You cancelled the run - did the work actually stop? This service re-probes each dispatched leg's downstream state and receipts the answer, per leg: stopped, landed before the cancel, still running, or honestly unknown.
MCP cancellation is a notification, not a request: the specification forbids a response, receivers only SHOULD stop and MAY ignore the signal, and frameworks offer no hard-stop API - so after every timeout, user Stop, and budget halt, the operator is forced to decide blind: re-issue (risking a duplicate effect if the first leg actually landed) or move on (risking the cancelled work completing unwanted). A harness audit measured the leak directly - 2 of 4 in-flight work classes uncancelled, up to about 9 model calls continuing after Stop while the bill continued. This service closes that moment. Submit the cancel record and it actively re-probes each leg's downstream state on servers you do not control - status and idempotency surfaces, resource state, task/status surfaces where they exist - and returns an HMAC-signed receipt with a per-leg four-state verdict: STOPPED-CONFIRMED, LANDED-BEFORE-CANCEL (with the effect evidence and its timing graded against the cancel timestamp, so "landed after the cancel" is distinguishable from "landed before it"), STILL-RUNNING (re-probed a bounded number of times before the receipt issues), or UNKNOWN - a first-class signed verdict naming the probe attempted and its cause, never folded into STOPPED. Corroboration never rides the request: probes resolve only against a server-side registry populated out-of-band, and caller fields claiming a verdict are stripped. Every receipt names the probe class used per leg, so routing is auditable.
Per-leg verdict $0.01 (x402) · Full cancel audit $4.99 per cancel event · Operator plan $9.99/operator/mo (exactly 1,000 leg verdicts + 20 cancel audits, simple-probe legs) · Fleet plan $19.99/operator/mo (exactly 10,000 leg verdicts + 200 cancel audits, simple-probe legs) · past-count use meters at $0.01/leg and $4.99/audit · deep-probe legs fronted exact quote only. One free full cancel audit per operator, ever (simple-probe legs only).
Stated plainly, because the lab proved the boundaries: UNKNOWN is a first-class signed verdict, never folded into STOPPED - a leg with no decidable surface can only ever return UNKNOWN; real-server probe coverage and the real-world UNKNOWN rate are unmeasured - the mechanism is proven against simulators modelling the documented shapes, not live third-party servers; deep-probe legs are quoted exactly, never silently absorbed into the simple-probe price (deep legs exact-quote only); willingness to pay is unmeasured - nobody has sold this verdict before.
Support: support@textforagents.com