@ultimat3/jobs 9.0.0 → 10.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/jobs",
-  "version": "9.0.0",
+  "version": "10.0.0",
   "description": "Durable background work: steps, transactional outbox, cron tasks, one driver interface",
   "license": "MIT",
   "type": "module",
@@ -32,9 +32,9 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/core": "9.0.0",
-    "@ultimat3/entity": "9.0.0",
-    "@ultimat3/schema": "9.0.0",
-    "@ultimat3/time": "9.0.0"
+    "@ultimat3/core": "10.0.0",
+    "@ultimat3/entity": "10.0.0",
+    "@ultimat3/schema": "10.0.0",
+    "@ultimat3/time": "10.0.0"
   }
 }

package/src/backfill-errors.ts

@@ -6,7 +6,6 @@
 // `backfill-pending.ts` and `backfill-registry.ts`.
 
 import { UltimateError } from '@ultimat3/core';
-import { docsFor } from './errors';
 
 /**
  * The seven backfill codes below all answer one question — "why is this sweep not running?" — and
@@ -31,7 +30,6 @@ export class BackfillPendingError extends UltimateError {
       code: 'X_BACKFILL_PENDING',
       cause: `backfill "${input.backfill}" is declared and x_backfills holds no completed pass for it in ${input.environment}`,
       fix: `x db backfill ${input.backfill} --write --json`,
-      docs: docsFor('X_BACKFILL_PENDING'),
     });
   }
 }
@@ -43,7 +41,6 @@ export class BackfillAppliedError extends UltimateError {
       code: 'X_BACKFILL_APPLIED',
       cause: `backfill "${input.backfill}" completed as run ${input.runId} at ${input.completedAt}; a forced rerun writes a NEW ledger row and never edits that one`,
       fix: `x db backfill ${input.backfill} --write --force --json`,
-      docs: docsFor('X_BACKFILL_APPLIED'),
     });
   }
 }
@@ -68,7 +65,6 @@ export class BackfillEnvironmentError extends UltimateError {
         target === undefined
           ? 'x db backfill --pending --json'
           : `ULTIMATE_ENV=${target} x db backfill ${input.backfill} --write --json`,
-      docs: docsFor('X_BACKFILL_ENVIRONMENT'),
     });
   }
 }
@@ -84,7 +80,6 @@ export class BackfillMigrationPendingError extends UltimateError {
       code: 'X_BACKFILL_MIGRATION_PENDING',
       cause: `backfill "${input.backfill}" requires migration ${input.migration}, which x_migrations does not record as applied`,
       fix: 'x db migrate --json',
-      docs: docsFor('X_BACKFILL_MIGRATION_PENDING'),
     });
   }
 }
@@ -100,7 +95,6 @@ export class BackfillRunningError extends UltimateError {
       code: 'X_BACKFILL_RUNNING',
       cause: `backfill "${input.backfill}" already has a live pass queued as ${input.jobId}, and one name holds one live pass; its step trace names the batch it is on, and a pass that is not advancing is a worker that lost its lease`,
       fix: `x jobs show ${input.jobId} --json`,
-      docs: docsFor('X_BACKFILL_RUNNING'),
     });
   }
 }
@@ -116,7 +110,6 @@ export class BackfillStalledError extends UltimateError {
       code: 'X_BACKFILL_STALLED',
       cause: `backfill "${input.backfill}" swept ${input.swept} rows, exhausted its source, and count() still matches ${input.remaining} — a WHERE the sweep narrows and the count does not is what leaves rows behind`,
       fix: `make count() select on exactly what source() selects on in backfill("${input.backfill}")`,
-      docs: docsFor('X_BACKFILL_STALLED'),
     });
   }
 }
@@ -131,7 +124,6 @@ export class BackfillUnknownError extends UltimateError {
           ? `no backfill named "${input.backfill}" is declared, and this app declares none at all`
           : `no backfill named "${input.backfill}" is declared (declared: ${input.known.join(', ')})`,
       fix: 'x db backfill --pending --json',
-      docs: docsFor('X_BACKFILL_UNKNOWN'),
     });
   }
 }

package/src/backfill-pass.ts

@@ -13,7 +13,7 @@
 // in step with the work and decides where a resumed pass restarts, while the `x_backfills` row is
 // a report an operator reads and the record that a completed name has already been swept.
 
