commandmate 0.29.0 → 0.29.2

package/dist/server/src/lib/verification/gate-runner.js

@@ -23,6 +23,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VerificationConflictError = exports.FLAKY_LOG_PREFIX = exports.MUTEX_WAIT_SKIP_REASON = exports.MUTEX_LOG_PREFIX = exports.WORKTREE_INDEX_ENV = exports.WORKTREE_ID_ENV = exports.MAX_CONCURRENT_VERIFICATIONS = exports.CONFIG_GATE_ID = exports.ENV_CLEAN_GATE_ID = exports.SCOPE_GATE_ID = exports.WORK_EVIDENCE_GATE_ID = void 0;
 exports.waitForVerification = waitForVerification;
+exports.cancelVerification = cancelVerification;
 exports.startVerification = startVerification;
 const child_process_1 = require("child_process");
 const fs_1 = require("fs");
@@ -45,6 +46,9 @@ const env_clean_gate_1 = require("./env-clean-gate");
 const env_snapshot_1 = require("./env-snapshot");
 const machine_lock_1 = require("./machine-lock");
 const worktree_index_1 = require("./worktree-index");
+// Issue #2062: the two skip logs the Web UI has to read back live beside the
+// exit-code table the pane prints, so the producer and the reader are one string.
+const run_verdict_vocabulary_1 = require("./run-verdict-vocabulary");
 const scope_gate_1 = require("./scope-gate");
 const verify_config_1 = require("./verify-config");
 Object.defineProperty(exports, "ENV_CLEAN_GATE_ID", { enumerable: true, get: function () { return verify_config_1.ENV_CLEAN_GATE_ID; } });
@@ -232,6 +236,101 @@ function waitForVerification(runId) {
     return inFlight.get(runId) ?? Promise.resolve(null);
 }
 // =============================================================================
+// Cancellation (Issue #2063)
+// =============================================================================
+/**
+ * How long {@link cancelVerification} waits for a signalled run to close itself.
+ *
+ * Longer than {@link SIGKILL_GRACE_MS} because a gate that ignores SIGTERM is
+ * only SIGKILLed after that grace, and the run still has rows to write
+ * afterwards. When the budget runs out the caller is told the cancel was
+ * *requested* rather than completed; the alternative is an HTTP request held
+ * open for as long as the most stubborn child in the group.
+ */
+const CANCEL_SETTLE_TIMEOUT_MS = SIGKILL_GRACE_MS + 3000;
+/** The gate that was executing when the operator's cancel arrived. */
+const CANCELLED_RUNNING_GATE_LOG = `${run_verdict_vocabulary_1.CANCELLED_SKIP_LOG} This gate was terminated before it reached a verdict.`;
+/** A gate the run had not started by the time it was cancelled. */
+const CANCELLED_NOT_REACHED_LOG = `${run_verdict_vocabulary_1.CANCELLED_SKIP_LOG} The run stopped before this gate started.`;
+/**
+ * The cancel switch for one run.
+ *
+ * Two jobs, and both are load-bearing. It *signals* the process groups running
+ * right now — a status flip on its own would leave `npm run build` holding the
+ * worktree for another twenty minutes while the UI claimed the run was over,
+ * which is worse than having no cancel at all. And it *latches*, so the gates
+ * the run has not started yet are never spawned. A child registered after the
+ * latch is set is killed on registration rather than granted one free run.
+ */
+class RunCancellation {
+    latched = false;
+    killers = new Set();
+    get cancelled() {
+        return this.latched;
+    }
+    /**
+     * Put a live child under this switch.
+     *
+     * @returns the unregister callback, which the caller runs when the child exits
+     */
+    register(kill) {
+        if (this.latched) {
+            kill();
+            return () => { };
+        }
+        this.killers.add(kill);
+        return () => {
+            this.killers.delete(kill);
+        };
+    }
+    cancel() {
+        this.latched = true;
+        // Copied before iterating: a killer may unregister itself synchronously.
