Settle canceled Coder turns exactly once and gate the lifecycle end to end #142

Outcome

Every canceled or exited Coder turn reaches one durable terminal state. Transport shutdown, tool cleanup, server thread state, and credit settlement agree, and retries or late events cannot settle the same turn twice.

Scope

• Define the server-visible canceled-turn state and the client report that produces it.
• Settle or release the inference grant and credit receipt exactly once.
• Make cancellation, transport failure, retry exhaustion, tool interruption, normal completion, and application exit mutually exclusive terminal outcomes.
• Define exit behavior while a turn runs and apply the same cleanup and settlement contract.
• Preserve completed transcript and ATIF entries with an explicit canceled outcome.
• Add correlation fields that connect the local turn, server thread, grant, receipt, transport request, and active tools.
• Make report, cancellation, and fallback cleanup idempotent across reconnects and late replies.

Required acceptance cases

• Cancel before the first model event.
• Cancel while assistant text streams.
• Cancel while one tool runs.
• Cancel while multiple tools run.
• Cancel during the three-second waiting state.
• Cancel during retry backoff.
• Receive late events after cancellation without resurrecting the turn.
• Exit while a turn runs under the documented policy.

For every case, assert:

• the composer becomes usable or the application exits as intended;
• the inference transport stops;
• each tool reaches its declared terminal policy;
• the server thread and grant reach one terminal state;
• one credit or settlement record is produced when required;
• no duplicate report, refund, charge, or receipt appears;
• completed transcript content remains;
• ATIF records the canceled or exited outcome;
• a later turn starts with clean state.

Verification

• Use protocol stubs to force every event ordering, including completion racing cancellation.
• Use PTY tests for visible state and terminal cleanup.
• Use integration tests against the thread, grant, and settlement APIs.
• Add a falsifier that deliberately delivers duplicate and late terminal events.

Dependencies

This issue is the final gate over the typed cancellation action, tool cancellation policy, and separate queue and exit controls.