Cancellation safety: cleanup and committed effects

A request to cancel work can arrive after the operation has acquired a resource, prepared a change, or already committed an effect. Those positions require different cleanup and reporting. Earlier effects remain part of the operation history when the request arrives.

cancellation safety defines where interruption is permitted and what remains true afterward. The contract must account for resource ownership, shared state and any completed effect even when the caller no longer wants the original operation to continue.

The example below uses a local document-update model with cooperative cancellation. It does not specify exception-handler APIs, payment retries, distributed commit or parent-child joining.

Place cancellation commit boundaries on a state diagram

Define five stages: NotStarted, Acquired, Prepared, Committed and Reported. The operation acquires resource R, computes a private prepared update, commits a change to a shared document record, and reports its result.

In the initial document state, a published revision counter is 4. The intended update produces revision 5 under the operation's stated conditions. Preparation is private in this model and has no public document effect.

Acquired means the operation owns R and must eventually release it according to the resource contract. Prepared adds private data that can be discarded if the operation stops before commitment.

Committed means revision 5 has become the visible document state under the model's commit rule. Reported means the caller has received the defined outcome. The time between those stages is relevant because an effect can exist before its response arrives.

The diagram should also identify which boundaries honor a cancellation request. A stage name alone does not establish that stopping there releases every resource or preserves the shared-state rule.

How partial operation cleanup works before commitment

If cancellation is honored in NotStarted, the operation has acquired nothing and changed no document state. Its stopped outcome can correctly describe no effect under these assumptions.

If cancellation arrives after Acquired but before Prepared, cleanup releases R. The document remains at revision 4 because no committed update has occurred. The resource release result still needs to be accounted for.

If cancellation is honored after Prepared, the operation discards its private prepared data and releases R. Again, the public revision remains 4 under the stipulated preparation rule.

The pipeline-backpressure guide provides a resource-accounting comparison for partial operation cleanup. Removing an item from a queue frees its slot while a worker or later stage may still retain its backing object. A full-pipeline charge remains until the relevant owner releases that object. Here, releasing R settles a stated resource obligation; determining whether the document update committed remains a separate check.

If cleanup itself fails or leaves ownership unresolved, a cancellation status cannot silently declare all resource obligations fulfilled. The result must preserve which resource remains owned or otherwise requires reconciliation.

These cases depend on preparation being effect-free under the model. An application that writes externally during its stage named prepare would have another commitment boundary to analyse.

Cleanup after commitment does not reverse the document

Now let the operation reach Committed. Revision 5 is visible. Cancellation arrives before the caller receives the response, and the operation releases R during its final cleanup.

The release changes resource ownership, not the document's revision. Reporting cancelled with an implied claim that nothing happened would contradict the committed state.

An observer might already have read revision 5. The later request to stop cannot remove that observation. Even a subsequent corrective action would be another event, rather than a reversal of everything that was visible.

The operation should preserve its commitment evidence and report the outcome required by the contract. That could be a committed result with cancellation observed, or another explicit status carrying the completed-effect information. The exact vocabulary is a policy choice.

The caller needs to distinguish this committed case from precommit cancellation with no effect. One undifferentiated stopped result would leave the important fact unresolved.

Deferring interruption can protect a small transition

One stipulated design defers cooperative cancellation while it moves through the small transition that commits the revision and records the resulting operation outcome. It honors a pending request at the next permitted boundary.

If the request was honored before entering that transition, no commit occurs. If the transition completed before the request was honored, the result record says revision 5 committed. The deferral prevents cancellation from splitting the specific state-and-outcome step in this model.

The protected transition must have a defined scope. Deferring requests around arbitrary long-running work would change responsiveness and might leave obligations unresolved for a long time. The example makes no timing guarantee for such work.

This reasoning concerns cooperative interruption. It does not establish protection against a process crash, hardware failure or arbitrary termination inside the transition. Those events require separate evidence and recovery assumptions.

The runtime-code-replacement guide offers a state-transition comparison for cancellation commit boundaries. Its replacement protocol records which object format became authoritative, and redirecting an entry back to old code does not reverse a committed conversion. The local document model likewise preserves a completed state change when interruption is observed afterward. Its revision transition remains a document-update example, with no version migration or distributed commitment implied.

Successful recording of the outcome still does not mean the caller has received it. The Reported stage remains an observation to establish separately, particularly when the response path fails or becomes uncertain.

