docs(decopilot): clarify queue cancel/mapper semantics + e2e ownership TODO

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: tlgimenes

apps/mesh/src/api/routes/decopilot/routes.ts

@@ -843,6 +843,12 @@ export function createDecopilotRoutes(deps: DecopilotDeps) {
     const ok = await cancelThreadGateWorkflow(taskId, workflowId);
     if (!ok) return c.body(null, 404);
 
+    // For a running head, also run the full run-cancel teardown (abort + NATS
+    // broadcast + run-registry CANCEL). cancelActiveThreadRun re-cancels the
+    // gate head via cancelThreadGateHead — that re-cancel is idempotent
+    // (DBOS.cancelWorkflows on an already-cancelled workflow is a no-op), so the
+    // explicit cancelThreadGateWorkflow above covers the queued case and this
+    // covers the live run.
     if (target.status === "running") {
       await cancelActiveThreadRun({
         ctx,

apps/mesh/src/dispatch-queue/thread-gate-queue.ts

@@ -18,7 +18,7 @@ export interface ThreadQueueItem {
   enqueuedAt: number;
 }
 
-/** Concatenate the text parts of the last user message. Pure + total. */
+/** Concatenate the text parts of the last user message, concatenated and trimmed for display. Pure + total. */
 export function extractUserMessageText(messages: ChatMessage[]): string {
   if (!Array.isArray(messages) || messages.length === 0) return "";
   const lastUserIdx = messages.findLastIndex((m) => m?.role === "user");
@@ -51,6 +51,8 @@ export function gateStatusToQueueItem(
     workflowId: status.workflowID,
     messageId: status.workflowID.slice(prefix.length),
     text,
+    // Caller (listThreadGateQueue) pre-filters to PENDING/ENQUEUED, so the
+    // else branch is ENQUEUED → "queued".
     status: status.status === "PENDING" ? "running" : "queued",
     enqueuedAt: status.createdAt,
   };

packages/e2e/tests/decopilot-thread-queue.spec.ts

@@ -161,6 +161,11 @@ test("GET queue 403s for a non-owner", async ({ authedPage, playwright }) => {
   await signUpViaApi(otherCtx);
 
   try {
+    // TODO(e2e-hardening): this proves a NON-MEMBER gets 403 (org-membership
+    // middleware). The owner-only guard (validateThreadOwnership: created_by !=
+    // userId) for a non-owner who IS a member of the same org is not yet
+    // covered — add a second org member via an invite/accept fixture and assert
+    // 403 on another member's thread when this suite runs against real infra.
     // The other user tries to read the owner's thread queue — should 403.
     const res = await otherCtx.get(
       `/api/${orgSlug}/decopilot/queue/${threadId}`,