+        for (const kill of [...this.killers])
+            kill();
+    }
+}
+/** Cancel switches for the runs this process is executing, keyed by run id. */
+const cancellations = new Map();
+/**
+ * Stop a run in flight: kill its gate's process group, then close it
+ * `cancelled` (Issue #2063).
+ *
+ * Killing is the whole point, and it is what a status-column rewrite would have
+ * skipped. Gates are spawned `detached` (see {@link runCommand}) precisely so a
+ * signal can reach the whole group — killing the shell alone leaves the
+ * `npm` / `vitest` grandchildren running.
+ *
+ * A run this process does not own answers `not-running`. After a restart
+ * {@link reconcileOrphanVerificationRuns} has already closed every orphan as
+ * `error`, so a `running` row with no switch behind it is not something a
+ * signal can reach, and saying so is more useful than pretending to have
+ * stopped something.
+ *
+ * A run cancelled while it is still queued behind
+ * {@link MAX_CONCURRENT_VERIFICATIONS} answers `requested`: the latch is set,
+ * so it will start nothing, but it closes its own row only once a slot reaches
+ * it. The caller polls, which it is doing anyway.
+ */
+async function cancelVerification(runId) {
+    const cancellation = cancellations.get(runId);
+    const completion = inFlight.get(runId);
+    if (!cancellation || !completion)
+        return { kind: 'not-running' };
+    cancellation.cancel();
+    let timer;
+    const settled = await Promise.race([
+        completion,
+        new Promise((resolve) => {
+            timer = setTimeout(() => resolve(null), CANCEL_SETTLE_TIMEOUT_MS);
+            timer.unref?.();
+        }),
+    ]);
+    if (timer)
+        clearTimeout(timer);
+    return settled === null ? { kind: 'requested' } : { kind: 'cancelled', status: settled };
+}
+// =============================================================================
 // Command execution
 // =============================================================================
 /**
@@ -315,15 +414,18 @@ function gateProcessEnv(gateEnv) {
  * `shell: true` so a gate can be written the way a developer would type it
  * (`npm run lint`), and `detached: true` so the timeout can signal the whole
  * process group — killing only the shell leaves the `npm`/`vitest` grandchildren
- * running and holding the worktree.
+ * running and holding the worktree. Issue #2063 gives the operator's cancel the
+ * same reach through `cancellation`, for the same reason.
  */
-function runCommand(command, cwd, timeoutSec, maxLogTailBytes, gateEnv) {
+function runCommand(command, cwd, timeoutSec, maxLogTailBytes, gateEnv, cancellation) {
     return new Promise((resolve) => {
         const startedAt = Date.now();
         const tail = new TailBuffer(maxLogTailBytes);
         let settled = false;
         let timedOut = false;
+        let cancelled = false;
         let graceTimer;
+        let cancelGraceTimer;
         const child = (0, child_process_1.spawn)(command, {
             shell: true,
             cwd,
@@ -355,6 +457,17 @@ function runCommand(command, cwd, timeoutSec, maxLogTailBytes, gateEnv) {
                 }
             }
         };
+        /**
+         * Issue #2063. Registered after the spawn so `child.pid` exists; when the
+         * run was cancelled between the two, `register` fires this immediately and
+         * the group is signalled before it can do anything.
+         */
+        const unregisterCancel = cancellation?.register(() => {
+            cancelled = true;
+            signalGroup('SIGTERM');
+            cancelGraceTimer = setTimeout(() => signalGroup('SIGKILL'), SIGKILL_GRACE_MS);
+            cancelGraceTimer.unref?.();
+        });
         // Only ever called from an event handler, so the killTimer binding below is
         // initialised by the time this runs.
         const finish = (outcome) => {
@@ -364,6 +477,9 @@ function runCommand(command, cwd, timeoutSec, maxLogTailBytes, gateEnv) {
             clearTimeout(killTimer);
             if (graceTimer)
                 clearTimeout(graceTimer);
+            if (cancelGraceTimer)
+                clearTimeout(cancelGraceTimer);
+            unregisterCancel?.();
             resolve({ ...outcome, startedAt, durationMs: Date.now() - startedAt });
         };
         const killTimer = setTimeout(() => {
@@ -391,6 +507,22 @@ function runCommand(command, cwd, timeoutSec, maxLogTailBytes, gateEnv) {
                 });
                 return;
             }
+            // Checked after `timedOut` so a gate that had already blown its budget
+            // keeps reporting the budget as the cause: the cancel arrived second and
+            // did not decide anything the timeout had not already decided.
