Cancel was documented as "cancels a pending session belonging to the
caller's org" but the contract did not name HOW the implementation
enforces that. A loose implementation could:
- read session, transition state, then check org_id (TOCTOU window)
- distinguish "not yours" from "not found" in the error message
(enumeration oracle leaks the existence of cross-org sessions)
- skip the org predicate when a concurrent legitimate caller also
has the row open (race condition lets the wrong-org call win)
Tightened doc names the three required behaviors:
- orgID derived from ctx Claims, not caller-supplied
- SELECT-FOR-UPDATE + WHERE org_id = ctx.OrgID; mismatch returns
ErrSessionNotFound (same opaque response as unknown id)
- row-level CAS with the org predicate in WHERE, so two callers
cannot race the state transition
- idempotency on already-cancelled scoped to the SAME org
go.work bumped to 1.26.3 to satisfy the per-module go directive.
zeekay