feat: support durable task cancellation without foreign keys

pulse/retry/decision.go

@@ -16,7 +16,7 @@ type Input struct {
 	Policy          pulse.RetryPolicy    // Policy 受理时冻结的有限策略。
 	Safety          pulse.RecoverySafety // Safety 仅 IDEMPOTENT 允许未知效果自动恢复。
 	Consumed        uint32               // Consumed 已领取次数，包含本次及未获批开始的尝试。
-	Outcome         string               // Outcome SUCCEEDED、FAILED、UNKNOWN 或 NOT_STARTED。
+	Outcome         string               // Outcome SUCCEEDED、FAILED、UNKNOWN、CANCELLED 或 NOT_STARTED。
 	Retryable       bool                 // Retryable 仅对明确失败有效，Worker 声明可安全重试。
 	Uncertain       bool                 // Uncertain 之前仍未核实的外部效果，失败或超时不能抹掉。
 	CancelRequested bool                 // CancelRequested 已保存取消意图时禁止后续尝试。
@@ -47,6 +47,15 @@ func Decide(in Input) (Decision, error) {
 	switch in.Outcome {
 	case "SUCCEEDED":
 		return Decision{State: pulse.TaskSucceeded, Reason: "SUCCEEDED"}, nil
+	case "CANCELLED":
+		if !in.CancelRequested {
+			return out, errors.New("cancelled result requires persisted intent")
+		}
+		out.State, out.Reason = pulse.TaskCancelled, "CANCEL_CONFIRMED"
+		if in.Uncertain {
+			out.State, out.Reason = pulse.TaskNeedsReview, "RECONCILIATION_REQUIRED"
+		}
+		return out, nil
 	case "FAILED":
 		canRetry = in.Retryable
 		if canRetry {