+            if (cancelled) {
+                finish({
+                    // `skipped`, not `failed`: the command reached no verdict about the
+                    // work. The run itself is closed as `cancelled` by executeRun, so
+                    // aggregateRunStatus never sees this row and its skipped -> error
+                    // rule is not involved.
+                    status: 'skipped',
+                    // Killed, so whatever the shell reported is the signal's doing.
+                    exitCode: null,
+                    logTail: `${tail.toString()}\n${CANCELLED_RUNNING_GATE_LOG} (${signal ?? 'exited'})`.trim(),
+                });
+                return;
+            }
             finish({
                 status: code === 0 ? 'passed' : 'failed',
                 exitCode: code,
@@ -444,15 +576,23 @@ function machineLockPathFor(name) {
  * across both, so a retry never keeps a machine-wide resource out of another
  * worktree's hands for a run that has already failed once.
  */
-async function runGateAttempt(gate, worktreePath, maxLogTailBytes, gateEnv) {
+async function runGateAttempt(gate, worktreePath, maxLogTailBytes, gateEnv, cancellation) {
     const mutex = gate.mutex;
     if (!mutex) {
-        return runCommand(gate.command, worktreePath, gate.timeoutSec, maxLogTailBytes, gateEnv);
+        return runCommand(gate.command, worktreePath, gate.timeoutSec, maxLogTailBytes, gateEnv, cancellation);
     }
     // The gate's own timeout is the wait budget: a gate allowed 600s of execution
     // has already declared how long this run may spend on it, and a second knob
     // would only let the two disagree.
-    const lock = await (0, machine_lock_1.acquireMachineLock)(mutex, { timeoutMs: gate.timeoutSec * 1000 });
+    //
+    // Issue #2063: the wait is abandonable. `build` declares 1800s here, so a run
+    // cancelled while queued behind the lock used to stay `running` for up to
+    // half an hour — holding the worktree against the very endpoint that exists
+    // to release it.
+    const lock = await (0, machine_lock_1.acquireMachineLock)(mutex, {
+        timeoutMs: gate.timeoutSec * 1000,
+        shouldAbandon: () => cancellation.cancelled,
+    });
     if (!lock.acquired) {
         const recordedAt = Date.now();
         return {
@@ -460,11 +600,25 @@ async function runGateAttempt(gate, worktreePath, maxLogTailBytes, gateEnv) {
             exitCode: null,
             startedAt: recordedAt,
             durationMs: 0,
-            logTail: mutexWaitTimeoutLog(gate, mutex, lock),
+            // A cancelled wait is not a resource conflict, and naming the holder
+            // would send the reader after a lock that had nothing to do with it.
+            logTail: lock.abandoned ? CANCELLED_NOT_REACHED_LOG : mutexWaitTimeoutLog(gate, mutex, lock),
         };
     }
     try {
-        const outcome = await runCommand(gate.command, worktreePath, gate.timeoutSec, maxLogTailBytes, gateEnv);
+        // The lock can still come free in the same tick the cancel arrives, so the
+        // latch is read once more before anything is spawned.
+        if (cancellation.cancelled) {
+            const recordedAt = Date.now();
+            return {
+                status: 'skipped',
+                exitCode: null,
+                startedAt: recordedAt,
+                durationMs: 0,
+                logTail: CANCELLED_NOT_REACHED_LOG,
+            };
+        }
+        const outcome = await runCommand(gate.command, worktreePath, gate.timeoutSec, maxLogTailBytes, gateEnv, cancellation);
         return {
             ...outcome,
             logTail: withMutexMarker(mutex, lock.waitedMs, lock.handle.path, outcome.logTail),
@@ -490,11 +644,14 @@ async function runGateAttempt(gate, worktreePath, maxLogTailBytes, gateEnv) {
  * came free) and an `error` (the command could not be spawned) never started a
  * command, so there is no verdict to seek a second opinion on.
