Give reminder cancellation its own store and IPC path (V-719)

CancelReminder replaces the cancelled half of MarkReminder, which stays
delivery-only. Cancellation has to win against the start of an external
send, so it refuses when the occurrence has a pending, sent or unknown
outbox row, and clears the delivery group inside the same transaction.
BeginDeliveryAttempt takes the mirror lock for reminder sends, so no
interleaving lets both operations report success.

Cancelling one member of a collapsed catch-up bundle invalidates the
cached phrase on every pending sibling; a later retry would otherwise keep
saying "three reminders" after one was removed.

Legacy rows carry the empty delivery group from migration 25, so they only
count as this occurrence when they began at or after its next-fire
boundary. Without that bound one old success would make a recurring series
permanently uncancellable.

ListPendingReminders returns cancellable rows in firing order, with no
limit by default, because spoken resolution must not miss an old reminder
that newer fired history pushed out of ListReminders' window.

Cancellation is ordinary authenticated write authority: it prevents a
future send and cannot create one. cmd/e2eprobe drives both from outside.

--no-verify: master is the working branch this session by the owner's call.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/auth/auth_test.go

@@ -68,7 +68,8 @@ func TestRequirement_Table(t *testing.T) {
 	reads := []ipc.Method{
 		ipc.MethodLatestFact, ipc.MethodLatestFactBySource, ipc.MethodSince,
 		ipc.MethodPresence, ipc.MethodRecentOutcomes,
-		ipc.MethodCreateReminder, ipc.MethodMarkReminder,
+		ipc.MethodCreateReminder,
+		ipc.MethodListPendingReminders,
 		ipc.MethodRecordNudge, ipc.MethodResolveNudge,
 		ipc.MethodChat,
 	}
@@ -424,6 +425,7 @@ func TestRequirement_SwapModel(t *testing.T) {
 func TestRequirement_ListMutation(t *testing.T) {
 	for _, m := range []ipc.Method{
 		ipc.MethodIngestMail, ipc.MethodSetTaskStatus,
+		ipc.MethodMarkReminder, ipc.MethodCancelReminder,
 	} {
 		if got := Requirement(m); got != AuthWrite {
 			t.Errorf("%s authority = %v; want AuthWrite", m, got)

internal/auth/policy.go

@@ -19,9 +19,10 @@ type Authority int8
 
 const (
 	// AuthRead — read methods (LatestFact, LatestFactBySource, Since, Presence,
-	// RecentOutcomes) and state mutations a module legitimately makes
-	// (CreateReminder, MarkReminder, RecordNudge, ResolveNudge). The Enrollment
-	// already gated caller identity; any enrolled module may use these.
+	// RecentOutcomes) and additive state mutations a module legitimately makes
+	// (CreateReminder, RecordNudge, ResolveNudge). The Enrollment already gated
+	// caller identity; any enrolled module may use these. Terminal list changes
+	// such as MarkReminder and CancelReminder sit at AuthWrite below.
 	AuthRead Authority = 0
 
 	// AuthWrite — WriteFact. Need enrollment + source-scope match. The
@@ -128,6 +129,14 @@ func Requirement(m ipc.Method) Authority {
 		// from under him. Same reasoning as WriteFact: a module gets to add to
 		// its own corner, not to erase his.
 		return AuthWrite
+	case ipc.MethodMarkReminder, ipc.MethodCancelReminder:
+		// Cancelling removes a standing reason for Maven to speak. It is a
+		// mutation, like resolving a task, but not a step-up act: both voice and
+		// the web must be able to make Maven quieter at the owner's request.
+		// MarkReminder now accepts only the delivery-side fired transition, but
+		// it is terminal too and therefore belongs on the same enrolled-writer
+		// rung rather than the generic reader rung.
+		return AuthWrite
 	case ipc.MethodAssertStepUp:
 		return AuthRead
 	case ipc.MethodLatestFact,
@@ -136,7 +145,7 @@ func Requirement(m ipc.Method) Authority {
 		ipc.MethodPresence,
 		ipc.MethodRecentOutcomes,
 		ipc.MethodCreateReminder,
-		ipc.MethodMarkReminder,
+		ipc.MethodListPendingReminders,
 		ipc.MethodRecordNudge,
 		ipc.MethodResolveNudge,
 		// Task capture (Vikunja #130). Listed explicitly rather than left to

internal/ipc/api.go

@@ -605,7 +605,8 @@ type idReq struct {
 	ID int64 `json:"id"`
 }
 
-// markReminderReq — pending→fired|cancelled.
+// markReminderReq — pending→fired. Cancellation has its own transactional
+// method because it must serialize against delivery attempts.
 type markReminderReq struct {
 	ID     int64  `json:"id"`
 	Status string `json:"status"`
@@ -1000,6 +1001,7 @@ var (
 	ErrNudgeOutcome     = errors.New("ipc: nudge already resolved")
 	ErrReminderNotFound = errors.New("ipc: reminder not found")
 	ErrReminderState    = errors.New("ipc: reminder not in a mutable state")
+	ErrReminderInFlight = errors.New("ipc: reminder delivery already started")
 	ErrUnknownMethod    = errors.New("ipc: unknown method")
 	ErrBadParams        = errors.New("ipc: bad params")
 	// ErrForbidden — the caller's authority doesn't cover this call. The

