tests: #550's cancellation guarantees are asserted by nothing that runs, and the probes that measured them were not landed

[Yaraslaut]

Found while running #550's Part 1. Filed rather than left as an aside inside that issue's comments, per AGENTS.md — "File, don't fold. An aside inside a closed issue lapses unless it gets its own issue."

The finding

#550's Part 1 produced a table of 27 cancellation entry points and measured their guarantees on a five-point scale (G0 nothing … G4 no callback still running). Four of those rows were reproduced by standalone probe programs, and two of the reproductions were sharp enough to become defects in their own right:

• core: SynchronousBackendAdapter::cancelPending does not cancel the completions the adapter itself produced #619 — SynchronousBackendAdapter::cancelPending does not cancel the completions the adapter itself produced. Measured: after cancelPending(BridgeDestroyedError) the bind's .then fired with a success value (okRan=1 errRan=0).
• core: TimeoutScheduler::cancel() does not stop an already-firing callback, and the header does not say so #620 — TimeoutScheduler::cancel() returns while an already-firing callback is still executing.

Those probe programs are gone. They lived in a lane scratchpad and were removed with the worktree. So the guarantees they proved are now recorded as prose on #550 and asserted by nothing that runs.

Why that matters here specifically

The whole point of #550's scale is the distinction between "no further callback will be scheduled" (G1/G2) and "no further callback will start" (G3). A caller who reads a G2 verb as G3 and frees the receiver on the next statement has a use-after-free — and docs/spec/concurrency_and_lifetimes.md:164 says the rules there "encode recent fixes to real deadlocks and use-after-frees", so this is a class of bug this repository has already shipped and fixed at least once.

A guarantee that nothing asserts is a guarantee that can regress silently. That is AGENTS.md's "verify rather than assert" applied to the concurrency contract itself.

Verification status: weak, and labelled as weak

Measured on master @ 0e3b8823:

$ grep -rn "cancelPending" tests/ | wc -l
38

38 call sites across 12 test files. So the verbs are exercised a great deal — this is emphatically not "cancellation is untested."

What I could not establish is whether any test asserts the strength of the guarantee rather than its effect. My probe for that was crude — searching each file for an assertion that a counter stayed at zero near a cancelPending — and it found none in any of the twelve:

tests/test_bridge_lifetime.cpp              cancelPending=7   zero-assertions=0
tests/test_coverage_push95.cpp              cancelPending=8   zero-assertions=0
tests/test_switch_backend.cpp               cancelPending=5   zero-assertions=0
tests/test_backend_extra.cpp                cancelPending=4   zero-assertions=0
tests/test_async_registration.cpp           cancelPending=3   zero-assertions=0
tests/test_backend_registration_surface.cpp cancelPending=3   zero-assertions=0
...

That heuristic is not good enough to conclude on. It matches only a few spellings of "this did not happen", and a test could assert the same property through a Catch2 matcher, a drained-queue check, or a scope-exit assertion it would never see. Do not treat "zero-assertions=0" as a measurement — treat it as the reason someone should look properly.

I did not: read any of the twelve test files, run the suite, or attempt to reconstruct the deleted probes.

What would resolve it

1. Audit the twelve files properly and establish whether any existing test distinguishes G2 from G3. If one does, this issue shrinks to "land the remaining probes."
2. Land the reproductions as tests/test_cancellation_policy.cpp — one case per reproduced row of research: write down the real cancellation policy, then test whether stdexec (or std::stop_token, or strand-confinement) removes any of the 54 mutexes #550's table, asserting the G-level, not just that an error arrived. research: write down the real cancellation policy, then test whether stdexec (or std::stop_token, or strand-confinement) removes any of the 54 mutexes #550's second comment proposes exactly this as a regression baseline for its Part 2.
3. Per AGENTS.md, each case must fail if the guarantee weakens — e.g. a case for core: SynchronousBackendAdapter::cancelPending does not cancel the completions the adapter itself produced #619 asserts errRan == 1 && okRan == 0, so it fails today and passes once core: SynchronousBackendAdapter::cancelPending does not cancel the completions the adapter itself produced #619 is fixed. A case that merely asserts "something settled" would pass in both worlds and is not evidence.

The probes cannot be recovered, so step 2 means rewriting them from the table on #550, which is the durable record that survived.

What would change the verdict

• Close it if the audit in (1) shows the guarantees are already asserted somewhere and the probes were duplicating existing coverage.
• Raise it if core: SynchronousBackendAdapter::cancelPending does not cancel the completions the adapter itself produced #619 or core: TimeoutScheduler::cancel() does not stop an already-firing callback, and the header does not say so #620 is fixed without a test that would catch the regression — that is the case this issue exists to prevent.

