Cancellation messages are not enough
A worker can lose network access, pause or ignore cancellation while continuing to edit. The scheduler cannot assume that sending stop made the old process harmless.
The receiving authority must validate ownership at the moment a result tries to change project state.
- Lease expiry
- Monotonic generation
- Delivery-time validation
- Idempotent transition