internal/ipc/client.go

@@ -74,6 +74,7 @@ var readOnlyMethods = map[Method]bool{
 	MethodSince:                 true,
 	MethodPresence:              true,
 	MethodListReminders:         true,
+	MethodListPendingReminders:  true,
 	MethodRecentOutcomes:        true,
 	MethodRecentFacts:           true,
 	MethodRecentActiveFacts:     true,
@@ -327,6 +328,8 @@ func hydrate(e *RpcError) error {
 		return fmt.Errorf("%w: %s", ErrReminderNotFound, e.Message)
 	case codeReminderState:
 		return fmt.Errorf("%w: %s", ErrReminderState, e.Message)
+	case codeReminderInFlight:
+		return fmt.Errorf("%w: %s", ErrReminderInFlight, e.Message)
 	case codeToolNotFound:
 		return fmt.Errorf("%w: %s", ErrToolNotFound, e.Message)
 	case codeNoSuchTrace:
@@ -398,6 +401,10 @@ func (c *Client) MarkReminder(ctx context.Context, id int64, status string) erro
 	return c.call(ctx, MethodMarkReminder, markReminderReq{ID: id, Status: status}, nil)
 }
 
+func (c *Client) CancelReminder(ctx context.Context, id int64) error {
+	return c.call(ctx, MethodCancelReminder, idReq{ID: id}, nil)
+}
+
 func (c *Client) ListReminders(ctx context.Context, n int) ([]Reminder, error) {
 	var out []Reminder
 	if err := c.call(ctx, MethodListReminders, nReq{N: n}, &out); err != nil {
@@ -406,6 +413,14 @@ func (c *Client) ListReminders(ctx context.Context, n int) ([]Reminder, error) {
 	return out, nil
 }
 
+func (c *Client) ListPendingReminders(ctx context.Context, n int) ([]Reminder, error) {
+	var out []Reminder
+	if err := c.call(ctx, MethodListPendingReminders, nReq{N: n}, &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *Client) RecordNudge(ctx context.Context, rule, channel, message string, ts time.Time) (int64, error) {
 	var r idResp
 	if err := c.call(ctx, MethodRecordNudge, recordNudgeReq{Rule: rule, Channel: channel, Message: message, Ts: ts}, &r); err != nil {

internal/ipc/coreapi.go

@@ -42,7 +42,9 @@ type FactAPI interface {
 type ReminderAPI interface {
 	CreateReminder(ctx context.Context, fire time.Time, payload, cron string) (int64, error)
 	MarkReminder(ctx context.Context, id int64, status string) error
+	CancelReminder(ctx context.Context, id int64) error
 	ListReminders(ctx context.Context, n int) ([]Reminder, error)
+	ListPendingReminders(ctx context.Context, n int) ([]Reminder, error)
 }
 
 // NudgeAPI — proactive sends Maven proposed, their outcomes, and the outbox

internal/ipc/ipc_test.go

@@ -245,6 +245,9 @@ func TestStoreAPI_Direct(t *testing.T) {
 	if err := api.MarkReminder(ctx, 99999, "weird"); !errors.Is(err, ErrReminderState) {
 		t.Fatalf("MarkReminder weird: got %v, want ErrReminderState", err)
 	}
+	if err := api.CancelReminder(ctx, 99999); !errors.Is(err, ErrReminderNotFound) {
+		t.Fatalf("CancelReminder missing: got %v, want ErrReminderNotFound", err)
+	}
 	// resolve nonexistent nudge ⇒ ErrNudgeNotFound
 	if err := api.ResolveNudge(ctx, 99999, "acted", time.Now()); !errors.Is(err, ErrNudgeNotFound) {
 		t.Fatalf("ResolveNudge none: got %v, want ErrNudgeNotFound", err)
@@ -256,7 +259,7 @@ func TestStoreAPI_Direct(t *testing.T) {
 // the test that catches the boundary bugs: param shape mismatch, sentinel
 // code drift, dto mapping, framing interleaving.
 func TestClient_E2E(t *testing.T) {
-	_, _, cli, _ := newServerWithStore(t)
+	_, _, cli, st := newServerWithStore(t)
 	ctx := context.Background()
 	now := time.Now().UTC().Truncate(time.Millisecond)
 
@@ -311,11 +314,31 @@ func TestClient_E2E(t *testing.T) {
 		t.Fatalf("Presence cold-start = %+v, want away/0", pres)
 	}
 
-	// reminder lifecycle: create → mark fired → re-mark ⇒ ErrReminderState.
+	// reminder lifecycle: both pending rows cross the wire in firing order;
+	// one cancels and disappears from that read, while the other still follows
+	// the existing fired transition.
+	cancelID, err := cli.CreateReminder(ctx, now.Add(30*time.Minute), `{"text":"cancel me"}`, "")
+	if err != nil {
+		t.Fatalf("CreateReminder cancellation candidate: %v", err)
+	}
 	rid, err := cli.CreateReminder(ctx, now.Add(time.Hour), `{"text":"wake me 7"}`, "")
 	if err != nil {
 		t.Fatalf("CreateReminder: %v", err)
 	}
+	pending, err := cli.ListPendingReminders(ctx, 0)
+	if err != nil || len(pending) != 2 || pending[0].ID != cancelID || pending[1].ID != rid {
+		t.Fatalf("ListPendingReminders = %+v, %v", pending, err)
+	}
+	if err := cli.CancelReminder(ctx, cancelID); err != nil {
+		t.Fatalf("CancelReminder: %v", err)
+	}
+	if err := cli.CancelReminder(ctx, cancelID); !errors.Is(err, ErrReminderState) {
+		t.Fatalf("CancelReminder twice: got %v, want ErrReminderState", err)
+	}
+	pending, err = cli.ListPendingReminders(ctx, 0)
+	if err != nil || len(pending) != 1 || pending[0].ID != rid {
+		t.Fatalf("pending after cancellation = %+v, %v", pending, err)
+	}
 	if err := cli.MarkReminder(ctx, rid, "fired"); err != nil {
 		t.Fatalf("MarkReminder fired: %v", err)
 	}
@@ -323,6 +346,28 @@ func TestClient_E2E(t *testing.T) {
 		t.Fatalf("MarkReminder twice: got %v, want ErrReminderState", err)
 	}
 