-import { appVersion, assert, logger, resolveEnvironment } from '@ultimat3/core';
+import { appVersion, assert, logger, renderThrowable, resolveEnvironment } from '@ultimat3/core';
 import type { BatchIterator } from '@ultimat3/entity';
 import type { BackfillDefinition, BackfillInput, BackfillReport } from './backfill';
 import { BackfillStalledError } from './backfill-errors';
@@ -101,7 +101,7 @@ async function markFailed(
   } catch (error) {
     logger.warn('jobs.backfill.ledger-failed', {
       runId,
-      error: error instanceof Error ? error.message : String(error),
+      error: renderThrowable(error),
     });
   }
 }

package/src/errors.ts

@@ -93,8 +93,12 @@ registerErrorRetry({
   X_BACKFILL_APPLIED: 'terminal',
 });
 
-/** Shared with `backfill-errors.ts`, which holds the seven `X_BACKFILL_*` classes. */
-export const docsFor = (code: JobErrorCode): string => `https://ultimate.dev/errors/${code}`;
+// No `docs:` on any class below, here or in `backfill-errors.ts`. `UltimateError` fills it from
+// `describeErrorCode(code).docs`, which is `@ultimat3/core`'s `ERROR_DOCS_URL` — one page for every
+// code, never one per code, because `wiki/` is the framework's only public documentation surface
+// and a code lives there in a TABLE ROW, which has no anchor. The `docsFor` that stood here built
+// `https://ultimate.dev/errors/<code>`, which answered 404, host included, on every job failure
+// this package has ever put in a dead-letter row.
 