Related

• research: write down the real cancellation policy, then test whether stdexec (or std::stop_token, or strand-confinement) removes any of the 54 mutexes #550 — the table, and the source of the G-scale this refers to.
• core: SynchronousBackendAdapter::cancelPending does not cancel the completions the adapter itself produced #619, core: TimeoutScheduler::cancel() does not stop an already-firing callback, and the header does not say so #620 — the two defects the lost probes found.
• core: remove IBackend's four async twins and retire the prose threading contract #571 — routes 13 call sites through SynchronousBackendAdapter, which is what makes core: SynchronousBackendAdapter::cancelPending does not cancel the completions the adapter itself produced #619's path the default.

[Yaraslaut]

Triage: rescope — the finding is real, but work in flight has overtaken its framing

The title says #550's cancellation guarantees are "asserted by nothing that runs." As of PR #639 (open, CI incomplete) that is no longer true for the two rows the issue calls its sharpest, and those are precisely the two it built its case on.

#619's row. #639 adds to tests/test_backend_registration_surface.cpp exactly the assertion this issue's step 3 asks for — the G-level, not "something settled":

TEST_CASE("morph::backend::SynchronousBackendAdapter: cancelPending rejects the completions it produced itself",
    std::atomic<int> okRan{0};
    std::atomic<int> errRan{0};
    ...
    REQUIRE(okRan.load() == 0);
    REQUIRE(errRan.load() == 0);
    adapter.cancelPending(std::make_exception_ptr(morph::backend::BridgeDestroyedError{}));
        return errRan.load() == 1;
    REQUIRE(inner->cancels.load() == 1);

#620's row. #639 adds to tests/test_timeout_scheduler.cpp the G2-vs-G3 distinction itself, as a contrast pair:

TEST_CASE("TimeoutScheduler: cancel() returns while the callback it names is still running", ...)
    REQUIRE_FALSE(finished.load());
TEST_CASE("TimeoutScheduler: the destructor -- unlike cancel() -- waits for a running callback", ...)

which is a sharper answer than "land the probe": one case pins that cancel() does not wait, the other that the destructor does, so neither can pass if the two collapse into the same behaviour.

What survives, and is the rescoped ticket

The general claim stands: 25 of #550's 27 rows still have no case asserting their G-level, and the deleted probes are still gone. What changes is the shape of the remaining work — it is no longer "land the reproductions," it is "audit the rest against a baseline that now exists." Whoever rewrites this should:

1. Wait for core: honour bindWaitPolicy at switchBackend and reconnect, cancel the adapter's own completions, and document TimeoutScheduler::cancel (fixes #615, fixes #619, fixes #620) #639 to land, then take its two cases as the pattern for the other rows rather than inventing a second one.
2. Do the audit of the twelve files properly. The issue is explicit that its own heuristic was not good enough to conclude on — "Do not treat zero-assertions=0 as a measurement" — and it is right. I re-ran only the coarse count on a8511aa6: grep -rn "cancelPending" tests/ | wc -l → 38, unchanged. I did not read the twelve files either, so the "nothing asserts strength" claim remains unverified by two people now.
3. Keep the issue's own re-open condition.

Re-scoping rather than closing, deliberately

Per AGENTS.md this is a finding that partly contradicts the ticket that produced it, so it is recorded here rather than shipped around: the issue was right that the guarantees were unasserted, right about which two rows mattered most, and its framing was overtaken between filing and triage by the fix for those same two rows. That is the #542 pattern this repository has hit before — a measurement that was true when written and stale by dispatch.

No triage: verdict is being self-assigned for the rewritten ticket when it is filed; per AGENTS.md it should go back through triage untriaged.

Labelling triage: rescope, area: core.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VptDWG2fKr2vBnLSJcgzgW

[Yaraslaut]

Closed as superseded by morph#550, not as resolved

Everything here is reproduced verbatim on morph#550: the two deleted probes and what they measured (morph#619's okRan=1 errRan=0, morph#620's firing-callback race), the 38-call-sites-across-12-files count, the full zero-assertions=0 table, the spec citation at concurrency_and_lifetimes.md:164, and — importantly — the explicit warning that the zero-assertions heuristic is not good enough to conclude on and must not be quoted as a measurement, together with the list of what was not done. Nothing was tidied in the move.

The reason is this issue's own framing: it is morph#550's Part 2 acceptance criterion, as its resolution step 2 states —

#550's second comment proposes exactly this as a regression baseline for its Part 2.

A policy morph#550 exists to write down, and the suite that holds that policy, are one deliverable. Split apart, the policy stays unfalsifiable, which is the condition morph#550 was opened to end.

Re-open if morph#550 closes without landing tests/test_cancellation_policy.cpp — or closes having written the policy down as prose only. That outcome would recreate exactly the situation this issue reported: a guarantee recorded and asserted by nothing that runs.