+	flightID, err := cli.CreateReminder(ctx, now.Add(2*time.Hour), `{"text":"already leaving"}`, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	storePending, err := st.ListPendingReminders(ctx, 0)
+	if err != nil || len(storePending) != 1 || storePending[0].ID != flightID {
+		t.Fatalf("store pending = %+v, %v", storePending, err)
+	}
+	const deliveryGroup = "reminder:ipc-in-flight"
+	if err := st.CacheReminderPhrase(ctx, storePending, deliveryGroup, "leaving", "leaving", "neutral"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.BeginDeliveryAttempt(ctx, "reminder", "", flightID, deliveryGroup, "telegram", "hash", now); err != nil {
+		t.Fatal(err)
+	}
+	if err := cli.MarkReminder(ctx, flightID, "cancelled"); !errors.Is(err, ErrReminderState) {
+		t.Fatalf("legacy MarkReminder cancellation bypass: got %v, want ErrReminderState", err)
+	}
+	if err := cli.CancelReminder(ctx, flightID); !errors.Is(err, ErrReminderInFlight) {
+		t.Fatalf("CancelReminder in flight: got %v, want ErrReminderInFlight", err)
+	}
+
 	// nudge lifecycle: record → resolve acted → resolve again ⇒ ErrNudgeOutcome.
 	nid, err := cli.RecordNudge(ctx, "water", "voice", "drink", now)
 	if err != nil {

internal/ipc/maperr_test.go

@@ -30,6 +30,7 @@ var mapErrPairs = []struct {
 	{"ErrNudgeOutcome", store.ErrNudgeOutcome, ErrNudgeOutcome},
 	{"ErrReminderNotFound", store.ErrReminderNotFound, ErrReminderNotFound},
 	{"ErrReminderState", store.ErrReminderState, ErrReminderState},
+	{"ErrReminderInFlight", store.ErrReminderInFlight, ErrReminderInFlight},
 	{"ErrToolNotFound", store.ErrToolNotFound, ErrToolNotFound},
 	{"ErrNoSuchTrace", store.ErrNoSuchTrace, ErrNoSuchTrace},
 	{"ErrTaskNoDoneWhen", store.ErrTaskNoDoneWhen, ErrTaskNoDoneWhen},

internal/ipc/server.go

@@ -414,9 +414,15 @@ var methodTable = map[Method]handlerFunc{
 	MethodMarkReminder: withParamsVoid(func(ctx context.Context, api CoreAPI, p markReminderReq) error {
 		return api.MarkReminder(ctx, p.ID, p.Status)
 	}),
+	MethodCancelReminder: withParamsVoid(func(ctx context.Context, api CoreAPI, p idReq) error {
+		return api.CancelReminder(ctx, p.ID)
+	}),
 	MethodListReminders: withParamsSlice(func(ctx context.Context, api CoreAPI, p nReq) ([]Reminder, error) {
 		return api.ListReminders(ctx, p.N)
 	}),
+	MethodListPendingReminders: withParamsSlice(func(ctx context.Context, api CoreAPI, p nReq) ([]Reminder, error) {
+		return api.ListPendingReminders(ctx, p.N)
+	}),
 	MethodRecordNudge: withParams(func(ctx context.Context, api CoreAPI, p recordNudgeReq) (idResp, error) {
 		id, err := api.RecordNudge(ctx, p.Rule, p.Channel, p.Message, p.Ts)
 		return idResp{ID: id}, err

internal/ipc/storeapi.go

@@ -77,6 +77,10 @@ func (a *storeAPI) MarkReminder(ctx context.Context, id int64, status string) er
 	return mapErr(a.s.MarkReminder(ctx, id, status))
 }
 
+func (a *storeAPI) CancelReminder(ctx context.Context, id int64) error {
+	return mapErr(a.s.CancelReminder(ctx, id))
+}
+
 // mapRows carries a store read's error through mapErr and converts the rows to
 // their wire shape. Every list method here is that one shape.
 func mapRows[S any, W any](rows []S, err error, conv func(S) W) ([]W, error) {
@@ -95,6 +99,11 @@ func (a *storeAPI) ListReminders(ctx context.Context, n int) ([]Reminder, error)
 	return mapRows(rs, err, toReminder)
 }
 
+func (a *storeAPI) ListPendingReminders(ctx context.Context, n int) ([]Reminder, error) {
+	rs, err := a.s.ListPendingReminders(ctx, n)
+	return mapRows(rs, err, toReminder)
+}
+
 func (a *storeAPI) RescheduleReminder(ctx context.Context, id int64, now time.Time) error {
 	return mapErr(a.s.RescheduleReminder(ctx, id, now))
 }
@@ -422,6 +431,8 @@ func mapErr(err error) error {
 		return ErrReminderNotFound
 	case errors.Is(err, store.ErrReminderState):
 		return ErrReminderState
+	case errors.Is(err, store.ErrReminderInFlight):
+		return ErrReminderInFlight
 	case errors.Is(err, store.ErrToolNotFound):
 		return ErrToolNotFound
 	case errors.Is(err, store.ErrNoSuchTrace):

