- JobRegistry.start raises TypeError when neither admission nor
record_changing is given, so a new job never runs as "read" beside a
scan by omission.
- hold() admits when its block is entered, so a hold that is never entered
leaves no running records job behind; callers that answer a refusal in
their own way check blocker() first, with no await before the block.
- A held SSE operation that ends in an error event (thumbnail generation,
legacy batch auto-tag) is listed as failed, and refused input (duplicate
delete without paths, an unreadable thumbnail body) is answered before
the hold, so it is not listed as a job.
- Activity keeps a job's cancellable flag (true when an older server omits
it) and shows Cancel only for a running, cancellable job, in Recent work
and in the job view. A held legacy job no longer offers a Cancel that
does nothing.