Rust #325: cooperative cancellation delivered to a retried child #873

Part of #325. Found in Security's review of #869.

Current native behavior

A child retried under its retry_policy (#869) gets a new workflow_links row for the same parent run and sequence. Native's cooperative cancellation delivery (validate_child_cancellation_boundary in rust/src/runtime/cooperative.rs) checks three things:

• the call has exactly one link;
• the parent's ChildWorkflowScheduled and ChildRunStarted events name that link;
• each event names the call's cancellation_policy.

After a retry, all three checks fail. So a parent's cooperative cancellation delivered to that child is refused with 409 cancellation_delivery_shape_mismatch before it can reach the current run. This applies to a child with cancellation_policy: try_cancel or wait_cancellation_completed, or parent_close_policy: request_cancellation, under a cooperative worker on protocol 1.20.

The refusal is deterministic, and it happens only for that combination.

What is needed

• A recording of published PHP delivering cooperative cancellation to a retried child. Published 2.11.7's retry ChildRunStarted omits cancellation_policy, so the expected boundary shape is not known from source reading alone.
• Then native follows the call to its current run and link (resolved_child_run_id), accepting the original scheduled event and the latest started event.
• A fixture case, likely an extension of child-retries with a cooperative worker.

🤖 Generated with Claude Code