internal/ipc/unimplemented.go

@@ -47,9 +47,15 @@ func (UnimplementedCoreAPI) CreateReminder(ctx context.Context, fire time.Time,
 func (UnimplementedCoreAPI) MarkReminder(ctx context.Context, id int64, status string) error {
 	return ErrNotImplemented
 }
+func (UnimplementedCoreAPI) CancelReminder(ctx context.Context, id int64) error {
+	return ErrNotImplemented
+}
 func (UnimplementedCoreAPI) ListReminders(ctx context.Context, n int) ([]Reminder, error) {
 	return nil, ErrNotImplemented
 }
+func (UnimplementedCoreAPI) ListPendingReminders(ctx context.Context, n int) ([]Reminder, error) {
+	return nil, ErrNotImplemented
+}
 func (UnimplementedCoreAPI) RecordNudge(ctx context.Context, rule, channel, message string, ts time.Time) (int64, error) {
 	return 0, ErrNotImplemented
 }

internal/ipc/wire.go

@@ -20,7 +20,9 @@ const (
 	MethodPresence               Method = "presence"
 	MethodCreateReminder         Method = "create_reminder"
 	MethodMarkReminder           Method = "mark_reminder"
+	MethodCancelReminder         Method = "cancel_reminder"
 	MethodListReminders          Method = "list_reminders"
+	MethodListPendingReminders   Method = "list_pending_reminders"
 	MethodRecordNudge            Method = "record_nudge"
 	MethodResolveNudge           Method = "resolve_nudge"
 	MethodRecentOutcomes         Method = "recent_outcomes"
@@ -118,19 +120,20 @@ func (e *RpcError) Error() string {
 // Sentinel codes. Stable over the wire — do not rename. Mirror the package
 // sentinels in api.go 1:1. The string is the contract.
 const (
-	codeNoFact          = "no_fact"
-	codeConfidence      = "confidence"
-	codeVoidsMissing    = "voids_missing"
-	codeNudgeNotFound   = "nudge_not_found"
-	codeNudgeOutcome    = "nudge_outcome"
-	codeReminderMissing = "reminder_not_found"
-	codeReminderState   = "reminder_state"
-	codeToolNotFound    = "tool_not_found"
-	codeNoSuchTrace     = "no_such_trace"
-	codeUnknownMethod   = "unknown_method"
-	codeBadParams       = "bad_params"
-	codeForbidden       = "forbidden"
-	codeInternal        = "internal"
+	codeNoFact           = "no_fact"
+	codeConfidence       = "confidence"
+	codeVoidsMissing     = "voids_missing"
+	codeNudgeNotFound    = "nudge_not_found"
+	codeNudgeOutcome     = "nudge_outcome"
+	codeReminderMissing  = "reminder_not_found"
+	codeReminderState    = "reminder_state"
+	codeReminderInFlight = "reminder_in_flight"
+	codeToolNotFound     = "tool_not_found"
+	codeNoSuchTrace      = "no_such_trace"
+	codeUnknownMethod    = "unknown_method"
+	codeBadParams        = "bad_params"
+	codeForbidden        = "forbidden"
+	codeInternal         = "internal"
 )
 
 // codeOf maps a server-side sentinel to its wire code. Anything not matched is
@@ -160,6 +163,8 @@ func codeOf(err error) string {
 		return codeReminderMissing
 	case errors.Is(err, ErrReminderState):
 		return codeReminderState
+	case errors.Is(err, ErrReminderInFlight):
+		return codeReminderInFlight
 	case errors.Is(err, ErrToolNotFound):
 		return codeToolNotFound
 	case errors.Is(err, ErrNoSuchTrace):

internal/store/delivery.go

@@ -2,6 +2,7 @@ package store
 
 import (
 	"context"
+	"database/sql"
 	"fmt"
 	"log"
 	"time"
@@ -34,6 +35,9 @@ const (
 // stored for post-crash operator triage, not enforced as a uniqueness
 // constraint (a rule/reminder legitimately re-sends across ticks).
 func (s *Store) BeginDeliveryAttempt(ctx context.Context, kind, rule string, reminderID int64, deliveryGroup, channel, bodyHash string, now time.Time) (int64, error) {
+	if kind == "reminder" && deliveryGroup != "" {
+		return s.beginReminderDeliveryAttempt(ctx, rule, reminderID, deliveryGroup, channel, bodyHash, now)
+	}
 	res, err := s.db.ExecContext(ctx,
 		`INSERT INTO delivery_attempts (kind, rule, reminder_id, delivery_group, channel, body_hash, status, created_ts)
 		 VALUES (?, ?, ?, ?, ?, ?, 'pending', ?)`,
@@ -48,6 +52,58 @@ func (s *Store) BeginDeliveryAttempt(ctx context.Context, kind, rule string, rem
 	return id, nil
 }
 
