Make review cancellation wait for authoritative turn terminal

[lynnswap]

Parent: #96

Contract

A successful turn/interrupt response means that cancellation was accepted; it is not review completion. Cleanup and product terminal publication must wait for the authoritative target-turn terminal, except when the interrupt request is explicitly rejected.

UI cancellation and MCP review_cancel must share this owner.

Acceptance criteria

• Accepted or outcome-unknown interrupts wait for the matching turn terminal before cleanup.
• Explicit request rejection returns without waiting for a terminal that cannot arrive.
• When interrupt and terminal-barrier failures overlap, the original typed request error is preserved.
• Source, detached review, redirected child, and stale turn identities cannot satisfy one another's barrier.
• Cleanup, retry, and restart do not delete the review thread before terminal publication and Persist ReviewMonitor-owned review history and logs locally #102 commit.
• Cancellation of one review remains independent of concurrent reviews.
• Deterministic tests cover terminal-before-response, response-before-terminal, request failure, connection failure, retry, duplicate terminal, and shutdown.

Historical evidence

The current behavior was established by PR #90 (4eaeccf) through 9e8be21, 9daf2df, 95b589d, and 1d3336d.

[lynnswap]

Shutdown/restart semantics are now fixed by trigger. Accepted or outcome-unknown interrupt waits for the matching target-turn terminal; explicit rejection is the only no-wait response. Same-account restart() preserves the product review and creates one new attempt; stop(), explicit cancel, account change/sign-out, and app termination terminalize it. Recoverable network loss keeps the product nonterminal; nonrecoverable protocol/process death terminalizes it. A 10-second injected grace only triggers force-close—completion still waits for the real connection and worker termination before committing.

[lynnswap]

Implementation sequencing clarification: Wave 3 will complete the authoritative in-memory terminal-before-cleanup barrier and awaited worker/runtime shutdown, but this issue remains open until Wave 4 connects the durable SQLite terminal commit at that exact boundary. Persistence is not pulled forward into Wave 3.

Application close failure is also fail-visible: ReviewMonitor presents explicit Cancel Quit (default) / Quit Anyway. It never silently reports a clean shutdown. Existing nonthrowing start/restart become no-ops once app-lifetime close begins; throwing review/MCP mutations report the typed closed state.

[lynnswap]

Wave 3 is now design-gated as three sequential local slices. Wave 3A (attempt start/cancel plus AppServer interrupt/connection barrier) has started on codex/recovery-wave-3a from integration checkpoint 90d5488 (code checkpoint 287795d). Wave 3B will add Store/Host/MCP close authority; Wave 3C will add ReviewUI/application termination.

The committed contract is Docs/recovery-wave-3-task-brief-2026-08-20.md; independent semantic and API/concurrency re-gates reported zero blockers. This issue remains open through Wave 4 because durable #102 commit-before-cleanup is part of its final acceptance.

[lynnswap]

Dependency update: the throwing runtime/process close and joined generation owner in this issue are prerequisites for #113 LoginStagingLease consumers. Wave 3A code/tests are complete on remote branch codex/recovery-wave-3a at 202ca65, but its exact-base Codex review remains pending because advertised review_await is currently unroutable; this issue stays open.