3/entity": "30.5.0",
+    "@ultimat3/http": "30.5.0",
+    "@ultimat3/schema": "30.5.0",
+    "@ultimat3/time": "30.5.0"
   }
 }

package/src/errors.ts

@@ -129,14 +129,20 @@ export class JobTimeoutError extends UltimateError {
  * the work inside it stops with.
  */
 export class JobAbortedError extends UltimateError {
-  constructor(input: { job: string; step?: string }) {
+  /** `ended`: the attempt FINISHED — it was not cancelled — and a step it never awaited came late. */
+  constructor(input: { job: string; step?: string; ended?: boolean }) {
     super({
       code: 'X_ABORTED',
       cause:
         input.step === undefined
           ? `job "${input.job}" was cancelled — this attempt no longer owns the run`
-          : `job "${input.job}" was cancelled before step "${input.step}" could be recorded`,
-      fix: 'add throwIfAborted(ctx) before expensive work, or pass fetch(url, { signal: ctx.signal }) — the queue re-runs the job, so stop at the deadline instead of running past it',
+          : input.ended === true
+            ? `job "${input.job}"'s attempt had already ended when step "${input.step}" finished — run() returned without awaiting it`
+            : `job "${input.job}" was cancelled before step "${input.step}" could be recorded`,
+      fix:
+        input.ended === true
+          ? `await step.run('${input.step ?? '<name>'}', fn) inside run(); work meant to outlive the attempt (a flush, a deferred enqueue): runToCompletion(() => work) from @ultimat3/core`
+          : 'add throwIfAborted(ctx) before expensive work, or pass fetch(url, { signal: ctx.signal }) — the queue re-runs the job, so stop at the deadline instead of running past it; work meant to outlive the attempt: runToCompletion(() => work) from @ultimat3/core',
     });
   }
 }

package/src/execute-result.ts

@@ -0,0 +1,43 @@
+// What one attempt of `executeJob` answers: how it ended and what it left behind. Its own file so
+// the worker, the metrics and the tally read the result's shape without the execution path.
+
+import type { JobStopReason } from './retry-classification';
+import type { StepRecord } from './steps';
+
+/**
+ * How one attempt ended. `interrupted` is the worker's drain cutting the attempt short: the job is
+ * back in the ready bucket with the attempt UNCOUNTED, because the process ended it and not the
+ * job — filed as `retried`, a deploy would burn an attempt per job it held, and with
+ * `attempts: 1` dead-letter it. `dropped` is a run that failed for good on a job declaring
+ * `retry.deadLetter: false`: the row is `failed`, where it used to go back `ready` and run
+ * forever. `refused` is `whenBusy: 'fail'` over a busy concurrency key: the
+ * row is `failed`, the body never ran, and it is neither a retry nor a dead letter
+ * (`worker-key-busy.ts`).
+ */
+export type JobOutcome =
+  | 'completed'
+  | 'suspended'
+  | 'retried'
+  | 'dead-lettered'
+  | 'dropped'
+  | 'interrupted'
+  | 'refused';
+
+export interface JobExecution {
+  readonly outcome: JobOutcome;
+  readonly jobId: string;
+  readonly job: string;
+  readonly attempt: number;
+  readonly durationMs: number;
+  /** Epoch ms the row is claimable again: a suspension's wake, or a retry's backoff ending. */
+  readonly resumeAt?: number;
+  readonly error?: string;
+  /** The stable `X_*` code the attempt's error carried — absent for an uncoded throw. */
+  readonly code?: string;
+  /** Why this attempt was the last. Absent while the job is still being retried. */
+  readonly stopReason?: JobStopReason;
+  /** What the body returned — present exactly on `completed`, for a caller driving a run by hand. */
+  readonly result?: unknown;
+  readonly steps: readonly StepRecord[];
+  readonly replayed: readonly string[];
+}

package/src/execute-unwind.ts

@@ -14,7 +14,7 @@ import {
 import { nowMs } from './clock';
 import type { ClaimedJob, JobDriver, SettleBy } from './driver';
 import { LEASE_LAPSED_FINAL_ATTEMPT } from './driver';
-import type { JobExecution, JobOutcome } from './execute';
+import type { JobExecution, JobOutcome } from './execute-result';
 import type { AnyJobHandle } from './job';
 import { backoffDelayMs, isFinalUnwindAttempt } from './retry';
 import type { JobStopReason } from './retry-classification';
@@ -50,7 +50,13 @@ export interface UnwindSettleOptions {
   readonly drained: () => boolean;
 }
 
