volume set: document the copyVolume command

concepts/command.mdx

@@ -25,7 +25,7 @@ The `lifecycleStage` field shows where a command is. It starts at `pending` and
 | --- | --- |
 | `pending` | Accepted, not yet started. |
 | `running` | Control Plane is carrying it out. |
-| `cancellation-requested` | Control Plane decided to stop the command, for example because a cron run passed its `activeDeadlineSeconds`, and is removing what the command created. It normally ends in `cancelled`, but can still end in `completed` or `failed` if the work finished first. |
+| `cancellation-requested` | The command is being stopped, because Control Plane decided to (for example, a cron run passed its `activeDeadlineSeconds`) or a caller [cancelled it](#working-with-commands). Control Plane is removing what the command created. It normally ends in `cancelled`, but can still end in `completed` or `failed` if the work finished first. |
 | `cancelled` | Final. Stopped, and everything it created has been removed. |
 | `completed` | Final. Finished successfully. |
 | `failed` | Final. It didn't finish. The command's `status` holds type-specific details. |
@@ -56,12 +56,19 @@ cpln rest get "/org/my-org/gvc/my-gvc/workload/my-cron-workload/-command?lifecyc
 cpln rest get /org/my-org/gvc/my-gvc/workload/my-cron-workload/-command/COMMAND_ID
 ```
 
-Only Control Plane moves a command between stages. To stop a `runCronWorkload` run that is in progress, [stop its replica](/reference/workload/general#stop-a-replica): that deletes the run's job and marks its command `cancelled`.
+Control Plane moves a command between stages. The one change a caller can make is to **cancel** a command by patching its `lifecycleStage` to `cancellation-requested`. Every volume set command, including a [volume copy](/reference/volumeset#cancel-a-volume-copy), and `runCronWorkload` can be cancelled; `stopReplica` can't. This needs the same `exec.TYPE` permission as creating the command:
+
+```bash
+echo '{"lifecycleStage": "cancellation-requested"}' > cancel.json
+cpln rest patch /org/my-org/gvc/my-gvc/volumeset/my-volume-set/-command/COMMAND_ID --file cancel.json
+```
+
+A cancellation request is refused with `400 Command type 'TYPE' does not support cancellation`, or with `400 Cannot request cancellation for command in terminal state 'STAGE'` once the command has finished.
 
 ## Gotchas
 
 - **A `201` doesn't mean the action finished.** It means the command was accepted. Read `lifecycleStage` until it reaches `completed`, `failed`, or `cancelled`.
-- **A command is read-only once created.** A `PATCH` from a user or service account is rejected with `403 Cannot modify commands`, and a `DELETE` isn't allowed. A command stays as a record of what ran until the workload or volume set it belongs to is deleted, which deletes its commands too.
+- **A command is read-only once created, except for cancellation.** Any other `PATCH` from a user or service account is rejected with `403 Cannot modify commands`, and a `DELETE` isn't allowed. A command stays as a record of what ran until the workload or volume set it belongs to is deleted, which deletes its commands too.
 - **Some commands conflict, and they conflict in different ways.**
   - A second `stopReplica` for the same replica is rejected with `400` while the first is still in progress.
   - A volume set command that overlaps one already in progress on the same volume is rejected with `409`. The exception is `deleteVolume`, which fails the overlapping commands instead.
@@ -77,7 +84,7 @@ Only Control Plane moves a command between stages. To stop a `runCronWorkload` r
     The `stopReplica` spec and what Control Plane does when a replica is stopped.
   </Card>
   <Card title="Volume set commands" icon="hard-drive" href="/reference/volumeset#commands">
-    Expand, shrink, delete, snapshot, and restore the volumes of a volume set.
+    Expand, shrink, copy, delete, snapshot, and restore the volumes of a volume set.
   </Card>
   <Card title="Workload security" icon="shield" href="/reference/workload/security#permissions">
     The `exec` permissions that allow a principal to create workload commands.

llms.txt

@@ -235,6 +235,7 @@ Volume sets provide persistent storage within a GVC. Mount via `cpln://volumeset
 - Custom encryption (AWS KMS) is supported on `ext4`/`xfs` only.
 - Volumes can only be **expanded once every 6 hours**.
 - `shrinkVolume` provisions a NEW smaller volume and **permanently deletes the old volume and all its data** — only safe for distributed systems with replication (Kafka, CockroachDB). Never use for single-replica stateful workloads or databases without replication.
