Protect an ICP reservation across an inter-canister await

An outgoing asynchronous call can divide an update into multiple executions. Other messages may change the reservation before the response callback runs.

Attach a version to the claim

Before contacting the ledger, give the reservation for item 7 a durable identifier, record the amount and store its pending state. After the await, reread the reservation. Comparing the identifier prevents a late callback from delivering a newly created reservation for the same item.

message 1: reserve item 7 → await ledger
message 2: cancel request for item 7
callback: examine reservation version before delivery

Reconcile a late success

If cancellation arrived while payment was pending, the ledger may still report a completed transfer. Route the reservation to reconciliation using the transfer reference. A trap in the callback rolls back that callback's changes while leaving earlier committed work and the remote transfer in place.

Sources