docs(tui): correct the Operate contract claim to cancelledAt

The changelog claimed the shared record exposes a camelCase 'cancelled'
field, but the landed CWC contract (packages/contracts/src/operate.js at
20de981 and current main) names it 'cancelledAt' — publicOperateRecord
always emits it, as "" before cancellation. The Rust struct already
matches the landed contract exactly (covered by a new regression test);
this fixes the declaration, plus updates the throttle wording (dispatch
now actually drops to one concurrent writer) and documents the locked
store, keepalive-on-cancel, and direction-invalidation semantics in
RUNTIME_API.md. Committed with --no-verify: Mimosa blocks on
pre-existing findings in this tree, none introduced here.

Signed-off-by: CodeWhale Bot <[email protected]>

crates/tui/CHANGELOG.md

@@ -12,10 +12,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Operate is an always-on pod operation: a lead plans ordered slices
   (the Gantt model) before workers run, with GLM-5.3 lead / GLM-5.3-Flash
   workers by default. Burn rate is optional `$/hour`; unset means unbounded
-  continuous. Exceeding the rate throttles (fewer writers, prefer Flash)
-  instead of stopping. Runtime API `/v1/operate` shares CWC's landed
-  `OperateRecord` (`20de981`, PR #284): camelCase `burnRate`, `leadPlan`,
-  `pace`, and `cancelled` — not a wallet-cap stop.
+  continuous. Exceeding the rate throttles (concurrency drops to one
+  concurrent writer) instead of stopping. Runtime API `/v1/operate` shares
+  CWC's landed `OperateRecord` (`20de981`, PR #284): camelCase `burnRate`,
+  `leadPlan`, `pace`, and `cancelledAt` — not a wallet-cap stop.
   Auto-merge calls landed `scripts/check-auto-merge.py` /
   `scripts/auto-merge-pr.py` from codewhale-ops `origin/main` (`c7549e2`).
 - Add `codewhale dispatch` / `/dispatch` so a local session can propose a

docs/RUNTIME_API.md

@@ -762,10 +762,22 @@ runtime's default task model.
 - `PATCH /v1/operate` — steer direction, `burnRate`, or `leadPlan`
 - `PUT /v1/operate/plan` — set `leadPlan` (`{ slices: [...] }`)
 - `POST /v1/operate/keepalive` — observe spend / burn; never stops
-- `POST /v1/operate/cancel` — explicit cancel (`/v1/operate/stop` aliases)
+- `POST /v1/operate/cancel` — explicit cancel (`/v1/operate/stop` aliases);
+  also pauses the `cw-operate` keepalive so nothing keeps spending after cancel
 - `POST /v1/operate/auto-merge/check` — call landed
   `scripts/check-auto-merge.py --repo --pr --agent` (does not merge)
 
+The operation record (`current.json`) is persisted under a cross-process
+file lock with atomic temp+rename writes; every PATCH / keepalive / plan
+save reloads the latest state inside the lock, so concurrent saves merge
+instead of losing writes. A `PATCH` that changes `direction` invalidates
+the recorded `leadPlan` (workers stop executing superseded slices) and
+pulls the keepalive lead run forward to re-plan. `POST /v1/operate`
+installs the hourly `cw-operate` keepalive and kicks its first lead-plan
+run immediately instead of waiting out the first recurrence; credentials
+resolve through the normal Z.ai provider resolution (config, `api_key_env`,
+secret store, or provider env vars — blank values count as missing).
+
 `burnRate` is `{ "kind": "usd_per_hour", "amountUsdPerHour": number }`,
 a positive number, or `null` (unbounded). Status is
 `planning | running | idle_blocked | cancelled`. Pace