Verify final submitted compact cancellation candidate

.github/workflows/tests.yml

@@ -1,31 +1,15 @@
 name: Tests
-
-# Builds, type-checks and runs every test suite on a clean GitHub runner, and records the file
-# list each published package would contain. Each suite is its own job so one failure does not
-# hide the others. No provider credentials or operator configuration are supplied.
-# Package suites deny external networking; scenario runtime has no external route.
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
+on: workflow_dispatch
 permissions:
   contents: read
-
-concurrency:
-  group: tests-${{ github.event_name }}-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
-  build-and-package:
+  compact-unconfirmed:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
         with:
+          ref: a479997317be1795d443968641194708fbff9e9a
           persist-credentials: false
       - uses: actions/setup-node@v4
         with:
@@ -33,110 +17,26 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run build
-      - name: Record the published file list of each package
+      - name: Cancellation and affected compaction regressions
+        shell: bash
         run: |
-          set -euo pipefail
-          mkdir -p pack-lists
-          for p in cli daemon tui; do
-            (cd packages/$p && npm pack --dry-run --json --ignore-scripts) \
-              | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{for(const f of JSON.parse(s)[0].files)console.log(f.path)})' \
-              | sort > pack-lists/$p.txt
-            echo "$p: $(wc -l < pack-lists/$p.txt) files"
-          done
-      - uses: actions/upload-artifact@v4
-        with:
-          name: pack-lists
-          path: pack-lists/
-
-  typecheck:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run lint
-
-  repo-checks:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run test:repo
-
-  package-tests:
-    if: ${{ github.event_name != 'push' }}
-    # macOS, the platform OpenRig runs on: several daemon and cli tests read macOS ps columns,
-    # file-inode behaviour and release tags.
-    runs-on: macos-latest
-    timeout-minutes: 45
-    strategy:
-      fail-fast: false
-      matrix:
-        package: [daemon, cli, tui, ui]
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: brew install tmux
-      - run: npm ci
-      - name: Build the packages the tests import
-        run: npm run build
-      - name: Run the suite without ambient credentials or external network
-        run: |
-          suite_root=$(mktemp -d "$RUNNER_TEMP/opr-test.XXXXXX")
-          suite_root=$(cd "$suite_root" && pwd -P)
-          mkdir -p "$suite_root/home" "$suite_root/bin"
-          # Same system bytes, nonprivileged mode; no system file is changed.
-          /usr/bin/install -m 0755 /bin/ps "$suite_root/bin/ps"
-          # Only this job's temporary sockets (including tmux) are reachable.
-          env -i HOME="$suite_root/home" PATH="$PATH" TMPDIR="$suite_root" TMUX_TMPDIR="$suite_root" \
-            CI=true TERM=xterm-256color \
-            sandbox-exec -D IPC_ROOT="$suite_root" -p '(version 1)(allow default)(deny network-outbound)(allow network-outbound (remote ip "localhost:*"))(allow network-outbound (subpath (param "IPC_ROOT")))' \
-            /bin/bash -s "${{ matrix.package }}" <<'SUITE'
-          set -euo pipefail
-          node scripts/ci-macos-process-probe.mjs
-          # The production readers use bare ps. Select real system bytes only after
-          # self/owned-child observation and network/IPC confinement are proved.
-          export PATH="$TMPDIR/bin:$PATH"
-          test "$(command -v ps)" = "$TMPDIR/bin/ps"
-          exec npm run test -w "packages/$1"
-          SUITE
-
-  installed-scenario:
-    runs-on: ubuntu-latest
-    timeout-minutes: 35
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - name: Installed package, daemon restart, and seeded durability failure
-        run: bash scripts/run-pr-scenarios.sh
+          set +e
+          set -uo pipefail
+          mkdir -p proof
+          git rev-parse HEAD HEAD^{tree} > proof/source.txt
+          node --version > proof/node-version.txt
+          npm --workspace @openrig/daemon test -- test/compaction-command-submission.test.ts test/compaction-preparation.test.ts test/compaction-generation.test.ts test/compaction-routes.test.ts test/compaction-drain-readiness.test.ts test/claude-compaction-enforcer.test.ts test/compaction-draft-aware.test.ts test/compaction-clock-injection.test.ts test/claude-idle-compaction.test.ts test/context-monitor-compaction-race.test.ts test/managed-compaction-effect.test.ts test/send-during-compaction-notice.test.ts --reporter=verbose 2>&1 | tee proof/daemon.log
+          result=${PIPESTATUS[0]}
+          npm --workspace @openrig/cli test -- test/compact.test.ts --reporter=verbose 2>&1 | tee proof/cli.log
+          cli_result=${PIPESTATUS[0]}
+          npm run lint 2>&1 | tee proof/typecheck.log
+          lint_result=${PIPESTATUS[0]}
+          git diff --exit-code > proof/source-unchanged.txt
+          printf 'daemon=%s\ncli=%s\ntypecheck=%s\n' "$result" "$cli_result" "$lint_result" > proof/exits.txt
+          test "$result" -eq 0 && test "$cli_result" -eq 0 && test "$lint_result" -eq 0
       - uses: actions/upload-artifact@v4
         if: always()
         with:
-          name: installed-scenario-evidence
-          path: dist/pr-scenarios/
+          name: compact-unconfirmed-final
+          path: proof/
           if-no-files-found: error

