cancellation

Unbounded goroutines are the default failure: ten thousand shards means ten thousand concurrent connections and an immediate rate limit. The semaphore pattern, the context that makes cancellation propagate, and the two mistakes that produce a leak nothing reports.

Four resources, one state machine and three semantics that separate a working API from one that corrupts state under retries. The idempotency key that makes a duplicate POST safe, why cancel returns 202 rather than 200, and the cursor that survives concurrent inserts.