-type Ending = Pick<JobExecution, 'error' | 'resumeAt' | 'stopReason'>;
+type Ending = Pick<JobExecution, 'error' | 'code' | 'resumeAt' | 'stopReason'>;
+
+/** The execution's `code`, when the thrown value carried one. */
+const codeOf = (thrown: unknown): Pick<JobExecution, 'code'> => {
+  const code = settledCode(thrown);
+  return code === undefined ? {} : { code };
+};
 
 /** The execution this attempt answers, and `onSettled` after a settle that landed. */
 function endings(options: UnwindSettleOptions) {
@@ -154,7 +160,7 @@ export async function unwindAndSettle(
       scope: { operation: handle.name, extra: { jobId: claimed.id, runId: claimed.runId } },
     });
     if (settled) await announce(settledAs, recorded, settledCode(thrown));
-    return finish(settledAs, { error: message, stopReason: 'terminal' });
+    return finish(settledAs, { error: message, ...codeOf(thrown), stopReason: 'terminal' });
   }
 
   const stack = failure === undefined ? undefined : failureStack(failure.thrown);
@@ -186,6 +192,7 @@ export async function unwindAndSettle(
   if (settled) await announce(settledAs, original, settledCode(failure?.thrown));
   return finish(settledAs, {
     error: original,
+    ...codeOf(failure?.thrown),
     stopReason: failure?.stop ?? 'attempts-exhausted',
   });
 }

package/src/execute.ts

@@ -22,12 +22,12 @@ import { claimOf } from './driver';
 import { JobAbortedError } from './errors';
 import { eventBus } from './events';
 import { callerActor, callerServices, callerSignal, drainedBy } from './execute-ctx';
+import type { JobExecution } from './execute-result';
 import type { UnwindSettleOptions } from './execute-unwind';
 import { unwindAndSettle } from './execute-unwind';
 import type { AnyJobHandle } from './job';
 import { createProgressReporter } from './progress';
 import { isFinalAttempt, isUnwindAttempt } from './retry';
-import type { JobStopReason } from './retry-classification';
 import {
   failureForRow,
   nextRetryForError,
@@ -37,47 +37,11 @@ import {
 import { raceTimeout } from './run-deadline';
 import { createRunSignal } from './run-signal';
 import { announceSettled, settledCode } from './settled';
-import type { EventLookup, StepRecord } from './steps';
+import type { EventLookup } from './steps';
 import { isStepSuspension, stepRunner } from './steps';
 import { isUnwindReached } from './steps-suspension';
 import { jobRunActor, refuseRunTenant } from './tenant';
 