packages/cli/src/commands/compact.ts

@@ -25,7 +25,7 @@ export function compactCommand(depsOverride?: CompactDeps): Command {
     .argument("<session>", "Target Claude session name (e.g. dev-impl@my-rig)")
     .option("--json", "JSON output for agents")
     .option("--skip-map", "Skip the restore-map prerequisite once; keep target, idle and permission checks")
-    .option("--cancel", "End the current preparation and disarm its future compact")
+    .option("--cancel", "Disarm managed preparation or pending restore/audit; cannot undo a submitted /compact")
     .option("--state", "Show the current preparation, expected map and deadline without triggering")
     .addHelpText("after", `
 Examples:
@@ -44,7 +44,10 @@ the preparation prompt's delivery, and the /compact result: "submitted, unconfir
 means /compact and Enter reached the seat; OpenRig does not check that compaction
 then ran. Ordinary approvals during preparation can be answered within that same deadline;
 OpenRig does not answer them. Automatic /compact, like manual, is sent only to an idle seat.
---cancel ends preparation. --skip-map skips only the map requirement for this one
+--cancel disarms preparation and pending restore/audit prompts without sending input.
+An already submitted /compact stays unconfirmed: cancellation cannot undo it or prove
+it never ran. An explicit retry still waits for the live pane to be idle; no automatic
+retry follows cancellation. --skip-map skips only the map requirement for this one
 manual request. Cancel an active preparation before retrying or using --skip-map.
 Automatic preparation waits at most 25 minutes from prep delivery, using existing
 polls. A stopped attempt does not restart automatically; rerun this command to

packages/cli/test/compact.test.ts

@@ -35,3 +35,17 @@ it('state and cancel reach an authenticated daemon; a missing bearer stays rejec
 it('a triggered compaction is reported as submitted, unconfirmed, never as having run',async()=>{const f=fixture();await f.cmd.parseAsync(['node','rig','writer@demo']);const out=(console.log as any).mock.calls.map((c:unknown[])=>String(c[0])).join('\n');expect(out).toContain('Manual compaction for writer@demo: submitted, unconfirmed (stage: compact-sent)');expect(out).not.toMatch(/compaction triggered|compacted/i);});
 
 it('manual help binds180s preparation and preserves automatic25minutes',()=>{const f=fixture();let text='';f.cmd.configureOutput({writeOut:value=>{text+=value;}});f.cmd.outputHelp();expect(text).toContain('180 seconds');expect(text).toContain('25 minutes');expect(text).toContain('expiry disarms that attempt');});
+
+// The cancellation receipt must retain uncertainty for both human and JSON callers.
+for (const json of [false, true]) {
+ it(`cancel displays the submitted-unconfirmed receipt without triggering (json=${json})`,async()=>{
+  const f=fixture();
+  f.post.mockResolvedValueOnce({status:200,data:{preparation:{status:'stopped',compact:'submitted_unconfirmed'},guidance:'Cancellation cannot undo a submitted /compact.'}} as any);
+  await f.cmd.parseAsync(['node','rig','writer@demo','--cancel',...(json?['--json']:[])]);
+  const output=JSON.parse(String((console.log as any).mock.calls[0][0]));
+  expect(output.preparation).toMatchObject({status:'stopped',compact:'submitted_unconfirmed'});
+  expect(output.guidance).toContain('cannot undo');
+  expect(f.post).toHaveBeenCalledTimes(1);
+  expect(f.post.mock.calls[0]?.[0]).toBe('/api/compaction/cancel');
+ });
+}

