[Dunky13]

What

agent-heavy cancel could refuse a job that was ending on its own: Process group ownership cannot be verified; shared slot retained without signalling. Seen as an intermittent failure of TestRealDaemonCancellationRemovesDescendants (PR #74, run 41672401460, macOS tests (macos-15-intel, core-1)). docs/handoffs/process-census.md already recorded it on main.

Cause

The daemon's signal checks a worker record read earlier, which names only the worker. A descendant that ignores SIGINT (sleep 60 & in a non-interactive shell) keeps the group alive after the worker is gone, so the group has a member but none the record names, and the check refuses. The old error text and missing job log cannot separate two ways to reach that state:

1. Stale read. Cancel resends every 200ms. A repeat can read the row as running, then list processes after the worker exited.
2. The repeat kills the worker. executeWithAttempt stopped handling SIGINT on return, so a resend before the outcome was published killed the worker with nothing written. A review forced this with injected delays. With a raw SIGINT and no cancel recorded, the job also reported 125 instead of the command's status; a real Cancel marks the row first, so its wait reports 130.

The refusal came from the daemon's cancel reply: WaitCleanup never returns the daemon's cleanup error and waits 12s, while the failure came 2.9s into the test. Birth instability is ruled out on arm64 (400 full-table reads under taskpolicy -c background never changed a birth); #62 normalizes both sides.

User impact: agent-heavy cancel N on a job that is ending, with a background child still running, can print the refusal and exit nonzero; repeating succeeds. After a daemon restart, the same state made tick return an error for that tick.

Fix

• VerifyGroupIdentity returns a named error, errGroupOwnershipUnverified, whose text states the group, the recorded members and the current members it compared.
• queueStore.settledAttempt re-reads the row. If the same attempt and worker has published its outcome, there is no worker to signal and the settled job's cleanup owns what is left. Used by queueDaemon.signal, tick for an adopted running row, and the three handover readers in queue_handover.go that already re-read on a vanished group.
• executeWithAttempt no longer stops its SIGINT handling on return, closing path 2. A resend after the command ended is discarded. One before the last check ahead of the command still cancels; one between that check and the command is lost unless a client resends, as on main (window at most 1.7-6.1ms, recorded in the handoff).
• Unchanged: a still-running row with no recorded member left keeps refusing. Nothing is signalled on unverified ownership. Cleanup and install_runtime_generations.go are untouched. install_managed.go, listenQueueSocket and safeQueueSocket are not touched.

Evidence

• Reproduced: the state, by TestSignalFromAStaleRowAfterTheWorkerExited. With only the queue_daemon.go change reverted it fails with compared group N, recorded members [N@...], current members [N+1@...]; with the fix it passes and the group is never signalled.
• Backend tests matching Queue|Handover|Cancel|Ownership|Group|Lease|Signal|Census|Corrupt|RealDaemon: pass. go build ./... && go vet ./...: pass. Race-built real test plus the new test, 120 runs under taskpolicy -c background, before path 2 was closed: pass.
• TestRealDaemonWorkerSurvivesInterruptsWhilePublishing fails with exit=125 want=7 with the handling stopped on return. TestSettledAttemptKeysOnTheSameAttempt fails with the done phase removed. Focused race suite: pass, 140s. An injected 800ms delay before the command showed a cancel still stops it (exit 130), in review of the fix; no test pins that window, because it needs a production hook.
• Not reproduced: the intermittent failure of the real test itself (about 1 in 390 on main under throttling). 120 passes do not show it is gone. Not run: the full backend suite, Intel hardware, a test for the tick path (it reads its own rows, so a stale snapshot cannot be forced without a hook).
• managedHeldByApp on Intel: no link found. The CI failure "An unowned queue process holds its lifetime lock" comes from managedDrain in install_managed.go, which inspects locks and does not use process group ownership.

Handoff: docs/handoffs/cancel-ownership-race.md.

Also on this branch: native/tests/SupervisorTests.swift now waits for the daemon restart that real queue restarts after exit 0 asserts, which fixes the Native failure on this PR's earlier run.

Two more flaky tests from this PR's Intel core-2 run are fixed here. TestCorruptedRowsCancelThroughClient/running_reading_Queued holds its ticks until the daemon has taken the cancel (2 of 60 race runs failed before, 0 of 60 after, on arm64). TestInstallerNewerCopyBesideRunningRecordedAppStops finds app-running by ID, because a helper holding scheduling.lock can put installer-busy ahead of it (0 of 5 after; the failure was not reproduced locally).

🤖 Generated with Claude Code