test: diagnose worker cancellation escalation

Author: menshikovs

.github/workflows/worker-lifecycle-compatibility.yaml

@@ -100,7 +100,10 @@ jobs:
       - uses: actions/checkout@v4
         with:
           repository: menshikovs/R-Knowledge-MCP
-          ref: main
+          # Pin the latest public commit inspected for the launcher consumer.
+          # It does not currently publish tests/test_codex_launcher.py; the
+          # pytest step remains strict so the missing consumer evidence stays visible.
+          ref: 8f01870558263283ba197dc215d0f1ab5ad864af
           path: R-Knowledge-MCP
       - uses: actions/setup-python@v5
         with:

R/workers.R

@@ -288,6 +288,7 @@ Worker <- R6::R6Class(
     last_diagnostics = NULL,
     exited_at = NULL,
     cancel_deadline = NULL,
+    cancel_escalated_at = NULL,
 
     start_process = function(app, fn, args, packages, timeout, supervision) {
       payload <- worker_prepare_payload(fn, args, packages)
@@ -399,6 +400,7 @@ Worker <- R6::R6Class(
       alive <- p$is_alive()
       if (isTRUE(self$cancel_requested) && alive &&
           !is.null(private$cancel_deadline) && now_seconds() >= private$cancel_deadline) {
+        private$cancel_escalated_at <- now_seconds()
         private$force_terminate()
         alive <- p$is_alive()
       }
@@ -591,7 +593,10 @@ Worker <- R6::R6Class(
 
     finish_cancelled = function() {
       if (self$state != "running") return(invisible(FALSE))
-      private$last_diagnostics <- private$diagnostics()
+      private$last_diagnostics <- paste0(
+        private$diagnostics(),
+        "; cancel_escalated=", !is.null(private$cancel_escalated_at)
+      )
       if (!is.null(private$process)) try(private$process$kill_tree(), silent = TRUE)
       private$cleanup()
       private$cancel_deadline <- NULL

docs/WORKER_LIFECYCLE_COMPATIBILITY_REPORT.md

@@ -516,8 +516,45 @@ The report-only commit `319d4c6f6ea31bc8bd0529306f8187b7f604326e` triggered
 which created four jobs. Windows and macOS passed again, and the consumer job
 failed again on the missing public test path. At 2026-10-26 11:15:31 UTC, the
 Ubuntu job was still in `setup-r-dependencies`; it had not rerun the lifecycle
-suite. The Ubuntu escalation result therefore remains unresolved rather than
-confirmed as transient or reproducible.
+suite.
+
+Commit `3a16a399e670c10a9efc99ca8556b93236a55858` triggered
+[run 40313778899](https://github.com/menshikovs/termr/actions/runs/40313778899),
+which completed all four jobs. Windows and macOS passed the shared contracts,
+the CRAN real-child probe and their applicable lifecycle tests. Windows
+reported the same two explicit Windows skips. Ubuntu passed the shared
+contracts and CRAN real-child probe, then failed only the lifecycle assertion
+at `test-worker-lifecycle.R:219`: elapsed time was 0.054 seconds versus the
+fixture's 0.100-second minimum. The logs contain no child-side acknowledgement
+or escalation-reason diagnostic. Therefore they cannot distinguish a child
+that exited on SIGINT from an early escalation; the prior test itself only
+assumed that the child ignored the interrupt. This was an inconclusive test
+oracle, not evidence of a worker defect. The new test fixture and private
+diagnostic below are pending a hosted rerun.
+
+The pending correction removes the minimum-elapsed assertion. The escalation
+fixture now prints an acknowledgement from its interrupt handler and keeps
+running; the test checks that it is still alive, then checks a private
+monotonic timestamp recorded only when the grace-deadline branch force-kills
+it. Separate tests cover a prompt cleanup handler and a child released to exit
+naturally after cancellation was accepted. This adds no public API and changes
+no cancellation defaults or behavior. On the local Windows sandbox,
+`Rscript -e "testthat::test_local('.', filter = 'worker-lifecycle', reporter =
+'summary')"` passed the runnable expectations; process tests were skipped
+because the environment blocks processx pipes. A hosted rerun is required for
+the real-process assertions.
+
+The consumer failure in runs 40311845330, 40312594293 and 40313778899 is an
+unpublished-test blocker. The current public R-Knowledge-MCP `main` is
+`8f01870558263283ba197dc215d0f1ab5ad864af`. The branch listing contained 34
+public heads; recursive tree inspection found no launcher-test file on any of
+them. The 25 public pull-request file lists likewise contained no
+`tests/test_codex_launcher.py` (or equivalent launcher test path). No public
+commit containing the referenced pytest tests was located, so the tests cannot
+be run unmodified against either package version. The workflow now pins the
+inspected `main` commit; it retains the strict test invocation and does not
+substitute unrelated tests. This consumer comparison remains unresolved until
+the consumer publishes its suite.
 
