Module cancel 

Cooperative cancellation primitive (DESIGN.md §5.2.5).

Lives at the protocol layer so every other crate can poll it without taking a dependency on grammar. The grammar crate re- exports this type as CancellationToken and adds the CommandError::Cancelled-aware check() short-circuit on top.

The token is a clone-cheap Arc<AtomicBool>. Cancelling costs one atomic store; polling is one atomic load. Evaluators (motions, operators, search loops, ex commands) poll on a regular cadence – typically once per inner-loop iteration – and bail with the appropriate domain error on a flipped token.

Sources of cancellation

• User Esc. While an evaluator runs on the document actor, the user can interrupt by pressing Esc. The TUI input loop flips the token of the in-flight invocation.
• Deadline timer (NOT YET WIRED). Per LatencyClass budget.
• Supersede (NOT YET WIRED). A newer same-event request invalidates the in-flight one.

Default token

CancellationToken::never returns a token that callers have no handle to flip. Use it when the call site doesn’t drive cancellation but the API requires a token.

Structs

CancellationToken

Cooperative cancellation handle. Cheap to clone (one Arc bump); safe to share across threads / tasks.