Documented mechanisms show why the boundary needs a precise contract. Python asynchronous task cancellation requests delivery of a cancellation exception at a later execution opportunity and recommends cleanup logic; the request does not guarantee that the coroutine finishes cancelled. PostgreSQL documents transaction changes becoming visible together on commitment and rollback discarding changes within an uncommitted transaction. These sources support the separation between interruption, cleanup and commitment. They do not implement the hypothetical protected document transition described here or establish crash protection for it.

Compensation is a new operation with its own conditions

Another application policy can request a compensating change after revision 5 committed. That action must have defined semantics and authority. It is not supplied by releasing R or by marking the original request cancelled.

Suppose another valid update moves the document to revision 6 before compensation begins. Blindly restoring the old revision-4 snapshot would overwrite that later change. The compensation must account for current state and the operation it is intended to address.

A policy could instead record that the original update is withdrawn while preserving intervening work. Whether that representation fits the application depends on its document semantics. The correction is another visible event with its own outcome.

Deferral and compensation act at different points in the effect history. Deferral protects a small internal transition from cooperative interruption. Compensation acts after an effect exists and must preserve the conditions of later shared state.

Neither approach justifies saying that cancellation itself reversed the update. The report should identify whether no commit occurred, a commit occurred, or a later compensating operation completed.

Define the outcome when request and commitment overlap

Use two abstract histories. In the first, the operation observes cancellation at a permitted precommit boundary and performs cleanup. The caller receives a stopped-before-effect outcome, and the document remains at revision 4.

In the second, the operation enters the protected transition, commits revision 5 and records that result. A cancellation request arrives during the transition and is observed afterward. Under a contract giving completed commitment precedence, the result reports the committed update.

The actual interruption boundary determines which of these outcomes the same cancellation request can legitimately receive. A request timestamp alone does not establish which state transition won under the selected mechanism.

The contract must say how commitment and cancellation observation are ordered. The implementation's evidence must support the declared ordering between the commitment and the observed request.

If commitment cannot be determined from the available evidence, report that uncertainty. It does not establish either no effect or successful completion. The operation remains a reconciliation obligation under the stated policy.

A caller receiving a cancellation-related result should not have to infer the effect from whether cleanup happened. The result and its associated evidence must name the completed or unresolved change directly.

Resource and shared-state obligations can fail independently

An operation can release R correctly after a committed update and still report the wrong effect status. It can also report the committed revision correctly while failing to release R. Those are different defects.

Prepared data can carry another obligation. If the preparation includes temporary state that another component can observe, discarding it needs the appropriate ownership and visibility rule. The initial private-preparation assumption cannot be reused for that expanded model.

The safety argument should therefore inventory resources and effects at each permitted interruption boundary. An undifferentiated cleanup label leaves the settled obligations unidentified.

Commitment evidence should identify the particular update, not only a revision number that another operation could also produce. If the application associates a stable operation identity with its intended content and resulting revision, the reconciliation can compare that record with the actual document change. A bare observation that the counter is now 5 would be insufficient if an unrelated update could have produced 5. The returned outcome should carry that same operation identity so its commitment evidence can be checked against the particular update.

Keep the requested stop and actual interruption point separately from the commitment result. Resource settlement and the caller report also have their own outcomes. Linking those records by operation identity makes a released resource distinguishable from a completed document change.

Test every permitted interruption position

For the hypothetical model, compare cancellation before acquisition, after acquisition, after private preparation, after commitment and after reporting. Inspect the actual resource and document state for each history.

The check must distinguish revision 4 with no effect from revision 5 already committed, even if both paths finish by releasing R. It should also reject a compensation that overwrites the independent revision-6 update under the stated document policy.

For deferred interruption, verify that the small transition's recorded outcome matches its effect before the pending request is honored. A success field that contradicts the document is not completion evidence.

Record an operation's resource ownership beside its committed revision when inspecting a trace on a computing workspace. The Lenovo IdeaPad touch laptop combines a 15.6-inch FHD Touch display with 512GB SSD storage, and its catalogue specifies 16GB DDR4 memory plus the Core i5-1334U processor. Those equipment details identify the workspace. The application trace still has to establish exactly when interruption was honored.

Separate fields for operation identity, caller outcome and resource release make a document-state record easier to reconcile. As another computing-workspace example, the ASUS Vivobook laptop is identified by its 14-inch FHD display; the listing specifies 16GB DDR4 memory and the Core 5 120U processor. The equipment identity can accompany the record, but commitment evidence must identify the particular document update.

If interruption is honored after private preparation, the model leaves revision 4 intact and releases R. If revision 5 committed before interruption was honored, releasing R leaves that change visible. An uncertain commitment requires reconciliation of the identified update. These outcomes need different reports even when every path successfully completes the same resource-release step.