  */
-async function runCommandGate(gate, worktreePath, maxLogTailBytes, gateEnv) {
-    const first = await runGateAttempt(gate, worktreePath, maxLogTailBytes, gateEnv);
+async function runCommandGate(gate, worktreePath, maxLogTailBytes, gateEnv, cancellation) {
+    const first = await runGateAttempt(gate, worktreePath, maxLogTailBytes, gateEnv, cancellation);
+    // A cancelled attempt reports `skipped`, so the retry below is already ruled
+    // out by the status check: an operator's Stop must not buy a second run of
+    // the very command they stopped.
     if (gate.retryOnFail !== 1 || first.status !== 'failed')
         return first;
-    const second = await runGateAttempt(gate, worktreePath, maxLogTailBytes, gateEnv);
+    const second = await runGateAttempt(gate, worktreePath, maxLogTailBytes, gateEnv, cancellation);
     if (second.status !== 'passed' && second.status !== 'failed') {
         // The retry reached no verdict of its own, so there is nothing to compare
         // the first run against. The first run's FAIL stands unchanged — reporting
@@ -752,20 +909,41 @@ function declaredGates(config, contractGates) {
  * with zero gate results, which {@link aggregateRunStatus} would have to call
  * `passed` — a green verdict from having checked nothing.
  *
+ * ## A narrowed run cannot drop the contract's own criteria (Issue #2063)
+ *
+ * Every field of `required` is ORed with the request rather than replaced by
+ * it. `runEnvClean` has worked this way since #1740, for the reason stated
+ * there: *a delegation that declared the requirement cannot lose it by naming a
+ * narrower gate list.* `runWorkEvidence` and `scope` did not, and the asymmetry
+ * became reachable in one click when #2063 added a "re-run only the failed
+ * gates" button, which by construction always sends a proper subset.
+ *
+ * The failure that closes: a run with `gateIds: ['unit']` executes `unit`
+ * alone, {@link aggregateRunStatus} sees one `passed`, the run is `passed` — and
+ * because a Web run carries no `taskId`, `getVerifiableTask` adopts the
+ * worktree's `failed` contract task and walks it `verify_started` ->
+ * `verify_passed` -> `succeeded`. A contract declaring `requireScopeClean: true`
+ * would have been closed as done with `scope.allow` never evaluated and no work
+ * evidence ever established. So the two gates that judge the *contract* (rather
+ * than the repository's own criteria) are forced back in whenever the contract
+ * asked for them.
+ *
+ * `scope` becomes `explicit`, not `implicit`: the caller did not name it, but a
+ * declaration did, and a skip of a gate somebody required has to count against
+ * the run (the same reading #1620 gave the detached-contract case).
+ *
  * @param declared verify.yaml's gates followed by the contract's (#1791); the
  *        selection preserves this order, never the order `gateIds` was typed in
- * @param requireEnvClean whether a declaration switched env-clean on. It is
- *        ORed with an explicit request rather than replacing it, so `--gates
- *        env-clean` still works with the switch off (and honestly reports
- *        UNKNOWN, because no baseline was recorded), and a delegation that
- *        declared the requirement cannot lose it by naming a narrower gate list.
