It weirds me out a little that cancel prevents any of these methods from being called. Would it be simpler if cancel caused `failure()` to be called if the cancel occurred before the job completed?

Otherwise it seems possible to leak memory or other resources. Suppose you have an integer tracking the number of requests in flight. You decrement it in both success and failure.

But not when a job is canceled. And unfortunately you can't also decrement that integer when you call cancel because cancel is idempotent (you might call it multiple times) and because `cancel()` is racy (a canceled job may still see `success()` or `failure()` called.)