FEATURE-ci-v3-runtime-green: remove PSK fixture scheduling races

Author: etr

ChangeLog

@@ -1,4 +1,6 @@
 Version 3.0.0 - 2026-10-10
+	Keep PSK cancellation lookup held until owner release and avoid artificial
+		per-fragment scheduling delays in the TLS test transport.
 	Avoid Windows DLL shutdown hangs by retaining the default timer service
 		during process termination while preserving ordinary timer cleanup.
 	Report the saved Winsock error code when host WSAPoll fails.

specs/tasks/FEATURE-ci-v3-runtime-green.md

@@ -70,3 +70,24 @@ Integrate the focused repairs and ChangeLog update now. Full CI remains incomple
 Groundwork validation has not run and stays deferred until full CI is green.
 This integration does not mark the overall CI repair complete or reopen closed
 diagnostic batches. Draft PR #382 carries the original working-branch runs.
+
+## Stage 4: PSK test fixture scheduling (2026-10-27)
+
+- [x] Read the completed, previously authorized diagnostic receipts; keep their budgets closed.
+- [x] Preserve the native Darwin RED: 14 tests/313 checks, three failures; held TLS1.3 cancellation callback already returned, and certificate-default TLS1.3 handshake timed out.
+- [x] Release the held cancellation lookup explicitly after assertions and close; bound the callback wait to five seconds for failure cleanup.
+- [x] Drain ready fragmented transport work and yield while waiting for provider work, preserving the original fragments and every deadline/assertion.
+- [x] Reproduce the real certificate fixture timeout under coarse scheduling, then pass the same regression and all 14 PSK tests/313 checks.
+- [x] Pass changed-file cpplint and diff checks.
+- [ ] Native current-source CI, including Darwin selected archive acceptance.
+- [ ] Resolve the remaining Windows external-loop failure from supported evidence.
+- [ ] Close the FreeBSD selected-archive timeout gate with actual evidence.
+
+Evidence and commands: primary checkout `.debug/v3-ci-native-repairs-PJFEkn/journal.md`.
+Current c1 installed matrix passed Linux, Darwin, FreeBSD; Windows failed. Native/fuzz, CodeQL and Verify Build passed. Source-equivalent selected archive remains failed; no current-source green claim.
+
+The diagnostic Windows four-test program failed one of 52 checks in 0.741 seconds with WSAPoll error10038 before stop was requested. Two bounded new socket-only probes on local Windows11 returned POLLNVAL successfully; they do not establish the Server2022 failure cause. No poll error suppression or guessed production fix was applied. Previous capture budgets remain closed.
+
+Fixture root cause: the cancellation rescue unconditionally released after250ms, before the owner could assert cancellation under slower scheduling. The transport also slept after every41/73-byte fragment, charging scheduler delays to real handshake deadlines. A minimal real TLS1.3 certificate fixture with1ms sleeps delayed to15ms failed at2089ms/outcome8(timeout); draining progress first passed at625ms. An intermediate full coarse-scheduling check still failed two held/capacity assertions because idle sleeps could expire the400ms pre-lookup deadline. Yielding while idle preserved that deadline and passed all313 checks in1.029seconds, with zero skips. The100ms owner-responsiveness assertion, cancellation/timeout/capacity/late-result assertions, bounded drains and all protocol settings remain unchanged. Only test source changed; production TLS is unchanged.
+
+Setup evidence is retained honestly: system OpenSSL was rejected before selecting the existing3.5.9 provider; the first suite launch used build-root cwd instead of test cwd and failed fixture path lookup. Correcting cwd, as required by the generated relative TLS_TEST_DIR, produced the meaningful behavioral check. Neither setup failure justifies a source workaround. No broad baseline or Groundwork validation was run.

test/unit/tls_psk_fixture.hpp

@@ -135,17 +135,20 @@ struct connection : mtls_test::adapter_connection {
         if (host) SSL_set_tlsext_host_name(peer.get(), host);
         handshake = hd::tls_handshake_operation(owner, 1, std::chrono::steady_clock::now() + timeout);
     }
-    void tick() {
-        ex.run_pending();
-        for (const auto& op : raw.pending_ops()) transfer(op);
+    bool tick() {
+        bool progressed = ex.run_pending() != 0;
+        for (const auto& op : raw.pending_ops()) progressed = transfer(op) || progressed;
         advance_peer();
+        return progressed || ex.pending() != 0;
     }
     template<class Predicate> bool until(Predicate predicate, std::chrono::milliseconds timeout = std::chrono::seconds(3)) {
         const auto deadline = std::chrono::steady_clock::now() + timeout;
         while (std::chrono::steady_clock::now() < deadline) {
-            tick();
+            const bool progressed = tick();
             if (predicate()) return true;
-            std::this_thread::sleep_for(std::chrono::milliseconds(1));
+            // Fragmentation is deliberate; adding a scheduling delay to every
+            // ready fragment can consume the real handshake deadline.
+            if (!progressed) std::this_thread::yield();
         }
         return false;
     }

test/unit/tls_psk_test.cpp

@@ -119,23 +119,23 @@ LT_BEGIN_AUTO_TEST(psk_suite, blocking_lookup_leaves_owner_responsive_and_cancel
         auto released = release.get_future().share();
         auto config = psk_test::credentials(runtime, [&](auto, const auto&) {
             entered = true;
-            released.wait();
+            // The owner releases lookup only after checking cancellation.
+            // A broken blocking implementation must still unwind the fixture.
+            released.wait_for(5s);
             returned = true;
             return hd::psk_lookup_result{hd::psk_lookup_status::accepted, hd::secure_bytes(psk_test::bytes("secret"))};
         });
         hd::tls_credentials_registry registry;
         LT_ASSERT(registry.replace(config).ok());
         psk_test::connection peer(registry.acquire()->select_default(), version, "identity", psk_test::bytes("secret"));
-        // Bounded rescue ensures RED cannot leave a fixture hanging in lookup.
-        auto rescue = std::async(std::launch::async, [&] { std::this_thread::sleep_for(250ms); release.set_value(); });
         peer.handshake.submit(*peer.tls);
         std::chrono::steady_clock::duration longest{};
         const auto until = std::chrono::steady_clock::now() + 1s;
         while (!entered && std::chrono::steady_clock::now() < until) {
             const auto before = std::chrono::steady_clock::now();
-            peer.tick();
+            const bool progressed = peer.tick();
             longest = std::max(longest, std::chrono::steady_clock::now() - before);
-            std::this_thread::sleep_for(1ms);
+            if (!progressed) std::this_thread::yield();
         }
         const auto cancelled = peer.tls->request_cancel(*peer.handshake.state());
         peer.ex.run_pending();
@@ -147,7 +147,7 @@ LT_BEGIN_AUTO_TEST(psk_suite, blocking_lookup_leaves_owner_responsive_and_cancel
         LT_CHECK(peer.handshake.state()->stored_result().code == hh::outcome_code::cancelled);
         LT_CHECK(!peer.tls->peer_metadata());
         peer.close();
-        rescue.get();
+        release.set_value();
         runtime->stop();
         LT_CHECK(runtime->drain(std::chrono::steady_clock::now() + 1s));
         peer.ex.run_pending();