 /** An enqueue collided with a live job holding the same idempotency key under `onConflict: 'error'`. */
 export class JobDuplicateError extends UltimateError {
@@ -103,7 +107,6 @@ export class JobDuplicateError extends UltimateError {
       code: 'X_JOB_DUPLICATE',
       cause: `job "${input.job}" already queued as ${input.existingId} with idempotencyKey "${input.idempotencyKey}"`,
       fix: 'pass onConflict: "dedupe" to enqueue, or make idempotencyKey narrower',
-      docs: docsFor('X_JOB_DUPLICATE'),
     });
   }
 }
@@ -124,7 +127,6 @@ export class JobNameTakenError extends UltimateError {
       code: 'X_JOB_DUPLICATE',
       cause: `two ${input.kind}s claim the name "${input.name}"`,
       fix: `x jobs ls --json names the one already seated; rename the other's export, or its "name:" if it declares one — a ${input.kind} name is a durable queue key and is globally unique`,
-      docs: docsFor('X_JOB_DUPLICATE'),
     });
   }
 }
@@ -151,7 +153,6 @@ export class JobRowStatusUnknownError extends UltimateError {
         `${input.table}.${input.column} holds "${input.value}", which this build does not know — ` +
         `it reads ${input.known.join(', ')}`,
       fix: `x jobs show --json   # then drain the older workers: a status this build cannot read was almost certainly written by a newer deploy`,
-      docs: docsFor('X_JOB_ROW_STATUS_UNKNOWN'),
     });
   }
 }
@@ -175,7 +176,6 @@ export class ActionJobUnbridgedError extends UltimateError {
       code: 'X_ACTION_JOB_UNBRIDGED',
       cause: `export "${input.export}" is the action projection "${input.job}", which is not a job handle and cannot be registered as one`,
       fix: `wrap it: agentJob(${input.export}, { name: '${input.export}', tenant, retry }) from @ultimat3/ai — that composes job() and returns a handle the queue accepts`,
-      docs: docsFor('X_ACTION_JOB_UNBRIDGED'),
     });
   }
 }
@@ -187,7 +187,6 @@ export class StepDuplicateError extends UltimateError {
       code: 'X_STEP_DUPLICATE',
       cause: `job "${input.job}" used step name "${input.step}" twice in one run`,
       fix: `rename one of them, e.g. step.run('${input.step}-2', ...) — step names are the replay key`,
-      docs: docsFor('X_STEP_DUPLICATE'),
     });
   }
 }
@@ -201,7 +200,6 @@ export class JobTimeoutError extends UltimateError {
           ? `job "${input.job}" exceeded its ${input.timeoutMs}ms timeout`
           : `job "${input.job}" step "${input.step}" exceeded its ${input.timeoutMs}ms timeout`,
       fix: `raise timeout on the job definition, or split the work into step.run() calls`,
-      docs: docsFor('X_JOB_TIMEOUT'),
     });
   }
 }
@@ -225,7 +223,6 @@ export class JobAbortedError extends UltimateError {
           ? `job "${input.job}" was cancelled — this attempt no longer owns the run`
           : `job "${input.job}" was cancelled before step "${input.step}" could be recorded`,
       fix: 'add throwIfAborted(ctx) before expensive work, or pass fetch(url, { signal: ctx.signal }) — the queue re-runs the job, so stop at the deadline instead of running past it',
-      docs: docsFor('X_ABORTED'),
     });
   }
 }
@@ -237,7 +234,6 @@ export class JobMaxAttemptsError extends UltimateError {
       code: 'X_JOB_MAX_ATTEMPTS',
       cause: `job "${input.job}" failed ${input.attempts} times, last error: ${input.lastError}`,
       fix: `x jobs retry ${input.jobId}`,
-      docs: docsFor('X_JOB_MAX_ATTEMPTS'),
     });
   }
 }
@@ -248,7 +244,6 @@ export class DriverUnavailableError extends UltimateError {
       code: 'X_DRIVER_UNAVAILABLE',
       cause: `jobs driver "${input.driver}" is unavailable: ${input.cause}`,
       fix: input.fix,
-      docs: docsFor('X_DRIVER_UNAVAILABLE'),
     });
   }
 }
@@ -263,7 +258,6 @@ export class IdempotencyRequiredError extends UltimateError {
       code: 'X_IDEMPOTENCY_REQUIRED',
       cause: `job "${input.job}" has no idempotencyKey — at-least-once delivery would run it twice`,
       fix: `add idempotencyKey: (input) => \`${input.job}:\${input.id}\` to the job definition`,
-      docs: docsFor('X_IDEMPOTENCY_REQUIRED'),
     });
   }
 }
@@ -290,7 +284,6 @@ export class JobTenantRequiredError extends UltimateError {
       // tenant, and the pass opens the cross-tenant scope for exactly that declaration. Half the
       // callers of this code arrive through `backfill()`, which forwards its `tenant` to `job()`.
       fix: `add tenant: (input) => input.orgId to job("${input.job}") — or tenant: 'none', which declares NO org: right for a job that touches no tenant-scoped table, and the spelling a backfill() uses to sweep every tenant`,
-      docs: docsFor('X_JOB_TENANT_REQUIRED'),
     });
   }
 }
@@ -307,7 +300,6 @@ export class LeaseLostError extends UltimateError {
       code: 'X_JOB_LEASE_LOST',
       cause: `job "${input.job}" (${input.jobId}) is no longer claimed by this worker — it was cancelled, or its visibility lease lapsed and the queue re-delivered it`,
       fix: `x jobs show ${input.jobId} --json`,
-      docs: docsFor('X_JOB_LEASE_LOST'),
     });
   }
 }
@@ -325,7 +317,6 @@ export class JobSlotLostError extends UltimateError {
       code: 'X_JOB_SLOT_LOST',
       cause: `job "${input.job}" (${input.jobId}) no longer holds fleet concurrency slot ${input.slot} — its lease expired and another worker took it`,
       fix: `x jobs show ${input.jobId} --json`,
-      docs: docsFor('X_JOB_SLOT_LOST'),
     });
   }
 }
@@ -344,7 +335,6 @@ export class JobNotCancellableError extends UltimateError {
           ? `no job ${input.jobId} exists in this queue`
           : `job ${input.jobId} is "${input.state}" and only a job that has not finished can be cancelled`,
       fix: `x jobs ls --state running --json`,
-      docs: docsFor('X_JOB_NOT_CANCELLABLE'),
     });
   }
 }
@@ -356,7 +346,6 @@ export class CancelUnsupportedError extends UltimateError {
       code: 'X_JOB_NOT_CANCELLABLE',
       cause: `the "${input.driver}" jobs driver cannot cancel a single job`,
       fix: 'call setJobDriver(createPgDriver()) at boot — only the pg driver implements introspect.cancel — then: x jobs cancel <id> --json',
-      docs: docsFor('X_JOB_NOT_CANCELLABLE'),
     });
   }
 }
@@ -373,7 +362,6 @@ export class ConcurrencyUnenforceableError extends UltimateError {
       code: 'X_JOB_CONCURRENCY_UNENFORCEABLE',
       cause: `${input.jobs.join(', ')} declare concurrency and the "${input.driver}" jobs driver has no lease store, so the cap would hold per process and the fleet would run concurrency x replicas`,
       fix: `remove concurrency from job("${input.jobs[0] ?? 'the job'}"), or call setJobDriver(createPgDriver()) at boot — the pg driver is the one with a lease store`,
-      docs: docsFor('X_JOB_CONCURRENCY_UNENFORCEABLE'),
     });
   }
 }
@@ -385,7 +373,6 @@ export class OutboxNoTxError extends UltimateError {
       code: 'X_OUTBOX_NO_TX',
       cause: `ctx.jobs.enqueue(${input.job}) ran outside a transaction with outbox: 'required'`,
       fix: 'wrap the call in ctx.tx(async (tx) => ...), or enqueue with { outbox: false }',
-      docs: docsFor('X_OUTBOX_NO_TX'),
     });
   }
 }
@@ -396,7 +383,6 @@ export class JobsNotImplementedError extends UltimateError {
       code: 'X_NOT_IMPLEMENTED',
       cause: `${input.feature} is declared but not implemented in @ultimat3/jobs`,
       fix: input.fix,
-      docs: docsFor('X_NOT_IMPLEMENTED'),
     });
   }
 }