 `actionlint` was not installed. A local `go install` attempt failed because
 the build network was blocked (`proxy.golang.org` connection refused) and Go's
@@ -530,19 +567,21 @@ substitute for the actual runs linked above.
 
 | Platform/job | CRAN 1.0.1 and development contract | Real-child baseline probe | Lifecycle suite | Classification |
 |---|---|---|---|---|
-| Ubuntu | Run 40311845330: pass / pass (32 expectations each), probe pass. Run 40312594293 had not reached tests at 11:15:31 UTC | Pass in 40311845330 | One failure in 40311845330: escalation elapsed 0.055s, expected at least 0.1s | Unresolved cancellation/escalation behavior; repeat test pending runner progress |
-| Windows | Pass / pass (32 expectations each) in runs 40311845330 and 40312594293 | Pass in both runs | Pass in both; 2 explicit POSIX signal skips | Applicable Windows lifecycle behavior passed; skipped cases are unsupported on Windows |
-| macOS | Pass / pass (32 expectations each) in runs 40311845330 and 40312594293 | Pass in both runs | Pass in both; no skips | Applicable macOS lifecycle behavior passed |
-| Ubuntu R-Knowledge-MCP | Not applicable; both package installs succeeded | Not applicable | No tests ran; pytest exit 4 due missing file in runs 40311845330 and 40312594293 | Consumer comparison unresolved due missing public test suite |
+| Ubuntu | Pass / pass (32 expectations each) in 40313778899; CRAN probe pass | Pass in 40313778899 | One failure in 40313778899: the 0.054s early completion cannot establish graceful exit versus escalation; new diagnostic test pending | Unresolved pending synchronized rerun |
+| Windows | Pass / pass in 40311845330, 40312594293 and 40313778899; CRAN probe pass | Pass in all three runs | Pass in all three; 2 explicit Windows skips | Applicable Windows lifecycle behavior passed; two POSIX signal cases are unsupported on Windows |
+| macOS | Pass / pass in 40311845330, 40312594293 and 40313778899; CRAN probe pass | Pass in all three runs | Pass in all three; no skips | Applicable macOS lifecycle behavior passed |
+| Ubuntu R-Knowledge-MCP | Package installs succeeded in 40313778899; test source pinned to `8f01870558263283ba197dc215d0f1ab5ad864af` | Not applicable | No tests ran; pytest exit 4 because the pinned consumer revision lacks the requested file | Unresolved: consumer tests are not present on public branches or PRs |
 
 The [R-CMD-check workflow](https://github.com/menshikovs/termr/actions/workflows/R-CMD-check.yaml)
 has push filters for `main`, `master` and `develop-*`, plus an unfiltered
-`pull_request` trigger. No pull request exists for this branch, so there is no
-R-CMD-check run for this head. A pull request from this feature branch will
-trigger its matrix: Ubuntu release, oldrel-1, R 4.1 and devel; macOS release;
-and Windows release. The dedicated [worker lifecycle workflow](https://github.com/menshikovs/termr/actions/workflows/worker-lifecycle-compatibility.yaml)
-now runs real child probes and lifecycle tests on all three operating systems,
-but its Ubuntu escalation failure and the consumer suite path remain open.
+`pull_request` trigger. At this report revision no draft pull request has been
+created, so there is no feature-branch R-CMD-check run yet. A draft PR from this
+branch triggers its matrix: Ubuntu release, oldrel-1, R 4.1 and devel; macOS
+release; and Windows release. The dedicated
+[worker lifecycle workflow](https://github.com/menshikovs/termr/actions/workflows/worker-lifecycle-compatibility.yaml)
+runs real child probes and lifecycle tests on all three operating systems.
+The Ubuntu termination reason, consumer suite availability and feature-branch
+R CMD check remain open.
 
