Two modeled carriers can now retain their shared world while an explicit operator cancels finite station transport and later resumes the same stopped parcel under current receiving authority. Cancellation after an intake grant preserves uncertainty and refuses a second attempt; navigation authority loss cannot be repaired by a transport decision.
This builds on the station, receiving-task and eleven-case handover checkpoints in #101 through #104. The new retained API has strict context/epoch/sequence admission, detached snapshots and terminal reports, and current revoked-board observations after close. Native cargo:fleet-control and the standalone CLI expose four bounded operator cases. API, guides and roadmap summaries now describe the implemented scope consistently.
Validation: 220 focused tests passed with 25,569 assertions across 19 files; eleven copied fleet fault cases, four copied operator cases and 31 older cargo cases passed outside the checkout. All eleven old fleet and 31 old cargo report bytes match the qualified local baseline. Native Pickier lint, app/runtime types, CLI/docs builds, roadmap and parity checks passed. Generated docs contain 99 pages, 7,779 local links and 99 assets without missing targets. Independent Spec and Standards reviews are clean after a genuine RED/GREEN fix for mutable retained result aliases.
Full exact-source CI is pending. The full local suite was withheld below its 4 GB free-space floor. This remains simulation with physical outputs inhibited and identity unauthenticated. General fleet recovery, durable world reconciliation, richer planning, electrical/measured endurance and physical/operational qualification remain open under #25. No issue is closed by this checkpoint.