package/src/events-pg.ts

@@ -7,7 +7,7 @@
 // resumes at 12:00:30 must still see an event published at 12:00:10.
 
 import type { Clock } from '@ultimat3/core';
-import { logger, systemClock, uuid } from '@ultimat3/core';
+import { logger, renderThrowable, systemClock, uuid } from '@ultimat3/core';
 import type { DurationInput } from './clock';
 import { nowMs, toMs } from './clock';
 import type { PgExecutor } from './driver-pg';
@@ -54,7 +54,7 @@ export function createPgEventBus(options: PgEventBusOptions): EventBus {
     void exec.query(SQL_EVENT_PURGE, []).catch((error: unknown) => {
       // Housekeeping never costs a publish: an unpurged row is filtered out of every read.
       logger.warn('jobs.event.purge-failed', {
-        error: error instanceof Error ? error.message : String(error),
+        error: renderThrowable(error),
       });
     });
     return 0;

package/src/execute.ts

@@ -10,6 +10,7 @@ import {
   anonymousActor,
   isUltimateError,
   logger,
+  renderThrowable,
   reportError,
   runWithContext,
   useContext,
@@ -22,6 +23,7 @@ import { eventBus } from './events';
 import type { AnyJobHandle } from './job';
 import type { JobStopReason } from './retry-classification';
 import { nextRetryForError, recordedFailure } from './retry-classification';
+import { createRunSignal } from './run-signal';
 import type { EventLookup, StepRecord } from './steps';
 import { createStepRunner, isStepSuspension } from './steps';
 import { jobRunActor } from './tenant';
@@ -100,7 +102,14 @@ export async function executeJob(options: ExecuteJobOptions): Promise<JobExecuti
   // where every other body does, with no jobs-only parameter to know about. Composed with the
   // caller's signal rather than replacing it: a ctx that was already going away still is.
   const cancel = new AbortController();
-  const signal = AbortSignal.any([callerSignal(options.ctx), cancel.signal]);
+  // `createRunSignal` and never `AbortSignal.any` — the second of the two sites this package's
+  // `CLAUDE.md` states the rule as absolute for. In the worker path `callerSignal` is per-run and
+  // nothing leaks; on `@ultimat3/testing`'s job-fixture path, which calls `executeJob` directly,
+  // the caller's `ctx.signal` may be process-lifetime, and a composite cannot be undone — so every
+  // job a fixture ran left a dependent signal on it for the life of the process. Disposed in the
+  // `finally` at the bottom of the try, beside `cancel.abort`.
+  const runSignal = createRunSignal([callerSignal(options.ctx), cancel.signal]);
+  const signal = runSignal.signal;
   const ctx: Ctx = Object.freeze({
     ...options.ctx,
     signal,
@@ -178,7 +187,7 @@ export async function executeJob(options: ExecuteJobOptions): Promise<JobExecuti
       });
     }
 