packages/daemon/src/domain/claude-compaction-enforcer.ts

@@ -91,6 +91,7 @@ export type ManualCompactionStage =
   | "compact-sent"
   | "restore-sent"
   | "audit-sent"
+  | "cancelled"
   | "skipped-or-failed";
 
 export interface ManualCompactionStatus {
@@ -578,7 +579,14 @@ export class ClaudeCompactionEnforcer {
   ): Promise<EnforcerOutcome | null> {
     // A missing or still-high sample need not show that /compact has finished. The newest idle
     // hook can predate it, so these drains require a live pane read to establish idle.
+    const pendingStage = this.pendingPostCompactRestore.get(input.sessionName);
+    const attempt = this.pendingPreCompactPrep.get(input.sessionName);
+    const isCurrent = () => this.pendingPostCompactRestore.get(input.sessionName) === pendingStage
+      && this.pendingPreCompactPrep.get(input.sessionName) === attempt;
     const sendOpts = {
+      beforeWrite: () => {
+        if (!isCurrent()) throw new DeliveryGuardError("compaction_cancelled", "Managed compaction was cancelled or replaced; no further input is authorized.");
+      },
       waitForIdleMs: this.postCompactSendWaitMs,
       ...(input.usedPercentage == null || input.usedPercentage >= policy.thresholdPercent ? { readinessFromPaneOnly: true } : {}),
     };
@@ -609,13 +617,13 @@ export class ClaudeCompactionEnforcer {
         return { triggered: false, reason: "stale_generation" };
       }
     }
-    const pendingStage = this.pendingPostCompactRestore.get(input.sessionName);
     if (pendingStage === "turn_boundary") {
       const boundary = await this.sessionTransport.send(
         input.sessionName,
         buildPostCompactTurnBoundaryPrompt(),
         sendOpts,
       );
+      if (!isCurrent()) return { triggered: false, reason: "preparation_stopped" };
       if (!boundary.ok || boundary.outcome === "retained") {
         // Busy/never-idle → no delivery, no advance; the SAME stage retries next tick.
         return { triggered: false, reason: "send_failed" };
@@ -642,6 +650,7 @@ export class ClaudeCompactionEnforcer {
         }),
         sendOpts,
       );
+      if (!isCurrent()) return { triggered: false, reason: "preparation_stopped" };
       if (!restore.ok || restore.outcome === "retained") {
         // Restore is exact-once + operator-authorized: if the seat is still busy
         // (mid-compaction/boundary), do NOT advance to restore-sent on an
@@ -660,6 +669,7 @@ export class ClaudeCompactionEnforcer {
         buildPostCompactCompliancePrompt(policy.postRestoreAuditInstruction),
         sendOpts,
       );
+      if (!isCurrent()) return { triggered: false, reason: "preparation_stopped" };
       if (!compliance.ok || compliance.outcome === "retained") {
         // Audit cannot overtake restore: only advances once the restore turn is
         // idle and this send delivers; a busy tick retries the SAME stage.
@@ -678,6 +688,7 @@ export class ClaudeCompactionEnforcer {
           saturationBoundPercentage: policy.thresholdPercent,
         });
       }
+      if (!isCurrent()) return { triggered: false, reason: "preparation_stopped" };
       this.pendingPostCompactRestore.delete(input.sessionName);
       this.restoreCarry.delete(input.sessionName);
       if (this.pendingPreCompactPrep.get(input.sessionName)?.status === "compact-sent") this.pendingPreCompactPrep.delete(input.sessionName);
@@ -1017,6 +1028,7 @@ export class ClaudeCompactionEnforcer {
       return { ok: false, reason };
     }
     attempt.compact = "submitted_unconfirmed";
+    if (attempt.controller.signal.aborted) return { ok: false, reason: attempt.reason };
     // Whatever the command could not carry, the restore request carries instead.
     if (skipMap || !composed.mapPathInCommand || !composed.instructionInCommand) {
       this.restoreCarry.set(input.sessionName, {
@@ -1025,7 +1037,6 @@ export class ClaudeCompactionEnforcer {
         ...(skipMap ? { skipMap: { mapPath: attempt.mapPath, marker: attempt.marker } } : {}),
       });
     } else this.restoreCarry.delete(input.sessionName);
-    if (attempt.controller.signal.aborted) return { ok: false, reason: attempt.reason };
     attempt.status = "compact-sent";
     this.lastAutoCompactAt.set(input.sessionName, this.now());
     this.triggeredAboveThreshold.add(input.sessionName);
@@ -1070,7 +1081,21 @@ export class ClaudeCompactionEnforcer {
   }
 
