01 / The operating case
What changes in a real workflow?
A human cancels maintenance task T while a restart action waits in a queue.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Mark task cancelled in authoritative state, revoke descendant grants, invalidate caches and recheck cancellation immediately before executor commit.
InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
The queue worker trusts its startup snapshot and restarts after cancellation.
Evidence to retain
Record cancellation time, revocation propagation, worker check and actual server state.
04 / Canonical scope
Why this reference stands alone
Revocation propagation describes delivery; this page owns task lifecycle and queued action behavior.
Illustrative implementation artifact
Cancellation race test
T0: operator cancels task T
T1: authority store marks T inactive
T2: queue worker resumes action
T3: executor rechecks T and DENIES
T4: verify protected state unchangedPrimary references