+// beginReminderDeliveryAttempt serializes the last local cancellation point
+// with the first externally ambiguous delivery point. CancelReminder clears a
+// group's identity when it wins first; when this insert wins first it leaves a
+// pending attempt that makes cancellation refuse. There is therefore no state
+// in which both operations report success.
+func (s *Store) beginReminderDeliveryAttempt(ctx context.Context, rule string, reminderID int64, deliveryGroup, channel, bodyHash string, now time.Time) (int64, error) {
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return 0, fmt.Errorf("begin reminder delivery attempt: begin: %w", err)
+	}
+	defer tx.Rollback()
+
+	var status, currentGroup string
+	err = tx.QueryRowContext(ctx,
+		`SELECT status, delivery_group FROM reminders WHERE id = ?`, reminderID,
+	).Scan(&status, &currentGroup)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return 0, ErrReminderNotFound
+		}
+		return 0, fmt.Errorf("begin reminder delivery attempt: read reminder %d: %w", reminderID, err)
+	}
+	if status != ReminderPending || currentGroup != deliveryGroup {
+		return 0, fmt.Errorf("%w: reminder %d no longer owns delivery group", ErrReminderState, reminderID)
+	}
+	var live int
+	if err := tx.QueryRowContext(ctx, `
+		SELECT COUNT(*) FROM delivery_attempts
+		 WHERE kind = 'reminder' AND delivery_group = ?
+		   AND status IN ('pending', 'sent', 'unknown')`, deliveryGroup).Scan(&live); err != nil {
+		return 0, fmt.Errorf("begin reminder delivery attempt: inspect group: %w", err)
+	}
+	if live > 0 {
+		return 0, ErrReminderInFlight
+	}
+	res, err := tx.ExecContext(ctx, `
+		INSERT INTO delivery_attempts (kind, rule, reminder_id, delivery_group, channel, body_hash, status, created_ts)
+		VALUES ('reminder', ?, ?, ?, ?, ?, 'pending', ?)`,
+		rule, reminderID, deliveryGroup, channel, bodyHash, now.UnixMilli())
+	if err != nil {
+		return 0, fmt.Errorf("begin reminder delivery attempt: %w", err)
+	}
+	id, err := res.LastInsertId()
+	if err != nil {
+		return 0, fmt.Errorf("begin reminder delivery attempt: last insert id: %w", err)
+	}
+	if err := tx.Commit(); err != nil {
+		return 0, fmt.Errorf("begin reminder delivery attempt: commit: %w", err)
+	}
+	return id, nil
+}
+
 // CompleteDeliveryAttempt records the sink's outcome for a prior
 // BeginDeliveryAttempt. status is "sent", "failed" or "dropped" — never
 // "pending" or "unknown" (those are set only by Begin and reconciliation

internal/store/delivery_test.go

@@ -54,7 +54,18 @@ func TestListDeliveryAttempts(t *testing.T) {
 	if err := s.CompleteDeliveryAttempt(ctx, dropped, DeliveryDropped, base.Add(time.Minute)); err != nil {
 		t.Fatal(err)
 	}
-	if _, err := s.BeginDeliveryAttempt(ctx, "reminder", "", 7, "reminder:test", "voice", "h3", base.Add(2*time.Minute)); err != nil {
+	reminderID, err := s.CreateReminder(ctx, base.Add(time.Hour), `{"text":"test"}`, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	reminders, err := s.ListReminders(ctx, 1)
+	if err != nil || len(reminders) != 1 {
+		t.Fatalf("list reminder: %+v, %v", reminders, err)
+	}
+	if err := s.CacheReminderPhrase(ctx, reminders, "reminder:test", "test", "test", "neutral"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := s.BeginDeliveryAttempt(ctx, "reminder", "", reminderID, "reminder:test", "voice", "h3", base.Add(2*time.Minute)); err != nil {
 		t.Fatal(err)
 	}
 
@@ -63,7 +74,7 @@ func TestListDeliveryAttempts(t *testing.T) {
 		t.Fatalf("ListDeliveryAttempts = %d rows, err=%v, want 3", len(all), err)
 	}
 	// Newest first.
-	if all[0].Kind != "reminder" || all[0].ReminderID != 7 {
+	if all[0].Kind != "reminder" || all[0].ReminderID != reminderID {
 		t.Fatalf("newest row is %+v, want the reminder", all[0])
 	}
 	if all[0].HasComplete {

internal/store/reminders.go

@@ -87,6 +87,7 @@ const (
 var (
 	ErrReminderNotFound = errors.New("store: reminder not found")
 	ErrReminderState    = errors.New("store: reminder not in a mutable state")
+	ErrReminderInFlight = errors.New("store: reminder delivery already started")
 	ErrReminderPhrase   = errors.New("store: reminder delivery phrase invalid")
 )
 
@@ -206,15 +207,17 @@ func (s *Store) PendingReminders(ctx context.Context, from, to time.Time) ([]Rem
 	return out, rows.Err()
 }
 
-// MarkReminder sets a reminder's status. Only valid transitions: pending→fired,
-// pending→cancelled. Anything else is a programming error.
+// MarkReminder records successful completion of a reminder delivery. The only
+// valid transition is pending→fired. Cancellation has stronger outbox and
+// collapsed-group invariants and must go through CancelReminder; accepting the
+// same status here would leave a legacy bypass around those invariants.
 func (s *Store) MarkReminder(ctx context.Context, id int64, status string) error {
-	if status != ReminderFired && status != ReminderCancelled {
+	if status != ReminderFired {
 		return fmt.Errorf("%w: %s", ErrReminderState, status)
 	}
 	// The old read-then-write transition allowed two callers to both observe
 	// pending and both report success. Keeping the source state in the UPDATE
-	// predicate makes pending → fired|cancelled one atomic contest (V-678).
+	// predicate makes pending → fired one atomic contest (V-678).
 	res, err := s.db.ExecContext(ctx,
 		"UPDATE reminders SET status = ? WHERE id = ? AND status = ?",
 		status, id, ReminderPending)
@@ -242,6 +245,82 @@ func (s *Store) MarkReminder(ctx context.Context, id int64, status string) error
 	return fmt.Errorf("%w: currently %s", ErrReminderState, current)
 }
 
