M0-4 · Cancellation probe findings - #56

Closes #5.

Fills docs/M0-FINDINGS.md §M0-4 and folds the results into PROJECT-PLAN.md and STORIES.md. Probe tooling is on spike/m0-4-cancel-probe (never merged), as M0-3's stubs were.

Method

Three runs per harness, each in its own workspace, --mode auto, prompt "read every file one at a time and summarise it" — cancel (or the second prompt) fired on the first tool_call, a protocol event rather than a wall clock, so the three are cut at a comparable point:

1. observe — uninterrupted control. Without it, "the turn ended" cannot be told from "the turn was ending anyway", and the central finding below is unprovable.
2. cancel — session/cancel, then wait (not run.mjs, whose SIGINT path kills at 2 s and would have lost the stop reason), then a follow-up prompt to test session survival. Two samples each.
3. double — a second session/prompt in flight, awaited to completion, marker-tagged.

Cancellation works, and is not the interesting part

M1c-1 gets its missing number: a 2 s grace after session/cancel, then force-kill — 30× the slowest sample, the same grace run.mjs already uses, and expected never to be reached.

Two results the plan did not anticipate

1. Copilot reports end_turn for a turn it cancelled (both samples). The control settles it: 11 events and ~5.6 s against 69 and 36.3 s, with the triggering tool_call never completing. It obeyed and mislabelled the result. Contrary to ACP's MUST ("the Agent MUST respond … with the cancelled stop reason"), and undocumented — GitHub's ACP server reference names stopReason only inside an example, and no github/copilot-cli issue reports it. The same defect was filed against opencode (anomalyco/opencode#25899, closed as not planned), yet opencode answers cancelled here — so versions, not trackers, decide. Every row above is version-pinned for that reason.

2. Every harness accepts a second session/prompt mid-turn. The story's expectation is false three different ways, and the failure is silent each time: nobody rejects it, the in-flight turn dies, and both requests answer end_turn. On opencode and copilot the text is merged into the running turn's context — both models read it as a possible prompt injection — rather than served. github/copilot-cli#4555 has the mechanism: session/prompt calls session.abort() unconditionally, even when idle.

So end_turn now means finished, I was cancelled, or someone interrupted me, depending on harness and circumstance.

Fold-backs

• STORIES.md M1b-2 — the stop-reason table stands; its input does not. Key status on the triple (stopReason, did we cancel, did the watchdog fire), supervisor's record authoritative. Cancelled turns truncate mid-tool-call, so max_tokens's "stopped mid-edit" hazard applies to timed_out.
• STORIES.md M1c-1 — 2 s grace; timed_out set from the watchdog's own record; "no third rung" upgraded from a design preference to a measured rule: one prompt per session per task.
• PROJECT-PLAN.md — Liveness row in the decisions table, agenda item 5 struck, watchdog module bullet carries the grace.
• STORIES.md M0-4 / M0-7 — marked done; M0-5 is the last stub.

Not covered

Two samples per harness for cancellation, one apiece for the other questions, one prompt shape, nothing written to disk during the runs — so cancelling mid-edit is untested and named in the note as the next probe. omp, pi, gemini remain unknown by absence.