-/**
- * How one attempt ended. `interrupted` is the worker's drain cutting the attempt short: the job is
- * back in the ready bucket with the attempt UNCOUNTED, because the process ended it and not the
- * job — filed as `retried`, a deploy would burn an attempt per job it held, and with
- * `attempts: 1` dead-letter it. `dropped` is a run that failed for good on a job declaring
- * `retry.deadLetter: false`: the row is `failed`, where it used to go back `ready` and run
- * forever. `refused` is `whenBusy: 'fail'` over a busy concurrency key: the
- * row is `failed`, the body never ran, and it is neither a retry nor a dead letter
- * (`worker-key-busy.ts`).
- */
-export type JobOutcome =
-  | 'completed'
-  | 'suspended'
-  | 'retried'
-  | 'dead-lettered'
-  | 'dropped'
-  | 'interrupted'
-  | 'refused';
-
-export interface JobExecution {
-  readonly outcome: JobOutcome;
-  readonly jobId: string;
-  readonly job: string;
-  readonly attempt: number;
-  readonly durationMs: number;
-  /** Epoch ms the row is claimable again: a suspension's wake, or a retry's backoff ending. */
-  readonly resumeAt?: number;
-  readonly error?: string;
-  /** Why this attempt was the last. Absent while the job is still being retried. */
-  readonly stopReason?: JobStopReason;
-  /** What the body returned — present exactly on `completed`, for a caller driving a run by hand. */
-  readonly result?: unknown;
-  readonly steps: readonly StepRecord[];
-  readonly replayed: readonly string[];
-}
-
 export interface ExecuteJobOptions {
   readonly driver: JobDriver;
   readonly claimed: ClaimedJob;
@@ -106,6 +70,13 @@ export async function executeJob(options: ExecuteJobOptions): Promise<JobExecuti
   // where every other body does, with no jobs-only parameter to know about. Composed with the
   // caller's signal rather than replacing it: a ctx that was already going away still is.
   const cancel = new AbortController();
+  // The attempt's END, apart from its cancellation: aborted in the `finally` however the attempt
+  // ended, so the step runner records nothing after it. `cancel` — what `ctx.signal` follows — is
+  // aborted only when another attempt may own the run: a failure, a suspension, an ack that did
+  // not land. A body that COMPLETED and was acked owns a finished run, and a timer it armed (a log
+  // flush, a deferred enqueue) still writes; reading as "cancelled" lost every such write.
+  const ended = new AbortController();
+  let completed = false;
   // `createRunSignal` and never `AbortSignal.any` — the second of the two sites this package's
   // `CLAUDE.md` states the rule as absolute for. In the worker path `callerSignal` is per-run and
   // nothing leaks; on `@ultimat3/testing`'s job-fixture path, which calls `executeJob` directly,
@@ -114,6 +85,15 @@ export async function executeJob(options: ExecuteJobOptions): Promise<JobExecuti
   // `finally` at the bottom of the try, beside `cancel.abort`.
   const runSignal = createRunSignal([callerSignal(options.ctx), cancel.signal]);
   const signal = runSignal.signal;
+  /**
+   * This attempt no longer owns the run: `ctx.signal` aborts, so a write still under it is refused
+   * (`abandonment()`). A second `abort()` keeps the first reason — a timed-out run still reports
+   * the timeout. `dispose` AFTER it: it stops following the sources and never aborts.
+   */
+  const release = (): void => {
+    cancel.abort(new JobAbortedError({ job: handle.name }));
+    runSignal.dispose();
+  };
   const ctx: Ctx = Object.freeze({
     ...options.ctx,
     signal,
@@ -127,7 +107,7 @@ export async function executeJob(options: ExecuteJobOptions): Promise<JobExecuti
     signal,
     // This attempt's OWN end — the deadline, the `finally` below — apart from the run's signal,
     // whose first reason may be the drain's: a drained step still records, an ended attempt never.
-    ended: cancel.signal,
+    ended: ended.signal,
     // The DECLARED per-step ceiling and event poll. Passed here or nowhere: this is the only
     // production construction of a runner, so a `StepRunnerOptions` field it omits is a feature
     // no `job()` can reach — which both of these were until 2026-08.
@@ -261,6 +241,7 @@ export async function executeJob(options: ExecuteJobOptions): Promise<JobExecuti
     if (handle.compensates && (await runner.unwinding())) {
       return await unwindAndSettle(unwinder(), undefined);
     }
+    completed = true;
   } catch (error) {
     // Before ANY settle: the last value a body reported is written while the row is still this
     // worker's, which is the only time `recordProgress`'s fence lets it land.
@@ -287,6 +268,10 @@ export async function executeJob(options: ExecuteJobOptions): Promise<JobExecuti
     }
 