+// CancelReminder atomically wins against the beginning of external delivery.
+// A pending/sent/unknown outbox row means the presentation may already be
+// outside the process, so claiming cancellation would be false. Definite
+// failures do not block cancellation.
+//
+// A collapsed catch-up bundle shares one cached phrase. Cancelling any member
+// invalidates that presentation on every still-pending sibling; otherwise the
+// next retry could continue saying "three reminders" after one was removed.
+func (s *Store) CancelReminder(ctx context.Context, id int64) error {
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("cancel reminder: begin: %w", err)
+	}
+	defer tx.Rollback()
+
+	var status, group string
+	var nextFire int64
+	err = tx.QueryRowContext(ctx,
+		`SELECT status, delivery_group, next_fire_ts FROM reminders WHERE id = ?`, id,
+	).Scan(&status, &group, &nextFire)
+	if errors.Is(err, sql.ErrNoRows) {
+		return ErrReminderNotFound
+	}
+	if err != nil {
+		return fmt.Errorf("cancel reminder %d: read: %w", id, err)
+	}
+	if status != ReminderPending {
+		return fmt.Errorf("%w: currently %s", ErrReminderState, status)
+	}
+
+	// New attempts carry an occurrence-scoped delivery group. Migration 25
+	// assigned older rows the empty group, so those can only be related to this
+	// occurrence when they began at or after its next-fire boundary. Without
+	// that bound, one successful delivery from a recurring reminder's history
+	// would make the whole series permanently uncancellable after an upgrade.
+	var live int
+	err = tx.QueryRowContext(ctx, `
+		SELECT COUNT(*)
+		  FROM delivery_attempts
+		 WHERE kind = 'reminder'
+		   AND status IN ('pending', 'sent', 'unknown')
+		   AND ((delivery_group <> '' AND delivery_group = ?)
+		        OR (delivery_group = '' AND reminder_id = ? AND created_ts >= ?))`,
+		group, id, nextFire).Scan(&live)
+	if err != nil {
+		return fmt.Errorf("cancel reminder %d: inspect delivery: %w", id, err)
+	}
+	if live > 0 {
+		return ErrReminderInFlight
+	}
+
+	if group != "" {
+		if _, err := tx.ExecContext(ctx, `
+			UPDATE reminders
+			   SET delivery_group = '', phrase_body = '', phrase_summary = '', phrase_mood = ''
+			 WHERE delivery_group = ? AND status = ?`, group, ReminderPending); err != nil {
+			return fmt.Errorf("cancel reminder %d: invalidate group: %w", id, err)
+		}
+	}
+	res, err := tx.ExecContext(ctx, `
+		UPDATE reminders
+		   SET status = ?, delivery_group = '', phrase_body = '', phrase_summary = '', phrase_mood = '',
+		       next_attempt_ts = NULL, delivery_blocked_ts = NULL, delivery_blocked_error = ''
+		 WHERE id = ? AND status = ?`, ReminderCancelled, id, ReminderPending)
+	if err != nil {
+		return fmt.Errorf("cancel reminder %d: %w", id, err)
+	}
+	if err := requireOneReminderRow(res, id); err != nil {
+		return err
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("cancel reminder %d: commit: %w", id, err)
+	}
+	return nil
+}
+
 // ListReminders returns the n most recent reminders, newest first.
 func (s *Store) ListReminders(ctx context.Context, n int) ([]Reminder, error) {
 	rows, err := s.db.QueryContext(ctx, `SELECT `+reminderColumns+`
@@ -261,6 +340,35 @@ func (s *Store) ListReminders(ctx context.Context, n int) ([]Reminder, error) {
 	return out, rows.Err()
 }
 
+// ListPendingReminders returns cancellable reminders in firing order. n <= 0
+// means all pending rows: spoken resolution must not miss an old reminder just
+// because newer fired history filled ListReminders' window.
+func (s *Store) ListPendingReminders(ctx context.Context, n int) ([]Reminder, error) {
+	query := `SELECT ` + reminderColumns + `
+		  FROM reminders
+		 WHERE status = ?
+		 ORDER BY next_fire_ts ASC, id ASC`
+	args := []any{ReminderPending}
+	if n > 0 {
+		query += ` LIMIT ?`
+		args = append(args, n)
+	}
+	rows, err := s.db.QueryContext(ctx, query, args...)
+	if err != nil {
+		return nil, fmt.Errorf("list pending reminders: %w", err)
+	}
+	defer rows.Close()
+	var out []Reminder
+	for rows.Next() {
+		r, err := scanReminder(rows)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, r)
+	}
+	return out, rows.Err()
+}
+
 // HasDeliveryPhrase reports whether this occurrence already has a durable
 // presentation. Summary may intentionally be empty (the delivery boundary has
 // a generic privacy-preserving fallback), so Body is the readiness marker.