-    const message = error instanceof Error ? error.message : String(error);
+    const message = renderThrowable(error);
     // The ERROR decides too, not only the attempt count. A `terminal` code — a rotated password,
     // a schema mismatch, a permission denial — fails identically on every remaining attempt, so
     // spending them is a queue slot, a provider bill and, at a site that locks an account after
@@ -238,6 +247,9 @@ export async function executeJob(options: ExecuteJobOptions): Promise<JobExecuti
     // attempt already owns. The runner fences its writes on this signal. A second `abort()` keeps
     // the first reason, so a timed-out run still reports the timeout, not this.
     cancel.abort(new JobAbortedError({ job: handle.name }));
+    // AFTER the abort, so the runner's fence still sees it: `dispose` stops following the sources,
+    // it never aborts, and the signal keeps whatever state the abort above left it in.
+    runSignal.dispose();
   }
 
   // Only reachable when the BODY succeeded, and settlement is deliberately outside the catch
@@ -287,9 +299,7 @@ function raceTimeout(
         job,
         timeoutMs,
         ended,
-        ...(error === undefined
-          ? {}
-          : { error: error instanceof Error ? error.message : String(error) }),
+        ...(error === undefined ? {} : { error: renderThrowable(error) }),
       });
     };
     work.then(

package/src/heartbeat.ts

@@ -4,7 +4,7 @@
 // hardest bug in a queue to see from the outside and the easiest to name from in here.
 
 import type { Clock } from '@ultimat3/core';
-import { logger, recordLeaseLost } from '@ultimat3/core';
+import { logger, recordLeaseLost, renderThrowable } from '@ultimat3/core';
 import { nowMs } from './clock';
 import type { ClaimedJob, JobDriver } from './driver';
 import { LeaseLostError } from './errors';
@@ -76,9 +76,7 @@ export function startLeaseHeartbeat(options: LeaseHeartbeatOptions): LeaseHeartb
       attempt: claimed.attempt,
       visibilityTimeoutMs,
       reason: reason ?? 'expired',
-      ...(error === undefined
-        ? {}
-        : { error: error instanceof Error ? error.message : String(error) }),
+      ...(error === undefined ? {} : { error: renderThrowable(error) }),
     });
     recordLeaseLost(claimed.queue);
     // Cancel LAST, so the loss is logged and counted before the body it unwinds starts throwing.
@@ -134,7 +132,7 @@ export function startLeaseHeartbeat(options: LeaseHeartbeatOptions): LeaseHeartb
         job: claimed.name,
         jobId: claimed.id,
         attempt: claimed.attempt,
-        error: error instanceof Error ? error.message : String(error),
+        error: renderThrowable(error),
       });
       if (lapsed()) reportLost(error);
     } finally {

package/src/outbox.ts

@@ -24,7 +24,7 @@
 // test and `x dev` must enqueue with nothing wired — but it is a fallback, not the guarantee.
 