     const message = renderThrowable(error);
+    // The code beside the message: a caller judging the failure (`x exercise`) reads a coded
+    // refusal by its code, as it reads an action's, and the message alone had lost it.
+    const thrownCode = settledCode(error);
+    const coded = thrownCode === undefined ? {} : { code: thrownCode };
     // Unwinding already: the replay stopped at its first incomplete step (`UnwindReached`) or
     // ended any other way. Never retried forward — a drain still hands the attempt back.
     if (
@@ -327,6 +312,7 @@ export async function executeJob(options: ExecuteJobOptions): Promise<JobExecuti
         attempt: claimed.attempt,
         durationMs: nowMs(options.clock) - startedAt,
         error: message,
+        ...coded,
         steps: [],
         replayed: [],
       });
@@ -359,6 +345,7 @@ export async function executeJob(options: ExecuteJobOptions): Promise<JobExecuti
         attempt: claimed.attempt,
         durationMs: nowMs(options.clock) - startedAt,
         error: message,
+        ...coded,
         resumeAt: nowMs(options.clock) + deferMs,
         steps: [],
         replayed: [],
@@ -445,6 +432,7 @@ export async function executeJob(options: ExecuteJobOptions): Promise<JobExecuti
       attempt: claimed.attempt,
       durationMs: nowMs(options.clock) - startedAt,
       error: message,
+      ...coded,
       // When the retry falls due, on this process's clock — what lets the worker that failed it
       // pass again at that moment instead of finding out on a backed-off poll.
       ...(decision.retry ? { resumeAt: nowMs(options.clock) + decision.delayMs } : {}),
@@ -453,14 +441,11 @@ export async function executeJob(options: ExecuteJobOptions): Promise<JobExecuti
       replayed: [],
     });
   } finally {
-    // The attempt is over however it ended, so nothing from it may still be writing: a step left
-    // in flight by a handler that returned without awaiting it settles into a run the next
-    // attempt already owns. The runner fences its writes on this signal. A second `abort()` keeps
-    // the first reason, so a timed-out run still reports the timeout, not this.
-    cancel.abort(new JobAbortedError({ job: handle.name }));
-    // AFTER the abort, so the runner's fence still sees it: `dispose` stops following the sources,
-    // it never aborts, and the signal keeps whatever state the abort above left it in.
-    runSignal.dispose();
+    // The attempt is over however it ended, so no step from it may still record: a step left in
+    // flight by a handler that returned without awaiting it would settle into a run the next
+    // attempt may own. The runner fences its writes on `ended`.
+    ended.abort(new JobAbortedError({ job: handle.name }));
+    if (!completed) release();
   }
 
   // Only reachable when the BODY succeeded, and settlement is deliberately outside the catch
@@ -470,9 +455,19 @@ export async function executeJob(options: ExecuteJobOptions): Promise<JobExecuti
   // Let it reach the worker instead, which logs `jobs.worker.settle-failed`; the lease then
   // lapses and the queue re-delivers, which is the honest outcome for "we could not say it ended".
   await progress.flush();
+  let acked = false;
+  try {
+    acked = landed(await driver.ack(claimed.id, by()), 'completed');
+  } finally {
+    // Unacked, the row is another worker's (or re-delivered once the lease lapses): cancelled.
+    if (!acked) release();
+    // Acked, the run is finished and owned by nobody: the signal stops following its sources and
+    // stays un-aborted, so work the body deliberately left running keeps landing.
+    else runSignal.dispose();
+  }
   // Announced only when the ack LANDED: a row cancelled or re-delivered under this body is
   // somebody else's to settle, and `completed` would be a claim about a row that is not `done`.
-  if (landed(await driver.ack(claimed.id, by()), 'completed')) {
+  if (acked) {
     await announceSettled({
       handle,
       claimed,