internal/store/reminders_cancel_test.go

@@ -0,0 +1,243 @@
+package store
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"testing"
+	"time"
+)
+
+func createCancellationReminder(t *testing.T, s *Store, fire time.Time, text string) Reminder {
+	t.Helper()
+	id, err := s.CreateReminder(context.Background(), fire, `{"text":"`+text+`"}`, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	rows, err := s.ListReminders(context.Background(), 1)
+	if err != nil || len(rows) != 1 || rows[0].ID != id {
+		t.Fatalf("created reminder %d, list=%+v err=%v", id, rows, err)
+	}
+	return rows[0]
+}
+
+func TestListPendingRemindersForCancellation(t *testing.T) {
+	ctx := context.Background()
+	s := newTestStore(t)
+	now := time.Date(2026, 8, 15, 9, 0, 0, 0, time.UTC)
+	later := createCancellationReminder(t, s, now.Add(2*time.Hour), "later")
+	earlier := createCancellationReminder(t, s, now.Add(time.Hour), "earlier")
+	fired := createCancellationReminder(t, s, now.Add(3*time.Hour), "already fired")
+	if err := s.MarkReminder(ctx, fired.ID, ReminderFired); err != nil {
+		t.Fatal(err)
+	}
+
+	all, err := s.ListPendingReminders(ctx, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(all) != 2 || all[0].ID != earlier.ID || all[1].ID != later.ID {
+		t.Fatalf("pending firing order = %+v", all)
+	}
+	one, err := s.ListPendingReminders(ctx, 1)
+	if err != nil || len(one) != 1 || one[0].ID != earlier.ID {
+		t.Fatalf("limited pending = %+v, %v", one, err)
+	}
+}
+
+func TestCancelReminderLifecycle(t *testing.T) {
+	ctx := context.Background()
+	s := newTestStore(t)
+	if err := s.CancelReminder(ctx, 999); !errors.Is(err, ErrReminderNotFound) {
+		t.Fatalf("missing cancellation = %v", err)
+	}
+	r := createCancellationReminder(t, s, time.Now().Add(time.Hour), "doctor")
+	if err := s.CancelReminder(ctx, r.ID); err != nil {
+		t.Fatal(err)
+	}
+	rows, err := s.ListReminders(ctx, 1)
+	if err != nil || len(rows) != 1 || rows[0].Status != ReminderCancelled {
+		t.Fatalf("cancelled row = %+v, %v", rows, err)
+	}
+	if err := s.CancelReminder(ctx, r.ID); !errors.Is(err, ErrReminderState) {
+		t.Fatalf("second cancellation = %v", err)
+	}
+}
+
+func TestMarkReminderCannotBypassCancellationSafety(t *testing.T) {
+	ctx := context.Background()
+	s := newTestStore(t)
+	r := createCancellationReminder(t, s, time.Now().Add(time.Hour), "doctor")
+	if err := s.MarkReminder(ctx, r.ID, ReminderCancelled); !errors.Is(err, ErrReminderState) {
+		t.Fatalf("legacy cancelled transition = %v, want ErrReminderState", err)
+	}
+	if got := reminderStatusesForTest(t, s)[r.ID]; got != ReminderPending {
+		t.Fatalf("legacy transition changed status to %q", got)
+	}
+}
+
+func reminderStatusesForTest(t *testing.T, s *Store) map[int64]string {
+	t.Helper()
+	rows, err := s.ListReminders(context.Background(), 100)
+	if err != nil {
+		t.Fatal(err)
+	}
+	out := make(map[int64]string, len(rows))
+	for _, row := range rows {
+		out[row.ID] = row.Status
+	}
+	return out
+}
+
+func TestCancelReminderInvalidatesCollapsedPhrase(t *testing.T) {
+	ctx := context.Background()
+	s := newTestStore(t)
+	now := time.Date(2026, 8, 15, 9, 0, 0, 0, time.UTC)
+	a := createCancellationReminder(t, s, now.Add(time.Hour), "doctor")
+	b := createCancellationReminder(t, s, now.Add(2*time.Hour), "bread")
+	originals, err := s.ListPendingReminders(ctx, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	const group = "reminder:collapsed-cancel-test"
+	if err := s.CacheReminderPhrase(ctx, originals, group, "two reminders", "two", "neutral"); err != nil {
+		t.Fatal(err)
+	}
+	attempt, err := s.BeginDeliveryAttempt(ctx, "reminder", "", a.ID, group, "telegram", "hash", now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := s.CompleteDeliveryAttempt(ctx, attempt, DeliveryFailed, now); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.CancelReminder(ctx, a.ID); err != nil {
+		t.Fatal(err)
+	}
+
+	rows, err := s.ListReminders(ctx, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	byID := make(map[int64]Reminder, len(rows))
+	for _, row := range rows {
+		byID[row.ID] = row
+	}
+	if got := byID[a.ID]; got.Status != ReminderCancelled || got.HasDeliveryPhrase() {
+		t.Fatalf("cancelled member retained presentation: %+v", got)
+	}
+	if got := byID[b.ID]; got.Status != ReminderPending || got.HasDeliveryPhrase() || got.DeliveryGroup != "" {
+		t.Fatalf("surviving member retained stale bundle: %+v", got)
+	}
+}
+
+func TestCancelReminderRefusesAmbiguousDelivery(t *testing.T) {
+	for _, status := range []string{DeliveryPending, DeliveryUnknown, DeliverySent} {
+		t.Run(status, func(t *testing.T) {
+			ctx := context.Background()
+			s := newTestStore(t)
+			now := time.Date(2026, 8, 15, 9, 0, 0, 0, time.UTC)
+			r := createCancellationReminder(t, s, now.Add(time.Hour), status)
+			group := "reminder:" + status
+			if err := s.CacheReminderPhrase(ctx, []Reminder{r}, group, status, status, "neutral"); err != nil {
+				t.Fatal(err)
+			}
+			attempt, err := s.BeginDeliveryAttempt(ctx, "reminder", "", r.ID, group, "telegram", "hash", now)
+			if err != nil {
+				t.Fatal(err)
+			}
+			switch status {
+			case DeliveryUnknown:
+				if _, err := s.ReconcileStaleDeliveryAttempts(ctx, now.Add(time.Minute)); err != nil {
+					t.Fatal(err)
+				}
+			case DeliverySent:
+				if err := s.CompleteDeliveryAttempt(ctx, attempt, DeliverySent, now); err != nil {
+					t.Fatal(err)
+				}
+			}
+			if err := s.CancelReminder(ctx, r.ID); !errors.Is(err, ErrReminderInFlight) {
+				t.Fatalf("cancel with %s attempt = %v", status, err)
+			}
+		})
+	}
+}
+
+func TestCancelReminderScopesLegacyAttemptsToTheCurrentOccurrence(t *testing.T) {
+	ctx := context.Background()
+	now := time.Date(2026, 8, 15, 9, 0, 0, 0, time.UTC)
+
+	t.Run("historical recurring send does not block the series", func(t *testing.T) {
+		s := newTestStore(t)
+		fire := now.Add(24 * time.Hour)
+		id, err := s.CreateReminder(ctx, fire, `{"text":"daily medicine"}`, "0 9 * * *")
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := s.db.ExecContext(ctx, `
+			INSERT INTO delivery_attempts
+				(kind, reminder_id, delivery_group, channel, body_hash, status, created_ts, completed_ts)
+			VALUES ('reminder', ?, '', 'telegram', 'legacy', 'sent', ?, ?)`,
+			id, now.UnixMilli(), now.UnixMilli()); err != nil {
+			t.Fatal(err)
+		}
+		if err := s.CancelReminder(ctx, id); err != nil {
+			t.Fatalf("historical blank-group attempt blocked recurrence: %v", err)
+		}
+	})
+
+	t.Run("current legacy ambiguity still refuses", func(t *testing.T) {
+		s := newTestStore(t)
+		fire := now.Add(time.Hour)
+		r := createCancellationReminder(t, s, fire, "legacy current")
+		if _, err := s.db.ExecContext(ctx, `
+			INSERT INTO delivery_attempts
+				(kind, reminder_id, delivery_group, channel, body_hash, status, created_ts)
+			VALUES ('reminder', ?, '', 'telegram', 'legacy', 'unknown', ?)`,
+			r.ID, fire.Add(time.Second).UnixMilli()); err != nil {
+			t.Fatal(err)
+		}
+		if err := s.CancelReminder(ctx, r.ID); !errors.Is(err, ErrReminderInFlight) {
+			t.Fatalf("current blank-group ambiguity = %v, want ErrReminderInFlight", err)
+		}
+	})
+}
+
+func TestReminderCancellationAndDeliveryBeginAreMutuallyExclusive(t *testing.T) {
+	for i := 0; i < 20; i++ {
+		s := newTestStore(t)
+		ctx := context.Background()
+		now := time.Date(2026, 8, 15, 9, 0, 0, i, time.UTC)
+		r := createCancellationReminder(t, s, now.Add(time.Hour), "race")
+		group := "reminder:race"
+		if err := s.CacheReminderPhrase(ctx, []Reminder{r}, group, "race", "race", "neutral"); err != nil {
+			t.Fatal(err)
+		}
+
+		start := make(chan struct{})
+		var cancelErr, beginErr error
+		var wg sync.WaitGroup
+		wg.Add(2)
+		go func() {
+			defer wg.Done()
+			<-start
+			cancelErr = s.CancelReminder(ctx, r.ID)
+		}()
+		go func() {
+			defer wg.Done()
+			<-start
+			_, beginErr = s.BeginDeliveryAttempt(ctx, "reminder", "", r.ID, group, "telegram", "hash", now)
+		}()
+		close(start)
+		wg.Wait()
+
+		if (cancelErr == nil) == (beginErr == nil) {
+			t.Fatalf("iteration %d: cancel=%v begin=%v; exactly one must win", i, cancelErr, beginErr)
+		}
+		if cancelErr == nil && !errors.Is(beginErr, ErrReminderState) {
+			t.Fatalf("iteration %d: cancellation won, begin=%v", i, beginErr)
+		}
+		if beginErr == nil && !errors.Is(cancelErr, ErrReminderInFlight) {
+			t.Fatalf("iteration %d: delivery won, cancel=%v", i, cancelErr)
+		}
+	}
+}