+ * @param required built-ins a declaration has made non-optional; ORed with the
+ *        request so `--gates env-clean` still works with the switch off (and
+ *        honestly reports UNKNOWN, because no baseline was recorded)
  */
-function selectGates(declared, gateIds, requireEnvClean) {
+function selectGates(declared, gateIds, required) {
     if (!gateIds) {
         return {
             runWorkEvidence: true,
             scope: 'implicit',
-            runEnvClean: requireEnvClean,
+            runEnvClean: required.envClean,
             gates: declared,
         };
     }
@@ -781,9 +959,9 @@ function selectGates(declared, gateIds, requireEnvClean) {
     }
     const requested = new Set(gateIds);
     const selection = {
-        runWorkEvidence: requested.has(verify_config_1.WORK_EVIDENCE_GATE_ID),
-        scope: requested.has(verify_config_1.SCOPE_GATE_ID) ? 'explicit' : 'off',
-        runEnvClean: requested.has(verify_config_1.ENV_CLEAN_GATE_ID) || requireEnvClean,
+        runWorkEvidence: requested.has(verify_config_1.WORK_EVIDENCE_GATE_ID) || required.workEvidence,
+        scope: requested.has(verify_config_1.SCOPE_GATE_ID) || required.scope ? 'explicit' : 'off',
+        runEnvClean: requested.has(verify_config_1.ENV_CLEAN_GATE_ID) || required.envClean,
         gates: declared.filter((gate) => requested.has(gate.id)),
     };
     if (!selection.runWorkEvidence &&
@@ -811,7 +989,9 @@ function aggregateRunStatus(gateStatuses) {
 }
 async function executeRun(db, runId, worktreeId, worktreePath, 
 /** Issue #2043: which agent instance the run is judging, for the second witness. */
-instanceId, config, selection, baseRef, task, detachedContract, envClean) {
+instanceId, config, selection, baseRef, task, detachedContract, envClean, 
+/** Issue #2063: the operator's Stop switch for this run. */
+cancellation) {
     const { maxLogTailBytes, skipInPrimaryCheckout } = config.options;
     const { runWorkEvidence, gates } = selection;
     // Issue #2043. A thunk rather than a number so the store is read at the
@@ -888,24 +1068,59 @@ instanceId, config, selection, baseRef, task, detachedContract, envClean) {
         return close(row.id, outcome);
     };
     const statuses = [];
+    /**
+     * Write a row for every gate this run will not reach, and why.
+     *
+     * Shared by the two reasons a run stops early — the work-evidence gate found
+     * nothing to judge, and Issue #2063's cancel — because "the report must show
+     * what was NOT run" is the same requirement either way. A run that simply
+     * ended with rows missing is indistinguishable from one whose gates all
+     * passed, which is the inversion `skipped` exists to prevent.
+     */
+    const recordRemainder = (reason, remaining) => {
+        if (remaining.scope) {
+            recordNotRun(verify_config_1.SCOPE_GATE_ID, SCOPE_GATE_COMMAND, 'builtin', reason);
+        }
+        if (remaining.envClean) {
+            recordNotRun(verify_config_1.ENV_CLEAN_GATE_ID, ENV_CLEAN_GATE_COMMAND, 'builtin', reason);
+        }
+        for (const gate of remaining.gates) {
+            recordNotRun(gate.id, gate.command, gate.source, reason);
+        }
+    };
+    /**
+     * Close the run out as `cancelled`, recording what it never got to.
+     *
+     * Returns the verdict directly rather than going through
+     * {@link aggregateRunStatus}: those rows are `skipped`, and the aggregate
+     * would turn an operator's deliberate Stop into `error` — "we could not
+     * judge" — which reads as a fault in the runner rather than a choice a human
+     * made.
+     */
+    const cancelledHere = (remaining) => {
+        recordRemainder(CANCELLED_NOT_REACHED_LOG, remaining);
+        return 'cancelled';
+    };
     if (runWorkEvidence) {
         const outcome = await runGate(verify_config_1.WORK_EVIDENCE_GATE_ID, WORK_EVIDENCE_GATE_COMMAND, 'builtin', () => evaluateWorkEvidence(worktreePath, baseRef, requireCommit, agentEvidence));
         if (outcome.status !== 'passed') {
             // Nothing was produced, so every command gate below would be judging the
             // base commit. Record them as skipped so the run shows what was not run.