package/src/index.ts

@@ -205,8 +205,9 @@ export {
 } from './events';
 export type { PostgresEventBusOptions } from './events-pg';
 export { postgresEventBus } from './events-pg';
-export type { ExecuteJobOptions, JobExecution, JobOutcome } from './execute';
+export type { ExecuteJobOptions } from './execute';
 export { executeJob } from './execute';
+export type { JobExecution, JobOutcome } from './execute-result';
 export type { ExportDefinition, ExportReport } from './export';
 export { DEFAULT_EXPORT_BATCH, DEFAULT_EXPORT_MAX_PART_BYTES, exportRows } from './export';
 export { ExportPartTooLargeError, ExportRowInvalidError } from './export-errors';
@@ -301,7 +302,15 @@ export type {
   JobHandle,
   JobRunArgs,
 } from './job';
-export { describeJobs, getJob, isJobHandle, job, registeredJobs, resetJobs } from './job';
+export {
+  describeJobs,
+  getJob,
+  isJobHandle,
+  job,
+  registeredJobs,
+  resetJobs,
+  restoreJobs,
+} from './job';
 export type { EnqueueManyOptions } from './job-enqueue-many';
 export { MAX_ENQUEUE_BATCH } from './job-enqueue-many';
 export type { JobsRetentionOptions } from './jobs-retention';
@@ -421,6 +430,7 @@ export type { ScheduledFire, SchedulerState } from './scheduler-state';
 export { fireThroughDriver, memorySchedulerState } from './scheduler-state';
 export type { JobCompleted, JobFailed, JobSettled } from './settled';
 export { ON_SETTLED_ATTEMPTS, ON_SETTLED_TIMEOUT_MS } from './settled';
+export { currentStep } from './step-scope';
 export type {
   CompensateContext,
   EventLookup,

package/src/job.ts

@@ -278,6 +278,16 @@ export function resetJobs(): void {
   registry.clear();
 }
 
+/**
+ * Put the registry back to exactly `handles` — `restoreTasks`' twin. `job()` registers at module
+ * scope, once per `bun test` process, so a test whose premise is "only these jobs" (`x exercise`
+ * over a fixture) empties the registry and hands every inherited handle back after it.
+ */
+export function restoreJobs(handles: readonly AnyJobHandle[]): void {
+  registry.clear();
+  for (const handle of handles) registry.set(handle.name, handle);
+}
+
 /**
  * Registered jobs as the manifest, the `/_x` jobs panel and the MCP dev server need them.
  * Name-sorted because `x.manifest.json` is committed and diffed — an iteration-order-dependent

package/src/metrics.ts

@@ -14,7 +14,7 @@
 
 import type { Gauge } from '@ultimat3/core';
 import { gauge } from '@ultimat3/core';
-import type { JobOutcome } from './execute';
+import type { JobOutcome } from './execute-result';
 
 /**
  * `JobOutcome` -> the `jobs_total` label, and `null` for the outcomes that are not one. `suspended`

package/src/step-scope.ts

@@ -0,0 +1,13 @@
+// Which durable step's body is running, ambient across its awaits. Read by an observer that must
+// tell an effect made INSIDE a step (rerun when the step did not complete) from one made between
+// steps (rerun on every replay): `@ultimat3/testing`'s crash proof names the step it ran in.
+
+import { asyncContext } from '@ultimat3/core';
+
+const scope = asyncContext<string>('a durable step body');
+
+/** Run one step body with its name in flight. `steps.ts` is the one caller. */
+export const inStep = <T>(name: string, body: () => T): T => scope.run(name, body);
+
+/** The name of the step whose body is running here, or `undefined` outside every step body. */
+export const currentStep = (): string | undefined => scope.get();

package/src/steps.ts

@@ -21,6 +21,7 @@ import {
   UNWINDING_STEP,
 } from './errors-saga';
 import { createRunSignal } from './run-signal';
+import { inStep } from './step-scope';
 import type { EventLookup, StepApi, StepRunOptions } from './steps-api';
 import { DEFAULT_EVENT_POLL_MS, WAKING_EVENT_POLL_MS } from './steps-api';
 import type { RunnerCore } from './steps-core';
@@ -209,7 +210,9 @@ export function stepRunner(options: StepRunnerOptions): StepRunner {
     return occurrence === 1 ? base : `${base}#${occurrence}`;
   };
 