 import type { Clock } from '@ultimat3/core';
-import { currentSpanContext, logger, traceparent, uuid } from '@ultimat3/core';
+import { currentSpanContext, logger, renderThrowable, traceparent, uuid } from '@ultimat3/core';
 import type { Tx } from '@ultimat3/entity';
 import { nowMs } from './clock';
 import type { EnqueueResult, JobDriver } from './driver';
@@ -421,7 +421,7 @@ export function createOutboxRelay(options: RelayOptions): OutboxRelay {
           id: record.id,
           published,
           remaining: batch.length - published,
-          error: error instanceof Error ? error.message : String(error),
+          error: renderThrowable(error),
         });
         // Hand the rest of the batch back rather than sit on a claim nobody is publishing. The
         // claim is a lease now, so without this a single pool timeout parks every committed row
@@ -456,7 +456,7 @@ export function createOutboxRelay(options: RelayOptions): OutboxRelay {
           .then((): void => undefined)
           .catch((error: unknown) => {
             logger.error('jobs.outbox.tick-failed', {
-              error: error instanceof Error ? error.message : String(error),
+              error: renderThrowable(error),
             });
           })
           .finally(() => {

package/src/renewal-timer.ts

@@ -4,6 +4,8 @@
 // the interval, which does nothing to the request already on the wire. So a flag is what every
 // branch after an `await` re-reads — the shape `settleWithin`'s `decided` uses in core.
 
+import { logger, renderThrowable } from '@ultimat3/core';
+
 export interface RenewalTimer {
   /**
    * True once `stop()` has been called. Read AFTER every await in the renewal body: a clean
@@ -22,7 +24,20 @@ export function startRenewalTimer(
 ): RenewalTimer {
   let stopped = false;
   const timer = setInterval(() => {
-    void renew();
+    // `Promise.resolve().then(renew)` and never `void renew()`: a `renew` that throws SYNCHRONOUSLY
+    // escapes before any `.catch` its body chained exists. `worker-fleet-slots.ts` guards the
+    // promise chain and cannot guard this — `LeaseStore.renew` is an injected seam, and a store
+    // that throws on a closed pool throws on the call, not in the chain. Nothing sits above a
+    // `setInterval` callback, so that throw is an uncaught exception in the timer that was going
+    // to keep the lease alive. The shape `outbox.ts`'s tick loop already uses.
+    void Promise.resolve()
+      .then(renew)
+      .catch((error: unknown) => {
+        // A renewal that FAILS is each caller's own business and both handle it. Reaching here
+        // means the seam broke its contract, which is a different fact and is worth its own line —
+        // swallowed, it would be a lease that stops renewing with nothing anywhere saying so.
+        logger.error('jobs.renewal.raised', { error: renderThrowable(error) });
+      });
   }, intervalMs);
   return {
     stopped: () => stopped,

package/src/scheduler.ts

@@ -13,7 +13,7 @@
 // round rather than opening a second one over the same `lastFiredAt`.
 
 import type { Clock } from '@ultimat3/core';
-import { isUltimateError, logger, onShutdown } from '@ultimat3/core';
+import { isUltimateError, logger, onShutdown, renderThrowable } from '@ultimat3/core';
 import { instant, nextCronOccurrence } from '@ultimat3/time';
 import { nowMs } from './clock';
 import type { JobDriver } from './driver';
@@ -26,7 +26,7 @@ import { registeredTasks } from './task';
  * stable code to search on and the `fix:` to run, not a sentence.
  */
 function failureFields(error: unknown): Record<string, unknown> {
-  const message = error instanceof Error ? error.message : String(error);
+  const message = renderThrowable(error);
   return isUltimateError(error)
     ? { error: message, code: error.code, cause: error.cause, fix: error.fix }
     : { error: message };

package/src/steps.ts

@@ -7,10 +7,11 @@
 // catches it and re-queues the job for `resumeAt` instead of holding a process for three days.
 
 import type { Clock } from '@ultimat3/core';
-import { logger } from '@ultimat3/core';
+import { logger, renderThrowable } from '@ultimat3/core';
 import type { DurationInput } from './clock';
 import { nowMs, toMs } from './clock';
 import { JobAbortedError, JobTimeoutError, StepDuplicateError } from './errors';
+import { createRunSignal } from './run-signal';
 
