Cancel Flow

Cancellation is a two-phase operation: the DB is updated first (source of truth), then a signal is published to the NATS CANCEL stream for pull-mode workers. Push-mode executors check cancellation status by querying the DB before each step.

POST /runs/{id}/cancel
     │
     ├──► UPDATE runs SET status='cancelled' in DB
     │    (release scheduler claim, set ended_at)
     │
     └──► publish to NATS CANCEL stream
             ironflow.{p}.{e}.cancel.run.{runID}
                     │
                     │  pull-mode workers receive cancel signal
                     │
                     ▼  push-mode checks DB, not CANCEL stream
             PushExecutor: isRunCancelled(ctx, runID)
             queries DB via store.GetRun() — checks status
             checked before each step execution

If the NATS publish fails, the DB status is reverted to the previous state to maintain consistency.