@@ -63,6 +63,7 @@ A rebase moves the pull request's base. The guarded merge would then scan only t
 | Cancel while waiting | the wait stops at once; the task closes; the job ends `cancelled` |
 | Cancel during the guarded merge | before GitHub is asked, the merge stops and the job ends `cancelled`; once a merge attempt is submitting, a cancel is refused, as before |
 | Shutdown | in shutdown's first, synchronous step, before requests drain, the job is told to stop: a wait ends at once, and nothing after it asks GitHub to merge. A preparation in progress stops only when preparation does, after the drain, as for a `prepare-merge` click; the job then stops without merging. The job is awaited before the store closes. While preparing or waiting, it stays `running` on disk. A guarded merge in progress stops as a click's does: if GitHub was not asked yet, the job stays `running`; if it was, the job ends as the merge attempt records it: `blocked` if GitHub refused (`failed` if the head changed, or the review changed while GitHub was asked), otherwise `submitted`, and the attempt reconciles as before |
+| Ending the job fails | if the write that ends a job fails (a store error, not shutdown), the server logs "Could not end merge job …; it shows as running until the server restarts". The job stays `running` on disk: the page keeps following it, and a new click is refused while it runs. The next start settles it as below |
 | Restart | a `running` job that had not asked GitHub to merge becomes `failed` ("The server restarted before the merge finished"). One that had (its merge action ID is saved before the guarded merge starts) ends as its merge attempt records it: `merged`, `queued`, `submitted`, or `blocked` after a refusal, which also moves the task to approved, merge blocked (`failed`, task unchanged, when the head changed or the review changed while GitHub was asked). A `prepare-merge` action and a push marker are settled as before |
 
 ## Storage
 
@@ -139,7 +139,12 @@ export class MergeJobCoordinator {
 
   #finish(id: string, state: Exclude<MergeJobState, 'running'>, reason: string | null = null, url: string | null = null): void {
     try { this.settle(() => this.service.store.finishMergeJob(this.service.config.identity, id, { state, reason, url })); }
-    catch { /* Startup settles a job that could not be ended now. */ }
+    catch (error) { this.#unended(id, error); }
+  }
+
+  /** Startup settles a job that could not be ended now; until then it shows as running and a new click is refused. */
+  #unended(id: string, error: unknown): void {
+    if (!this.#closing) console.error(`Could not end merge job ${id}; it shows as running until the server restarts: ${(error as Error)?.message ?? String(error)}`);
   }
 
   async #run(job: MergeJob, signal: AbortSignal): Promise<void> {
@@ -219,7 +224,7 @@ export class MergeJobCoordinator {
   #block(job: MergeJob, reason: string, whileReady = false): void {
     const readyFor = whileReady ? { commandPolicyDigest: this.service.commandPolicyDigest() } : undefined;
     try { this.settle(() => this.service.store.blockMergeJob(this.service.config.identity, job.id, reason, readyFor)); }
-    catch { /* Startup settles a job that could not be ended now. */ }
+    catch (error) { this.#unended(job.id, error); }
   }
 
   async #awaitChecks(job: MergeJob, signal: AbortSignal): Promise<CheckVerdict> {
 
@@ -341,6 +341,24 @@ it.each([false, true])('ends submitted, not merged or queued, when GitHub accept
   expect(f.store.getTask(identity).status).toBe('in review');
 });
 
+it.each(['finish', 'block'] as const)('reports a job it could not end (%s), which stays running and refuses a new click until startup settles it', async kind => {
+  const f = setup(kind === 'block' ? { checks: () => [{ context: 'build', appId: null, state: 'failure' }] } : {});
+  const fail = vi.fn(() => { throw new Error('disk full'); });
+  // The finish case ends `submitted` (its attempt's outcome was not saved either), so the task stays in review and a new
+  // click reaches the running-job check.
+  if (kind === 'block') f.store.blockMergeJob = fail;
+  else { f.store.finishMergeJob = fail; f.store.finishMergeAttempt = () => { throw new Error('local refresh failed'); }; }
+  const logged = vi.spyOn(console, 'error').mockImplementation(() => {});
+  try {
+    const started = await f.coordinator.start('review-token', randomUUID());
+    await f.coordinator.current;
+    expect(fail).toHaveBeenCalledTimes(1);
+    expect(logged).toHaveBeenCalledWith(expect.stringMatching(new RegExp(`Could not end merge job ${started.id}; it shows as running until the server restarts: disk full`)));
+    expect(f.store.getMergeJob(identity, started.id)).toMatchObject({ state: 'running' });
+    await expect(f.coordinator.start('review-token', randomUUID())).rejects.toThrow(/already running/);
+  } finally { logged.mockRestore(); }
+});
+
 it('leaves the task approved, merge blocked when a retried job is queued', async () => {
   const f = setup({ queue: true, checks: n => (n === 1 ? [{ context: 'build', appId: null, state: 'failure' }] : []) });
   await f.coordinator.start('review-token', randomUUID());