 /**
  * The runtime list is the declaration and `StepStatus` is derived from it, the shape
@@ -283,10 +284,16 @@ export function createStepRunner(options: StepRunnerOptions): StepRunner {
     // The step's own ceiling, folded into the run's cancellation so the body reads ONE signal and
     // sees whichever deadline lands first. Composed only when there is a second one to compose.
     const deadline = new AbortController();
-    const signal =
-      options.stepTimeoutMs === undefined
-        ? runSignal
-        : AbortSignal.any([runSignal, deadline.signal]);
+    // `createRunSignal` and never `AbortSignal.any`, which is the rule this package's `CLAUDE.md`
+    // states as absolute: a composite cannot be undone, so ONE dependent signal per STEP stayed on
+    // the run's signal for the whole attempt. A `backfill()` at `batch: 1000` over 5M rows is
+    // 5,000 of them held at once, and an app whose `WorkerOptions.context()` carries a
+    // process-lifetime signal keeps them past the run. Composed only when there is a second signal
+    // to compose, and DISPOSED in the `finally` below, which is the whole reason `run-signal.ts`
+    // exists — `worker-run.ts` disposes the run's own the same way.
+    const composed =
+      options.stepTimeoutMs === undefined ? null : createRunSignal([runSignal, deadline.signal]);
+    const signal = composed?.signal ?? runSignal;
     try {
       const output = await withStepTimeout(
         fn(signal),
@@ -320,12 +327,16 @@ export function createStepRunner(options: StepRunnerOptions): StepRunner {
           status: 'failed',
           startedAt,
           attempts,
-          error: error instanceof Error ? error.message : String(error),
+          error: renderThrowable(error),
         };
         await store.put(failure);
         remember(failure);
       }
       throw error;
+    } finally {
+      // Nothing of the run's is held past the step. Idempotent, and it never aborts: a step that
+      // settled leaves its signal in whatever state it ended in.
+      composed?.dispose();
     }
   }
 

package/src/worker-fleet-slots.ts

@@ -3,7 +3,7 @@
 // Apart from `worker.ts` because the claim loop's question is "may I start this one?" — which job
 // holds which slot, and who gives it back, is bookkeeping of its own.
 
-import { logger } from '@ultimat3/core';
+import { logger, renderThrowable } from '@ultimat3/core';
 import type { ClaimedJob } from './driver';
 import { getJob } from './job';
 import type { HeldLease, LeaseStore } from './leases';
@@ -121,7 +121,7 @@ export function createFleetSlots(options: FleetSlotOptions): FleetSlots {
         logger.warn('jobs.worker.lease-release-failed', {
           workerId: options.workerId,
           jobId,
-          error: error instanceof Error ? error.message : String(error),
+          error: renderThrowable(error),
         });
       });
     },

package/src/worker.ts

@@ -4,7 +4,14 @@
 // deploy turns "at least once" into "always twice", so draining is on by default.
 
 import type { Clock, Ctx } from '@ultimat3/core';
-import { logger, onShutdown, recordJob, recordQueueDepth, uuid } from '@ultimat3/core';
+import {
+  logger,
+  onShutdown,
+  recordJob,
+  recordQueueDepth,
+  renderThrowable,
+  uuid,
+} from '@ultimat3/core';
 import { nowMs } from './clock';
 import type { ClaimedJob, JobDriver, QueueStats } from './driver';
 import { DEFAULT_QUEUE, DEFAULT_VISIBILITY_TIMEOUT_MS } from './driver';
@@ -141,7 +148,7 @@ export function createWorker(options: WorkerOptions): Worker {
       // Instrumentation never costs a tick: a queue that cannot be measured must still be worked.
       logger.warn('jobs.worker.depth-failed', {
         workerId,
-        error: error instanceof Error ? error.message : String(error),
+        error: renderThrowable(error),
       });
     }
   };
@@ -290,7 +297,7 @@ export function createWorker(options: WorkerOptions): Worker {
               workerId,
               job: job.name,
               jobId: job.id,
-              error: error instanceof Error ? error.message : String(error),
+              error: renderThrowable(error),
             });
           },
         );
@@ -332,7 +339,7 @@ export function createWorker(options: WorkerOptions): Worker {
         .catch((error: unknown) => {
           logger.error('jobs.worker.tick-failed', {
             workerId,
-            error: error instanceof Error ? error.message : String(error),
+            error: renderThrowable(error),
           });
         })
         .finally(() => {