Root cause was cross-test measurement leakage, not a timing budget.
EventPump's `Meter` is STATIC — one instance per process — and a `MeterListener`
can only select by *meter* in `InstrumentPublished`. `StartMeterCapture` therefore
received measurements from every `EventPump` alive anywhere in the assembly. xUnit
runs test classes in parallel and several build pumps (`EventPumpStreamFaultTests`,
the `Driver-X` test in this same file), so a sibling's events landed in these
counters. That is why the flake needed a busy box: it needed two tests to overlap.
Measured directly during the gate — `Received = 11` in a run that emitted 10.
The old `Received == Dispatched + Dropped + InFlight` assertion is what turned the
leak into a failure. `InFlight` is DERIVED as `Received - Dispatched - Dropped`, so
the identity is a tautology that cannot fail on a real defect — only on a foreign
increment landing between its four separate `Interlocked.Read` calls. Hence the
reported subject, `counters.Received`. It is deleted, along with the `InFlight`
member, and replaced by direct assertions on the three MEASURED counters.
Three further defects in the same test, all found on the way:
- **The "held" dispatch loop was never held.** `OnDataChange` is `EventHandler<T>`
— void-returning — so `async (_, _) => await gate` is async VOID: it returned to
the dispatch loop at the first await and blocked nothing. Measured `Dispatched =
2..3`, never 0. Drops happened only when the producer happened to outrun the
consumer, so the arrangement the doc comment describes was fiction and the
assertions rode on scheduling luck. Now a synchronous `ManualResetEventSlim.Wait()`
on the loop's own thread, pinned by `Dispatched.ShouldBe(0)`.
- **Fixed `Task.Delay(150)`** replaced by a presence poll on the drop count (#500's
rule). Dropped starts at 0, so it cannot be satisfied by the initial state.
- **Emission is staged** — one event, wait for the dispatcher to enter the handler,
then the other nine — so the arithmetic is exact (`10 - 1 held - 2 buffered = 7`)
rather than scheduler-dependent.
The gate release moved into `finally`, ahead of disposal: `DisposeAsync` awaits the
dispatch loop, which is now genuinely parked on that gate, so a failed assertion
would otherwise hang instead of failing.
Verified: 15/15 clean under the exact contention the issue measured (Runtime +
AdminUI + Core concurrently) — where the half-fixed version still failed on run 4.
Falsifiability: restoring the async-void handler turns the new assertions red.
Joseph Doherty
95295210b0