-  const cancelled = (): boolean => runSignal.aborted;
+  // The run cancelled, or this attempt over — `ended` also covers one that COMPLETED, whose
+  // `ctx.signal` stays un-aborted on purpose (`execute.ts`).
+  const cancelled = (): boolean => runSignal.aborted || options.ended?.aborted === true;
 
   /**
    * A cancelled run whose step result is still this attempt's to record: the worker's drain cut
@@ -247,7 +250,11 @@ export function stepRunner(options: StepRunnerOptions): StepRunner {
    */
   const put = async (record: StepRecord): Promise<void> => {
     if (cancelled() && !writesThrough()) {
-      throw new JobAbortedError({ job: jobName, step: record.name });
+      throw new JobAbortedError({
+        job: jobName,
+        step: record.name,
+        ...(runSignal.aborted ? {} : { ended: true }),
+      });
     }
     await persist(record);
     remember(record);
@@ -291,7 +298,7 @@ export function stepRunner(options: StepRunnerOptions): StepRunner {
     const signal = composed?.signal ?? runSignal;
     try {
       const output = await withStepTimeout(
-        fn(signal),
+        inStep(name, () => fn(signal)),
         stepTimeoutMs,
         deadline,
         () =>

package/src/worker-admit.ts

@@ -7,7 +7,7 @@ import type { Clock, Ctx } from '@ultimat3/core';
 import { logger } from '@ultimat3/core';
 import type { ClaimedJob, JobDriver } from './driver';
 import { claimOf } from './driver';
-import type { JobExecution } from './execute';
+import type { JobExecution } from './execute-result';
 import type { Lease, Limiter } from './limits';
 import type { FleetSlots, SlotGrant } from './worker-fleet-slots';
 import { handBack } from './worker-hand-back';

package/src/worker-key-busy.ts

@@ -9,7 +9,7 @@ import { nowMs } from './clock';
 import type { ClaimedJob, JobDriver } from './driver';
 import { claimOf } from './driver';
 import { JobKeyBusyError } from './errors-concurrency';
-import type { JobExecution } from './execute';
+import type { JobExecution } from './execute-result';
 import { getJob } from './job';
 import { failureForRow } from './retry-classification';
 import { announceSettled } from './settled';

package/src/worker-run.ts

@@ -8,8 +8,8 @@ import { parseTraceparent, withSpan } from '@ultimat3/core';
 import type { ClaimedJob, JobDriver } from './driver';
 import { claimOf } from './driver';
 import { JobSlotLostError } from './errors';
-import type { JobExecution } from './execute';
 import { executeJob } from './execute';
+import type { JobExecution } from './execute-result';
 import { startLeaseHeartbeat } from './heartbeat';
 import { getJob } from './job';
 import type { IntervalScheduler } from './renewal-timer';

package/src/worker-tally.ts

@@ -1,7 +1,7 @@
 // What one worker has settled, by outcome — the counters `stats()` reports. Split from `worker.ts`
 // at the file-size ceiling; the claim loop counts, this file says what each count means.
 
-import type { JobExecution } from './execute';
+import type { JobExecution } from './execute-result';
 import type { WorkerStats } from './worker-types';
 
 export type WorkerTallies = Pick<

package/src/worker-types.ts

@@ -4,7 +4,7 @@
 
 import type { Clock, Ctx } from '@ultimat3/core';
 import type { JobDriver, QueueStats } from './driver';
-import type { JobExecution } from './execute';
+import type { JobExecution } from './execute-result';
 import type { Limiter } from './limits';
 import type { IntervalScheduler } from './renewal-timer';
 import type { EventLookup } from './steps';

package/src/worker.ts

@@ -18,7 +18,7 @@ import { nowMs } from './clock';
 import { createDrainBudget, settleAllBy } from './drain-wait';
 import type { ClaimedJob, JobRecord } from './driver';
 import { DEFAULT_QUEUE } from './driver';
-import type { JobExecution } from './execute';
+import type { JobExecution } from './execute-result';
 import { registeredJobs } from './job';
 import { concurrencyLimiter } from './limits';
 import { JOB_OUTCOME_LABELS } from './metrics';