   cancelPreparation(session: string): PreparationState | null {
-    this.stopPreparation(session, "preparation_cancelled");
+    const attempt = this.pendingPreCompactPrep.get(session);
+    if (attempt?.status === "compact-sent" || this.pendingPostCompactRestore.has(session)) {
+      // Abandon management, not the provider command: keep its unconfirmed receipt and map.
+      // Do not clear automatic dedup/re-arm state or send any input. A later explicit retry
+      // still requires a new preparation and the live-pane idle check before /compact.
+      if (attempt) {
+        attempt.status = "stopped";
+        attempt.reason = "compaction_cancelled";
+        attempt.controller.abort();
+      }
+      this.pendingPostCompactRestore.delete(session);
+      this.pendingStageGeneration.delete(session);
+      this.restoreCarry.delete(session);
+      this.setManualStage(session, "cancelled", "compaction_cancelled");
+    } else this.stopPreparation(session, "preparation_cancelled");
     return this.getPreparationState(session);
   }
 

packages/daemon/src/routes/compaction.ts

@@ -124,7 +124,11 @@ export function compactionRoutes(opts?: { bearerToken?: string | null }): Hono {
     if (!body.session) return c.json({ ok: false, error: "Missing required field: session" }, 400);
     const resolved = await transport.resolveSessions({ session: body.session });
     if (!resolved.ok) return c.json({ ok: false, error: resolved.error }, resolved.code === "ambiguous" ? 409 : 404);
-    return c.json({ ok: true, session: body.session, preparation: enforcer.cancelPreparation(body.session) });
+    const preparation = enforcer.cancelPreparation(body.session);
+    return c.json({ ok: true, session: body.session, preparation,
+      ...(preparation ? { compact: compactResultText(preparation.compact) } : {}),
+      guidance: "Managed preparation and pending restore/audit are disarmed. Cancellation sent no input. It cannot undo a submitted /compact or confirm whether it ran. An explicit retry still requires the live pane to be idle.",
+    });
   });
 
   router.get("/state", (c) => {

packages/daemon/test/claude-compaction-enforcer.test.ts

@@ -444,7 +444,7 @@ describe("ClaudeCompactionEnforcer", () => {
     send.mockResolvedValueOnce(held);
     expect(await highTick()).toEqual({ triggered: false, reason: "send_failed" });
     expect(send.mock.calls.at(-1)?.[1]).toContain("restoring this Claude session after compaction");
-    expect(send.mock.calls.at(-1)?.[2]).toEqual({ waitForIdleMs: expect.any(Number), readinessFromPaneOnly: true });
+    expect(send.mock.calls.at(-1)?.[2]).toEqual({ waitForIdleMs: expect.any(Number), readinessFromPaneOnly: true, beforeWrite: expect.any(Function) });
     expect(await highTick()).toEqual({ triggered: true });
     expect(send.mock.calls.at(-1)?.[1]).toContain("restoring this Claude session after compaction");
     expect(await highTick()).toEqual({ triggered: true });
@@ -496,7 +496,7 @@ describe("ClaudeCompactionEnforcer", () => {
     expect(send.mock.calls[queuedSends + 2]?.[1]).toContain("Now audit your compaction restore");
     // Without a sample, every stage's send must read the pane: no hook may stand in for it.
     for (let i = 0; i < 3; i++) {
-      expect(send.mock.calls[queuedSends + i]?.[2]).toEqual({ waitForIdleMs: expect.any(Number), readinessFromPaneOnly: true });
+      expect(send.mock.calls[queuedSends + i]?.[2]).toEqual({ waitForIdleMs: expect.any(Number), readinessFromPaneOnly: true, beforeWrite: expect.any(Function) });
     }
 
     expect(enforcer.hasPendingPostCompactStage("claude-seat@rig")).toBe(false);
@@ -507,7 +507,7 @@ describe("ClaudeCompactionEnforcer", () => {
   it("the sampled drain keeps ordinary send readiness", async () => {
     const { enforcer, send, queuedSends } = await queueStageWithGen("gen-uuid-1");
     expect(await belowTick(enforcer)).toEqual({ triggered: true });
-    expect(send.mock.calls[queuedSends]?.[2]).toEqual({ waitForIdleMs: expect.any(Number) });
+    expect(send.mock.calls[queuedSends]?.[2]).toEqual({ waitForIdleMs: expect.any(Number), beforeWrite: expect.any(Function) });
   });
 
