[tang-vu]

Why this matters

The Models page can keep Cancel disabled forever when POST /api/models/download/cancel stalls before headers or while reading an error body. Even an acknowledged cancellation holds the same guard while its subsequent status refresh is pending. Three hook-boundary regressions reproduce these cases on public-beta.

Give the acknowledgement a 45-second deadline, longer than the dashboard API's 30-second host-agent request. Retain the last observed transfer state on timeout and tell the operator that cancellation was not acknowledged. Release the duplicate-submission guard after the acknowledgement settles; status polling independently determines whether the transfer actually stopped. There are no automatic retries or optimistic cancelled/success states.

Overlap check

Searched 4,381 open/closed upstream PRs by cancellation, download deadlines and changed-file histories for useDownloadProgress.js, including legacy paths. Compared #3040 (progress percentages and single-flight polling), #3316 (status outage reporting), #3803 (terminal dismissal), and merged #893 (backend cancellation). None bounds cancellation acknowledgements or separates the acknowledgement guard from status refresh. These behaviors remain independent; overlapping hook changes must preserve both contracts when integrated.

Regression and validation

• Three new hook-boundary tests failed on the unchanged production implementation. They cover stalled headers, stalled error bodies, duplicate-click admission, deliberate retry, retained progress, and an acknowledged cancellation with a deferred status refresh.
• Download hook and Models suites: 58 tests passed; the final 45-second deadline was rechecked in the 15 hook tests.
• ESLint, production build, changed-file secret/private-key/large-file checks and git diff --check passed. Existing UI warnings remain.
• Full make gate was attempted: shell syntax/Python compilation passed, then two unchanged no-sudo tests failed under this root/WSL environment. Standalone BATS also retains existing environment failures; all platform smoke tests and installer simulation passed.
• All-file pre-commit passed secret, large-file and shell checks; private-key detection flags unchanged dummy-key fixtures in test_host_agent.py and test-remote-provider-egress-policy.py.

Shared browser behavior on Linux, Windows and macOS; no live download was cancelled. The backend remains authoritative and a lost acknowledgement does not prove the server stopped. Revert restores the former indefinite UI guard without changing stored state or backend lifecycle behavior.

This is PR 1 of an authorized 30-PR quality batch. No dependency on another batch PR. Combined-head validation and hosted CI results will be recorded after the batch candidates are available.