internal/store/reminders_delivery_test.go

@@ -158,15 +158,17 @@ func TestReminderTerminalTransitionHasExactlyOneWinner(t *testing.T) {
 		start := make(chan struct{})
 		var wg sync.WaitGroup
 		errs := make([]error, 2)
-		statuses := []string{ReminderFired, ReminderCancelled}
-		for i := range statuses {
-			wg.Add(1)
-			go func(i int) {
-				defer wg.Done()
-				<-start
-				errs[i] = s.MarkReminder(ctx, id, statuses[i])
-			}(i)
-		}
+		wg.Add(2)
+		go func() {
+			defer wg.Done()
+			<-start
+			errs[0] = s.MarkReminder(ctx, id, ReminderFired)
+		}()
+		go func() {
+			defer wg.Done()
+			<-start
+			errs[1] = s.CancelReminder(ctx, id)
+		}()
 		close(start)
 		wg.Wait()
 
@@ -177,11 +179,11 @@ func TestReminderTerminalTransitionHasExactlyOneWinner(t *testing.T) {
 			switch {
 			case err == nil:
 				successes++
-				winner = statuses[i]
+				winner = []string{ReminderFired, ReminderCancelled}[i]
 			case errors.Is(err, ErrReminderState):
 				losers++
 			default:
-				t.Fatalf("iteration %d transition %s: %v", iteration, statuses[i], err)
+				t.Fatalf("iteration %d transition %d: %v", iteration, i, err)
 			}
 		}
 		if successes != 1 || losers != 1 {