Cancellation can arrive just as a reservation becomes due. If both paths read old state and the last write wins, cancelled work can run or actual completion can be overwritten. I serialize transitions for one reservation and restrict cancellation to the states in which it still has a truthful meaning.
Read and change state within the same ordered transition
Cancellation and execution claim use the reservation-identity lock. The code rereads current state and decides eligibility inside that ordered boundary, rather than serializing writes while trusting an earlier queued observation.
That ordering lets a request see running or cancelled state established by its predecessor. Without it, two condition checks can both pass on the same stale value. A state machine needs coherent read, decision and write ordering, not merely many descriptive state names and an isolated save function.
When cancellation wins, the due tick must not dispatch
Cancellation is allowed from queued and paused. A claim arriving after cancellation has begun waits for that transition and rereads state. Cancelled items are not dispatched, so a late running write cannot reverse the completed cancellation.
The existing test holds the cancellation save behind a gate while starting a due tick. It requires zero calls for that item while another project progresses, then checks cancelled state on disk after release. That examines retained records and later execution behavior rather than only the return value of the cancellation method.
When execution wins, do not overwrite it as cancelled
If running persistence claims the item first, the later cancellation reads that state and is refused. The execution fact is not overwritten with cancelled. Its actual result still proceeds through success or review handling.
The operator needs to understand why a late cancellation was rejected. This does not mean execution has no stop capability. Cancelling a waiting reservation and stopping an active program have different lifetimes, and delivered service effects need separate reconciliation. One word cannot truthfully represent all three outcomes.
Deletion and resume need the same transition discipline
Project removal uses the same reservation lock to cancel waiting or paused entries without overwriting active execution. Resume checks paused state and a future intended time. Different buttons changing one record still need compatible transition ordering.
The Cafe queue has a separate serialized metadata path rather than the identical per-identity implementation. The shared principle is rereading current state before persisting an allowed transition. Long execution and metadata serialization remain separate. New controls need that specific boundary identified before they can preserve the existing contract.
Distinguish controlled ordering tests from new field verification
The execution-first test holds running persistence, sends cancellation and then releases the gate. Cancellation must fail, dispatch must occur once and success must remain. A removal-first scenario similarly requires zero dispatch. The ordering is controlled rather than left to timing luck.
Historical Electron and MCP tests also delayed the main-process persistence boundary. This publication task reads that code and evidence without manipulating the original application. It does not freshly test every network and storage combination. The two controlled orderings support their precise outcomes, not an unrestricted guarantee against all races.
The actual transition matters more than the last button pressed
Someone pressing cancel late may still expect the interface to say cancelled. If execution already began, that wording would contradict the retained facts. The result should reflect which transition established ownership first rather than whichever button was pressed last.
Approvals and revocations in business software face the same issue. Presently allowed choices differ from events already established. An understandable interface explains why a choice is available now instead of showing the desired word regardless of history. Careful cancellation handling makes that explanation trustworthy.