RetryUntilMajorityCommit invariants that its CancelToken is not yet cancelled when trying to create its retry helpers. Not only is it technically fine for the token to begin cancelled, it is very possible for this to be the case under expected use, if the PrimaryOnlyService steps down after calling run(), but before initializing the retry helper.