-            const reason = `skipped: the ${verify_config_1.WORK_EVIDENCE_GATE_ID} gate did not pass.`;
-            if (selection.scope !== 'off') {
-                recordNotRun(verify_config_1.SCOPE_GATE_ID, SCOPE_GATE_COMMAND, 'builtin', reason);
-            }
-            if (selection.runEnvClean) {
-                recordNotRun(verify_config_1.ENV_CLEAN_GATE_ID, ENV_CLEAN_GATE_COMMAND, 'builtin', reason);
-            }
-            for (const gate of gates) {
-                recordNotRun(gate.id, gate.command, gate.source, reason);
-            }
+            recordRemainder(run_verdict_vocabulary_1.WORK_EVIDENCE_SKIP_LOG, {
+                scope: selection.scope !== 'off',
+                envClean: selection.runEnvClean,
+                gates,
+            });
             return outcome.status === 'failed' ? 'not_started' : 'error';
         }
         statuses.push(outcome.status);
+        if (cancellation.cancelled) {
+            return cancelledHere({
+                scope: selection.scope !== 'off',
+                envClean: selection.runEnvClean,
+                gates,
+            });
+        }
     }
     if (selection.scope !== 'off') {
         // A detached contract is decided before the gate would run, so its row is
@@ -924,6 +1139,9 @@ instanceId, config, selection, baseRef, task, detachedContract, envClean) {
         if (outcome.status !== 'skipped' || declined) {
             statuses.push(outcome.status);
         }
+        if (cancellation.cancelled) {
+            return cancelledHere({ scope: false, envClean: selection.runEnvClean, gates });
+        }
     }
     if (selection.runEnvClean) {
         // Measured before the command gates, not after: the pair of snapshots spans
@@ -938,20 +1156,33 @@ instanceId, config, selection, baseRef, task, detachedContract, envClean) {
             sources: envClean.decision.sources,
         }));
         statuses.push(outcome.status);
+        if (cancellation.cancelled) {
+            return cancelledHere({ scope: false, envClean: false, gates });
+        }
     }
     const isPrimaryCheckout = skipInPrimaryCheckout && sameRealPath(worktreePath, process.cwd());
-    for (const gate of gates) {
+    for (const [index, gate] of gates.entries()) {
+        // Read at the top of every iteration rather than only when a gate finishes:
+        // the switch may have been thrown while the previous gate was closing its
+        // row, and the next `npm run build` must not start regardless.
+        if (cancellation.cancelled) {
+            return cancelledHere({ scope: false, envClean: false, gates: gates.slice(index) });
+        }
         if (isPrimaryCheckout) {
             // The server process runs out of this directory. A `build` here replaces
             // the chunks the running app is serving mid-flight and breaks the live UI
             // — observed twice before this guard existed.
-            statuses.push(recordNotRun(gate.id, gate.command, gate.source, 'skipped: worktreePath is the server process working directory and ' +
-                'options.skipInPrimaryCheckout is true.').status);
+            statuses.push(recordNotRun(gate.id, gate.command, gate.source, run_verdict_vocabulary_1.PRIMARY_CHECKOUT_SKIP_LOG).status);
             continue;
         }
-        const outcome = await runGate(gate.id, gate.command, gate.source, () => runCommandGate(gate, worktreePath, maxLogTailBytes, gateEnv()));
+        const outcome = await runGate(gate.id, gate.command, gate.source, () => runCommandGate(gate, worktreePath, maxLogTailBytes, gateEnv(), cancellation));
         statuses.push(outcome.status);
     }
+    // The loop's own check cannot see a cancel that landed during the LAST gate:
+    // there is no next iteration to read it. Without this the run would be
+    // aggregated from a trailing `skipped` and reported as `error`.
+    if (cancellation.cancelled)
+        return 'cancelled';
     return aggregateRunStatus(statuses);
 }
 // =============================================================================
@@ -1118,6 +1349,21 @@ async function startVerification(input) {
     }
     // Resolved before gate selection because it can add a gate to it (#1740).
     const envCleanDecision = (0, env_clean_gate_1.resolveRequireEnvClean)(task?.contract ?? null, config);
+    /**
+     * Built-ins a declaration has made non-optional for this run (Issue #2063).