 ## K. Breaking-change assessment
 

tests/testthat/test-worker-lifecycle.R

@@ -190,16 +190,21 @@ test_that("graceful cancellation allows child cleanup while the event loop stays
   pilot$wait_for(function(app) !worker$is_running(), timeout = 8)
   expect_identical(worker$state, "cancelled")
   expect_true(file.exists(marker))
+  expect_null(worker$.__enclos_env__$private$cancel_escalated_at)
+  expect_match(worker$.__enclos_env__$private$last_diagnostics,
+               "exit_status=0;.*cancel_escalated=FALSE")
   expect_gt(ticks, 0L)
   expect_lt(ticks, 1000L)
 })
 
-test_that("a missed graceful interrupt escalates at its deadline", {
+test_that("a child that ignores SIGINT is killed at the grace deadline", {
   skip_on_cran()
   script <- tempfile("termr-unresponsive-child-", fileext = ".R")
   writeLines(c(
     'cat("READY\\n"); flush(stdout())',
-    "repeat(tryCatch(Sys.sleep(0.02), interrupt = function(e) NULL))"
+    'repeat(tryCatch(Sys.sleep(60), interrupt = function(e) {',
+    '  cat("INTERRUPT_HANDLED\\n"); flush(stdout())',
+    "}))"
   ), script)
   on.exit(unlink(script, force = TRUE), add = TRUE)
 
@@ -212,12 +217,54 @@ test_that("a missed graceful interrupt escalates at its deadline", {
   }, add = TRUE)
   lifecycle_wait_for_output(pilot, worker, "READY")
 
-  started <- now_seconds()
-  expect_true(worker$request_cancel(grace = 0.15))
+  expect_true(worker$request_cancel(grace = 2))
+  deadline <- worker$.__enclos_env__$private$cancel_deadline
+  pilot$wait_for(function(app) "INTERRUPT_HANDLED" %in% worker$stdout, timeout = 8)
+  expect_true(worker$is_running(), info = paste(worker$stdout, collapse = " | "))
+  expect_true(worker$cancel_requested)
+
+  pilot$wait_for(function(app) !worker$is_running(), timeout = 8)
+  private <- worker$.__enclos_env__$private
+  expect_identical(worker$state, "cancelled")
+  expect_true(is.numeric(private$cancel_escalated_at))
+  expect_gte(private$cancel_escalated_at, deadline)
+  expect_match(private$last_diagnostics, "cancel_escalated=TRUE")
+})
+
+test_that("a natural child exit during a cancellation request is not escalated", {
+  skip_on_cran()
+  release <- tempfile("termr-cancel-natural-release-")
+  script <- tempfile("termr-cancel-natural-child-", fileext = ".R")
+  writeLines(c(
+    'cat("READY\\n"); flush(stdout())',
+    sprintf("release <- %s", deparse(release)),
+    "repeat {",
+    '  tryCatch(Sys.sleep(60), interrupt = function(e) {',
+    '    cat("CANCEL_RECEIVED\\n"); flush(stdout())',
+    "  })",
+    '  if (file.exists(release)) quit(save = "no", status = 0L, runLast = FALSE)',
+    "}"
+  ), script)
+  on.exit(unlink(c(release, script), force = TRUE), add = TRUE)
+
+  application <- app(label("x"))
+  pilot <- test_app(application, 20, 2)
+  worker <- lifecycle_start_process(application, args = c("--vanilla", script))
+  on.exit({
+    if (worker$is_running()) worker$cancel(grace = 0)
+    pilot$stop()
+  }, add = TRUE)
+  lifecycle_wait_for_output(pilot, worker, "READY")
+
+  expect_true(worker$request_cancel(grace = 5))
+  pilot$wait_for(function(app) "CANCEL_RECEIVED" %in% worker$stdout, timeout = 8)
+  expect_true(worker$is_running())
+  writeLines("exit naturally", release)
   pilot$wait_for(function(app) !worker$is_running(), timeout = 8)
+  private <- worker$.__enclos_env__$private
   expect_identical(worker$state, "cancelled")
-  expect_gte(now_seconds() - started, 0.1)
-  expect_lt(now_seconds() - started, 8)
+  expect_null(private$cancel_escalated_at)
+  expect_match(private$last_diagnostics, "exit_status=0;.*cancel_escalated=FALSE")
 })
 
 test_that("asynchronous cancellation removes worker temporary files", {