   it("the restore prompt tells a seat that did not compact to say so and skip the restore reading", () => {
@@ -1414,7 +1414,7 @@ describe("ClaudeCompactionEnforcer", () => {
         sessionName: SEAT, runtime: "claude-code", usedPercentage: 95,
       })).toEqual({ triggered: true }); // owed turn boundary, not another prep
       expect(send).toHaveBeenCalledTimes(3);
-      expect(send).toHaveBeenLastCalledWith(SEAT, expect.stringContaining("OpenRig post-compaction turn boundary"), { waitForIdleMs: expect.any(Number), readinessFromPaneOnly: true });
+      expect(send).toHaveBeenLastCalledWith(SEAT, expect.stringContaining("OpenRig post-compaction turn boundary"), { waitForIdleMs: expect.any(Number), readinessFromPaneOnly: true, beforeWrite: expect.any(Function) });
       expect(await enforcer.maybeAutoCompact({
         sessionName: SEAT, runtime: "claude-code", usedPercentage: 20, transcriptPath: "/tmp/claude.jsonl",
       })).toEqual({ triggered: true }); // restore
@@ -1489,7 +1489,7 @@ describe("ClaudeCompactionEnforcer", () => {
       expect(enforcer.getManualCompactionState(SEAT)?.stage).toBe("compact-sent"); // busy timeout does NOT advance to restore-sent
       const restoreCall = send.mock.calls.find(isRestore);
       expect(restoreCall, "restore send must be attempted with an idle gate").toBeDefined();
-      expect(restoreCall![2]).toEqual({ waitForIdleMs: expect.any(Number) }); // idle-gated, not a busy-pane fire-and-forget
+      expect(restoreCall![2]).toEqual({ waitForIdleMs: expect.any(Number), beforeWrite: expect.any(Function) }); // idle-gated, not a busy-pane fire-and-forget
       expect(send.mock.calls.some(isAudit)).toBe(false); // audit cannot overtake restore
 
       // Claude goes idle → the SAME restore stage delivers and advances ONCE.

