A publish that times out fails open (keep streaming), and every tool call starts behind a publish. If the session actor processed a Cancel and then stalled before answering the gate, the tool started anyway. The Abort kernel interrupt catches that late start only for kernel tools. A tool outside the kernel, such as an MCP call, ran to completion with its result unrecorded. A reply can't carry the cancel here: the gate is the call that got no reply, and every reply after the cancel already says stop. So the run carries a latch (a one-slot atomics ref) that the worker's publish reads only on a timeout. turn.cancel raises it together with the cancelled flag, so the two can't disagree. A stall before the Cancel is processed is still fail-open, as before: until then the session has not cancelled anything. The test cancels a run through turn.cancel and publishes on its latch to a never-replying owner: the gate stays shut. It fails (True should equal False) with the pre-fix timeout policy, and also when turn.cancel does not raise the latch. Signed-off-by: dawn <90008@klbr.net>