* Add missing API-level state checks during session cancel This validates it's not already canceled or in terminated state.