Terminal-status repair: residual multi-fault interleavings, turn-identity race window, and broker readiness-probe kills (follow-up to #623)

Background

PR #623 (fixing #612) introduced an atomic terminal-status claim (jobs/<id>.terminal) plus repair machinery (orphan adoption in cancel and SessionEnd, a dead-worker reaper, reassertTerminalClaim) so that any single crash or race cannot lose a job's terminal outcome or orphan a brokered turn. Its published scope boundary deliberately stops at single-fault correctness.

This issue tracks the residual classes beyond that line. Review findings against #623 that fall into these classes are redirected here.

Residuals

• Multi-fault claim/repair interleavings. Two independent faults aligning — e.g. a claimant dying inside the microsecond window between creating the claim file and its first record write, while the worker is simultaneously wedged or another repairer races the same orphan. The current machinery converges these on the next lifecycle event (cancel retry, SessionEnd, reaper) rather than atomically. True atomicity needs cross-process locking (#428 covers the state-file half of that).

• Turn admission slower than the identity-polling budgets. Cancel polls up to 3 s and SessionEnd polls within its interrupt budget for the worker to persist threadId/turnId from the turn/start response. A slower acceptance can still leave a server-side turn uninterrupted after its relay worker is killed. The robust fix is worker-side: when the worker learns its job's terminal claim is taken (it already detects this in its progress updater and completion paths), it should interrupt its own turn before exiting — it always holds the ids and a live connection.

• ensureBrokerSession teardown aggressiveness. It SIGKILLs an existing broker whose endpoint does not answer its short readiness probe — the same kill-under-live-work failure class as #612, on a path #623 does not touch. A slow-but-healthy broker (host under load) can be killed while serving another session.

Related

• #612 (parent bug), PR #623 (single-fault fix with the published scope boundary)
• #245 (broker shutdown timeout handling), #428 (concurrent state writes), #521 (persisted PID/metadata validation) — adjacent residual classes already tracked

Start by reviewing PR #623 and its published scope boundary, then inspect the worker progress-updater and completion paths plus ensureBrokerSession's readiness probe. Trace the multi-fault claim races, slow turn admission, and broker teardown behavior. Done means each residual class has a defined safe handling path without killing live work or leaving a turn uninterrupted.