+- `copyVolume` copies one volume into another location of the same volume set, or into another volume set in the same org (`spec.targetVolumeSet`). It **deletes the destination volume's storage device**, always requires `acknowledgeDestinationVolumeDeletion: true`, needs `exec.copyVolume` (not included in `exec`), and supports `ext4`/`xfs` only. A copy from a mounted source is not crash-consistent.
 - `createFinalSnapshot: true` (default) auto-snapshots before any volume deletion — leave on.
 - Volume sets are GVC-scoped. A workload can only use volume sets in the same GVC. Autoscaling (reactive and predictive) is available for automatic expansion.
 
@@ -356,7 +357,7 @@ cpln logs '{gvc="GVC", workload="WL"}' --org ORG --tail
 ## Concepts
 - [Access Control](https://docs.controlplane.com/concepts/access-control): The two systems, billing account roles and org policies, then the policy model: the four principal kinds defined (user, group, service account, identity as what you attach to a workload), bindings, permission implication, dynamic tag-query targets, built-in superusers/viewers policies, the access report, and how billing membership stays separate from org membership
 - [Billing Account](https://docs.controlplane.com/concepts/billing): What a billing account holds, the three billing roles, setup order, monthly spend alerts, why billing roles grant nothing inside an org, and why billing users and org members are two separate lists joined in different ways
-- [Command](https://docs.controlplane.com/concepts/command): The asynchronous resource behind one-off actions on a workload or volume set (runCronWorkload, stopReplica, volume and snapshot operations): the -command endpoint, the six lifecycle stages and the three final ones, listing (filter by lifecycleStage) and getting commands, why commands are read-only once created (PATCH returns 403, no DELETE), stopping a cron run by stopping its replica, how stopReplica, volume set, and runCronWorkload conflicts differ, and why a 201 means accepted rather than finished
+- [Command](https://docs.controlplane.com/concepts/command): The asynchronous resource behind one-off actions on a workload or volume set (runCronWorkload, stopReplica, volume and snapshot operations): the -command endpoint, the six lifecycle stages and the three final ones, listing (filter by lifecycleStage) and getting commands, why commands are read-only once created except for cancellation (PATCH lifecycleStage to cancellation-requested with exec.TYPE; any other PATCH returns 403, no DELETE), stopping a cron run by stopping its replica, how stopReplica, volume set, and runCronWorkload conflicts differ, and why a 201 means accepted rather than finished
 - [Deployment](https://docs.controlplane.com/concepts/deployment): The read-only per-location record Control Plane writes back for a workload: ready gated on the expected version, deploying that stops on failure, the two-version view of a rollout, health rollup to every interface, stale flagging and 24-hour expiry, cron run history, and why fixes go to the workload
 - [GVC (Global Virtual Cloud)](https://docs.controlplane.com/concepts/gvc): The locations a GVC spans and the shared ground its workloads inherit: per-GVC geo routing, the namespace behind cpln.local and cpln.app endpoints, env vars, pull secrets, KEDA, and the volume-set deletion block
 - [Identity](https://docs.controlplane.com/concepts/identity): What you attach to a workload to give it credentials, and the source of every credential it presents: the three-part secret chain (attach, reveal policy, cpln://secret reference), Universal Cloud Identity across AWS, GCP, Azure, and NATS, wormhole network resources, PrivateLink and Private Service Connect native network resources, and the use permission needed to attach one

reference/policy.mdx

@@ -66,7 +66,8 @@ Beyond those two rules, some kinds grant more. Each row below is what the named
 | [Audit Context](/reference/auditctx) | `readAudit`, `writeAudit` | `view` |
 | [Managed Kubernetes](/mk8s/overview) | `clusterAdmin` | `view` |
 | [Org](/reference/org) | `readLogs` | `view` |
-| [Workload](/reference/workload/general), [Volume Set](/reference/volumeset) | `exec` | the individual `exec.*` permissions |
+| [Workload](/reference/workload/general) | `exec` | `exec.runCronWorkload`, `exec.stopReplica` |
+| [Volume Set](/reference/volumeset) | `exec` | every `exec.*` permission except `exec.copyVolume` and `exec.shrinkVolume` |
 
 <Warning>
   **`edit` on a secret grants `reveal`,** which is the plaintext. Someone who can change a secret can also read it. Grant `use` when a principal only needs to attach the secret to a GVC or workload, and `view` when it only needs to see that the secret exists.