They decide to go to lunch without voting and without mentioning it to a pollworker? If you really believe this isn't an absurd example, then you are going to need a Spyrus at the gate to confirm that people have actually voted. You'd need it to catch people who are given cards but don't even put them in the machine, nevermind those who put them in and then cancel.
With VCProgrammer we can do all kinds of neat things. We could even track that your indecisive-lunch-voter canceled their ballot when the card is recycled through VCProgrammer. When they return from lunch, VCProgrammer knows they canceled and a new card is issued. I suppose you are now going to tell me that she the took the canceled card with her and then lost it at lunch. Fair enough; I don't have all the answers. We are probably also going to have multiple-personality voters who swear they were never in to vote this morning, and demand a new smart card. We'll probably need to check the ADA act for provisions here.
The Jornada is exactly like the Spyrus, except that the Jornada is 16 times as expensive, and the Spyrus is easier to use.
But you are ignoring my central thesis. The voter can find and use the hidden cancel button. They will. So will Shamus, Craft, and the LA Times. If you believe they won't, then let's have the aformentioned written paragraph to this effect, and move on. Myself, I wouldn't design a voting system based on this premise, but hey, that's me.