test(stack): prove Provider receives cancellation

[XnLemon]

Summary

• pin Samples test(stack): prove Provider receives cancellation #7 at exact commit 9f26d5e674a79b2d89685b05ca4ed02a2c5ba37d
• give every canceled SSE Invocation a non-sensitive, unique Provider observation marker
• wait for the first Provider task chunk so Router has the exact task ID, then close the stream and wait for the correlated canceled Ledger record
• query the same installed Agent through Control Plane and Router and require canceled: true plus cancelCount: 1
• add the marker prefix to the full persistence and process-log secrecy scan

Why

The existing acceptance proved caller cancellation and Ledger finalization, while Core unit coverage proved a tasks/cancel attempt. It did not prove that the live Provider selected from watched Nacos topology received that request. A Provider could drop the task on stream disconnect, or the caller could disconnect before Router learned the Provider task ID, and the old Stack test would still pass.

This slice closes that gap without a direct Consumer-to-Provider request or a test-only management endpoint. The observation itself is a second normal managed invocation through Gateway and Router; it does not retry the canceled Invocation.

Acceptance

For each cancellation:

Consumer receives accepted + first Provider task chunk
  -> Consumer closes SSE after Router knows the exact task ID
  -> Router sends one bounded tasks/cancel to the already selected Provider
  -> Provider records one Workspace/exact-Release/capability-scoped request
  -> Router and Ledger finalize one correlated canceled Invocation
  -> Consumer queries the marker through Gateway/Router
  -> Provider returns cancelCount == 1
  -> both Invocation records are queryable in Ledger

No alternate endpoint, provider, Release, retry, direct Provider dial, stale success, payload persistence, or credential exposure is introduced.

Validation

• go mod verify
• clean go mod tidy
• go run ./cmd/manifest-validator components.json
• go build ./...
• go test ./...
• go test -race ./...
• go vet ./...
• go test -tags=e2e -run ''^$'' ./tests/backend
• git diff --check

The GitHub backend job is the authoritative live-container acceptance.

Dependencies

• base: Stack test(stack): prove registration lease lifecycle #6 (codex/registration-lease-e2e)
• Samples: test(runtime-b): prove provider-side cancellation NeKiro-Samples#7 at 9f26d5e674a79b2d89685b05ca4ed02a2c5ba37d
• Core topology and registration remain pinned by Stack test(stack): prove registration lease lifecycle #6

Fallback delta: removed 0, retained 0, added 0, net +0.
Added fallback evidence: none.

[XnLemon]

Re-reviewed current HEAD 0bd10f6. I found no remaining required-closure issue. The live acceptance waits for the first Provider task chunk before disconnecting, so Router has the exact task ID; it then proves one bounded tasks/cancel reaches the already selected Provider, the correlated Invocation reaches canceled in Ledger, and a separate managed observation returns cancelCount == 1. The marker prefix remains covered by persistence and process-log secrecy scans. Backend, browser, security, and required Stack CI are green.

中文

已复审当前 HEAD 0bd10f6，未发现剩余的 required-closure 问题。live acceptance 会在断开前等待首个 Provider task chunk，确保 Router 已取得精确 task ID；随后证明一次有界 tasks/cancel 到达已选中的 Provider、关联 Invocation 在 Ledger 中进入 canceled，并由独立的托管 observation 返回 cancelCount == 1。marker prefix 继续由持久化与进程日志保密扫描覆盖。Stack backend、browser、security 和 required CI 全绿。