[theboringhumane]

A canceled query can lose its DATA lease before its database cancellation reaches the source. Add an opt-in accepted-parent registry and a separate bounded PostgreSQL cleanup tunnel. Receipts are returned only after pairing, a refreshed lease and physical stream registration. Cleanup checks the same parent, worker certificate, source/token/control-owner fences and a fixed live cleanup lease, then consumes the parent and ticket once.

Worker-to-source DATA stops permanently during cleanup. A positive cleanup lease permits at most 256 KiB of source-to-worker completion bytes for the trusted adapter to inspect and discard. Cleanup retains original source TLS and is capped at five seconds and 256 KiB in each direction. Rabbit cannot inspect the PostgreSQL protocol inside TLS; the trusted parent owns the typed encoder and must never give the cleanup connection to an untrusted child. CONNECT admission or CancelRequest EOF does not prove backend termination.

Disabled unless an operator supplies a separate receipt signing key and cleanup-authority URL. Existing clients remain unchanged. Network errors, hard revocations, missing receipts, busy writes and ambiguous state fail closed.

Validation: full transport and server package suites passed with the race detector on Azure. Tests cover closed parents, replay, current-source denial, cancellation before receipt registration, receive-only bounds, absent cleanup authority and joined shutdown. Paired source-TLS and queued-job backend-cancellation acceptance remains pending; no production activation.