packages/daemon/test/compaction-command-submission.test.ts

@@ -537,3 +537,115 @@ it('a real zero-input refusal through the transport (the pane is stuck in a tmux
   for (let i = 0; i < 3; i++) await f.e.maybeAutoCompact(input);
   expect(compactWrites(f)).toBe(0);
 });
+
+
+it('cancel disarms a submitted manual attempt without claiming it failed or sending input; an explicit retry uses a fresh map', async () => {
+  const f = fixture();
+  f.onSleep(() => f.stageMap());
+  expect(await f.e.triggerManualCompact(input, {operatorInitiated: true})).toMatchObject({triggered: true});
+  const previous = f.e.getPreparationState(seat)!;
+  const before = [...f.events];
+  const app = new Hono();
+  app.use('*', async (c, next) => {
+    c.set('compactionEnforcer' as never, f.e);
+    c.set('sessionTransport' as never, f.transport);
+    await next();
+  });
+  app.route('/api/compaction', compactionRoutes());
+  vi.spyOn(f.transport, 'resolveSessions').mockResolvedValue({ok: true, sessions: [seat]} as any);
+  const response = await app.request('/api/compaction/cancel', {
+    method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({session: seat}),
+  });
+  expect(response.status).toBe(200);
+  expect(await response.json()).toMatchObject({ok: true, preparation: {
+    attemptId: previous.attemptId, status: 'stopped', reason: 'compaction_cancelled', compact: 'submitted_unconfirmed',
+  }});
+  expect(f.e.getManualCompactionState(seat)).toMatchObject({stage: 'cancelled', reason: 'compaction_cancelled'});
+  expect(f.e.observedCompaction(seat)).toBeNull();
+  expect(f.e.hasPendingPostCompactStage(seat)).toBe(false);
+  expect(await f.e.drainPendingPostCompactStage(input)).toEqual({triggered: false, reason: 'no_pending_stage'});
+  f.advance(61_000);
+  await f.e.maybeAutoCompact(input);
+  expect(f.events).toEqual(before); // no automatic retry, restore, audit, or cancellation keystroke
+  expect(await f.e.triggerManualCompact(input, {operatorInitiated: true})).toMatchObject({triggered: true});
+  const next = f.e.getPreparationState(seat)!;
+  expect(next.attemptId).not.toBe(previous.attemptId);
+  expect(next.mapPath).not.toBe(previous.mapPath);
+  expect(f.texts().filter((t) => t.startsWith('/compact'))).toHaveLength(2);
+});
+
+for (const activity of ['running', 'unknown']) {
+  it(`cancel preserves the unconfirmed receipt, and a ${activity} pane cannot get a second /compact through a stale idle hook`, async () => {
+    const f = fixture();
+    await f.e.triggerManualCompact(input, {operatorInitiated: true, skipMap: true});
+    expect(f.e.cancelPreparation(seat)).toMatchObject({status: 'stopped', compact: 'submitted_unconfirmed'});
+    f.activity(activity);
+    f.hook('idle');
+    const retry = await f.e.triggerManualCompact(input, {operatorInitiated: true, skipMap: true});
+    expect(retry).toMatchObject({triggered: false, reason: activity === 'unknown' ? 'target_activity_unknown' : 'wait_for_idle_timeout'});
+    expect(f.texts().filter((t) => t.startsWith('/compact'))).toHaveLength(1);
+    expect(f.e.getPreparationState(seat)).toMatchObject({status: 'stopped', compact: 'not_sent'});
+  });
+}
+
+it('cancel fences a pending back-half pane read before any text or Enter can land', async () => {
+  const f = fixture();
+  await f.e.triggerManualCompact(input, {operatorInitiated: true, skipMap: true});
+  const before = [...f.events];
+  let release!: () => void;
+  const blocked = new Promise<void>((r) => { release = r; });
+  let entered!: () => void;
+  const reading = new Promise<void>((r) => { entered = r; });
+  vi.spyOn(f.transport as any, 'classifySendReadiness').mockImplementation(async () => {
+    entered(); await blocked; return {state: 'idle', reason: 'fixture', evidenceSource: 'fixture'};
+  });
+  const drain = f.e.drainPendingPostCompactStage(input);
+  await reading;
+  f.e.cancelPreparation(seat);
+  release();
+  await drain;
+  expect(f.events).toEqual(before);
+  expect(f.e.hasPendingPostCompactStage(seat)).toBe(false);
+  expect(f.e.getManualCompactionState(seat)?.stage).toBe('cancelled');
+});
+
+it('cancel after a back-half paste prevents Enter and does not resurrect the next stage', async () => {
+  const f = fixture();
+  await f.e.triggerManualCompact(input, {operatorInitiated: true, skipMap: true});
+  const before = f.events.length;
+  f.onText(() => { f.e.cancelPreparation(seat); });
+  await f.e.drainPendingPostCompactStage(input);
+  expect(f.events.slice(before).filter((ev) => ev.kind === 'keys' && ev.keys.includes('Enter'))).toEqual([]);
+  expect(f.e.hasPendingPostCompactStage(seat)).toBe(false);
+  expect(f.e.getPreparationState(seat)).toMatchObject({status: 'stopped', compact: 'submitted_unconfirmed'});
+});
+
+it('cancel after a back-half send settles prevents its late receipt from rearming restore', async () => {
+  const f = fixture();
+  await f.e.triggerManualCompact(input, {operatorInitiated: true, skipMap: true});
+  const real = f.transport.send.bind(f.transport);
+  vi.spyOn(f.transport, 'send').mockImplementation(async (...args) => {
+    const result = await real(...args);
+    f.e.cancelPreparation(seat);
+    return result;
+  });
+  await f.e.drainPendingPostCompactStage(input);
+  expect(f.e.hasPendingPostCompactStage(seat)).toBe(false);
+  const after = [...f.events];
+  await f.e.drainPendingPostCompactStage(input);
+  expect(f.events).toEqual(after);
+});
+
+for (const completedStages of [1, 2]) {
+  it(`cancel disarms the remaining restore/audit after ${completedStages} completed back-half stages`, async () => {
+    const f = fixture();
+    await f.e.triggerManualCompact(input, {operatorInitiated: true, skipMap: true});
+    for (let i = 0; i < completedStages; i++) await f.e.drainPendingPostCompactStage(input);
+    const before = [...f.events];
+    f.e.cancelPreparation(seat);
+    expect(f.e.getPreparationState(seat)).toMatchObject({status: 'stopped', compact: 'submitted_unconfirmed'});
+    expect(f.e.getManualCompactionState(seat)?.stage).toBe('cancelled');
+    expect(await f.e.drainPendingPostCompactStage(input)).toEqual({triggered: false, reason: 'no_pending_stage'});
+    expect(f.events).toEqual(before);
+  });
+}