[Richard-LZ-Zhang]

Summary

A routed bucket parent could stay cancelling indefinitely after a venue acknowledged cancellation while still reporting its child open: later child updates and timer ticks were gated on working. Routing-boundary stops could also receive callbacks before leaving working.

Enter cancelling before requesting cancellations, keep processing child results and retry cleanup on timer ticks, and prevent replacement allocations while stopping. Preserve the original incomplete ending across retries and restart; a complete fill wins over cancellation. Existing public statuses and stop reasons remain unchanged.

Includes the requested readability checkpoint: descriptive risk/controller/callback names, purpose comments, _replan stages, and local lifecycle walkthroughs. Integrates the current experimental base, including updated RFQ callers. Python names are intentionally changed on this development branch; HTTP contracts are unchanged.

Test coverage and verification

• Full offline pure-Python SDK suite after integrating current experimental base: 2,752 passed, 684 skipped, 141 deselected.
• Final routed cancellation/recovery suite, including two additional SQLite close/reopen cases: 33 passed.
• Terminal consumer backend: 43 passed, importing this SDK checkout; offline consumer import smoke check passed.
• Cases cover delayed cancellation confirmation, partial/full fill races, open responses, response timeout/retry, synchronous callbacks, explicit expiry, new/legacy snapshots and actual SQLite restart without new allocations.
• Native Rust and PostgreSQL verification remain GitHub CI gates; local pure-Python results do not claim that coverage. No credentialed venue tests were run.

Review

/review covered scope, concurrency, callers/contracts, tests, maintainability, security/performance and an independent adversarial pass. Corrected two stale RFQ method references; added actual database restart tests; clarified internal journal downgrade documentation. No unresolved introduced defect identified by those passes. Independent CLI review also reported no introduced bugs; its runtime attempt lacked eth_utils, while the parent environment produced the passing test evidence above. GitHub CI remains pending.

Documentation

Lifecycle documentation is alongside the implementation. Engine README clarifies that some upstream downgrade functions remove fields or recreate tables empty. No website documentation or SDK release/version changes.

Rollout and scope

Merge into codex/order-lifecycle-storage only. This is a feature PR into the terminal-compatible experimental branch; it does not merge the umbrella experimental PR into public main, create a release or publish to PyPI.

Workspace PR https://github.com/Synpath-ai/prediction_market/pull/106 now follows the latest codex/order-lifecycle-storage commit, per the agreed development policy. It removes the fixed workspace SHA pin, verifies existing clean checkouts against the latest remote tip without changing local files, and records tested commits in CI evidence. SDK-first landing, backups and rollback limits are documented there. This SDK PR merged after all native/pure-Python, Rust and PostgreSQL CI passed.

The cancellation patch adds a field to existing managed snapshots and adds no migration. The workspace's older pin-to-pin upgrade includes other upstream changes and migrations; its rollout plan covers that wider upgrade.

Failed venue reads, uncertain sends, routing-time cancellation acknowledgments, consistent stop reasons, bucket synchronization and amendments remain deferred. This PR handles tracked-child stopping and does not establish complete recovery safety for unattended live routing.