{
  "schema_version": "1.3.0",
  "slug": "what-invariants-prevent-cancellation-from-racing-with-already-dispatched-work",
  "title": "What invariants prevent cancellation from racing with already-dispatched work?",
  "date_of_record": "2026 November 2",
  "scope": "Applies to cancellation protocols where a cancel message is sent to stop work already in flight. Does not apply to cancellation of not-yet-dispatched work, which is a queue operation rather than a race.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-invariants-prevent-cancellation-from-racing-with-already-dispatched-work.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-invariants-prevent-cancellation-from-racing-with-already-dispatched-work.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-invariants-prevent-cancellation-from-racing-with-already-dispatched-work.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 974,
    "python_slice_tokens": 117,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "Cancellation is not the removal of work; it is a request that in-flight work stop. If the work has already been dispatched to a worker that has begun executing, cancellation can arrive at the worker's queue but not at the worker's hands. The work completes, side effects fire, and the requester believes the work was cancelled. **Invariant.** Cancellation is e...",
    "what_was_observed": "**Signature.** Side effects from work that was logged as cancelled. The requester's cancel record and the worker's execution record both exist, on different sides of the boundary, and neither references the other. **Trace.** Cancellation sent at 100ms. Worker commits at 105ms. Cancellation arrives in worker queue at 110ms. Worker's cancel handler finds the work already complete and exits. Side effect exists; cancel r...",
    "condition_of_validity": "The instance must ensure at least one holds before it treats cancellation as effective: 1. **Must know the cancel deadline.** The last instant at which cancel is effective is defined and communicated; cancel after that deadline is expected to be ineffective. 2. **Must compensate after deadline.** Work that commits after the cancel deadline is compensated (ro...",
    "decision_boundary": "- Cancel arrives before commit: effective. - Cancel arrives after commit, work is compensable, compensation executed: effective via compensation. - Cancel arrives after commit, work is not compensable: cancellation failed; side effect stands and must be surfaced. - Cancel deadline unknown: every cancel is a guess; the boundary between effective and post-comm...",
    "operational_effect": "The invariant couples a request to stop with the reality that dispatched work may not stop. The instance's correct posture is to define the deadline, compensate after it, and surface the gap. **Trap.** Require workers to check cancel before every operation. That closes some races but not the one between \"check cancel\" and \"commit side effect\" — a check is no..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "8ccc4acda5aaacedfd357f99c0314403ceb0ba569129987a4f30048ce136ce5a",
    "verified_classes": [
      "CancelRaceError",
      "CancelGate"
    ],
    "verified_functions": [
      "dispatch_cancel_mode",
      "verify"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "CancelRaceError"
    ],
    "sample_fail_closed_invariants": [
      "cancel arrives after commit and work has no compensation: side effect will persist",
      "cancel deadline undefined: effective-versus-post-commit boundary is undecidable"
    ],
    "stdlib_dependencies": [
      "dataclasses"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}