+     *
+     * Read from the contract this run is actually attached to — the same rule
+     * `requireCommit` and the #1791 gate merge follow, because a run that could
+     * not attach to a contract is not a run about that contract. The exception is
+     * `scope`: a *detached* contract that asked for a clean scope still forces the
+     * gate, so the row #1620 records ("this contract was NOT judged") survives a
+     * narrowed run instead of vanishing with it.
+     */
+    const requiredBuiltins = {
+        workEvidence: task?.contract.success.requireWorkEvidence ?? false,
+        scope: (task?.contract.success.requireScopeClean ?? false) || detachedContract !== null,
+        envClean: envCleanDecision.required,
+    };
     let selection = null;
     if (config && !configFailure) {
         // Contract gates come from the task this run is actually about (#1791), so
@@ -1128,7 +1374,7 @@ async function startVerification(input) {
             configFailure = declared;
         }
         else {
-            const selected = selectGates(declared, gateIds, envCleanDecision.required);
+            const selected = selectGates(declared, gateIds, requiredBuiltins);
             if (typeof selected === 'string') {
                 configFailure = selected;
             }
@@ -1190,6 +1436,12 @@ async function startVerification(input) {
     if (trackedTask) {
         recordTaskTransition(db, trackedTask.id, 'verify_started', run.id);
     }
+    // Issue #2063. Registered before the background work is scheduled and after
+    // every early return above, so a `cancel` that arrives on the very next tick
+    // finds a switch to throw, and a run that closed synchronously never leaves
+    // one behind.
+    const cancellation = new RunCancellation();
+    cancellations.set(run.id, cancellation);
     const resolvedConfig = config;
     const resolvedSelection = selection;
     // Read once, up front: the baseline is a file, and a run that took minutes
@@ -1205,7 +1457,15 @@ async function startVerification(input) {
         await acquireSlot();
         let terminalStatus = 'error';
         try {
-            const status = await executeRun(db, run.id, input.worktreeId, input.worktreePath, input.instanceId, resolvedConfig, resolvedSelection, baseRef, task, detachedContract, envCleanContext);
+            // Cancelled while queued behind MAX_CONCURRENT_VERIFICATIONS: nothing was
+            // ever spawned, so there is nothing to kill and no gate row to write —
+            // just the verdict the operator asked for.
+            if (cancellation.cancelled) {
+                terminalStatus = 'cancelled';
+                (0, db_1.finishVerificationRun)(db, run.id, 'cancelled');
+                return 'cancelled';
+            }
+            const status = await executeRun(db, run.id, input.worktreeId, input.worktreePath, input.instanceId, resolvedConfig, resolvedSelection, baseRef, task, detachedContract, envCleanContext, cancellation);
             terminalStatus = status;
             (0, db_1.finishVerificationRun)(db, run.id, status);
             return status;
@@ -1234,6 +1494,7 @@ async function startVerification(input) {
             notifyRunFailure(db, input, run.id, taskId, terminalStatus);
             releaseSlot();
             inFlight.delete(run.id);
+            cancellations.delete(run.id);
         }
     })();
     inFlight.set(run.id, completion);

package/dist/server/src/lib/verification/machine-lock.js

@@ -162,6 +162,17 @@ async function acquireMachineLock(name, options) {
     // remove degrades into ordinary waiting instead of a spin loop.
     const broken = new Set();
     for (;;) {
+        // Issue #2063. Checked before the claim as well as after the sleep, so a
+        // caller that was already cancelled when it got here never takes a lock it
+        // is only going to release.
+        if (options.shouldAbandon?.()) {
+            return {
+                acquired: false,
+                waitedMs: Date.now() - startedAt,
+                heldBy: describeOwner(readOwner(lockPath)),
+                abandoned: true,
+            };
+        }
         const owner = { pid: process.pid, host: (0, os_1.hostname)(), token, acquiredAt: Date.now() };
         if (claim(lockPath, owner)) {
             return {