Split out from #1497 — Swift executor URLSession error audit. Section E — Cancellation gaps.
File references are to native/swift/Sources/wordpress-api/SafeRequestExecutor.swift unless noted; :NNN line numbers were verified against fix/converge-executor-error-classification.
Severity: medium. In both perform implementations, withTaskCancellationHandler's onCancel calls cancellation.cancel(), which nils a still-unset _task; TaskCancellation has no cancelled latch, and withTaskCancellationHandler invokes onCancel immediately when the surrounding Task is already cancelled — before the continuation body creates the URLSession task. A pre-cancelled or racing cancellation therefore cancels nothing: the request executes fully (a cancelled POST/DELETE still sends the mutation) and the caller receives success instead of CancellationError. Fix: latch cancel() and cancel any task assigned after the fact, and/or check Task.isCancelled before resuming.
Severity: medium. In both
performimplementations,withTaskCancellationHandler'sonCancelcallscancellation.cancel(), which nils a still-unset_task;TaskCancellationhas no cancelled latch, andwithTaskCancellationHandlerinvokesonCancelimmediately when the surrounding Task is already cancelled — before the continuation body creates the URLSession task. A pre-cancelled or racing cancellation therefore cancels nothing: the request executes fully (a cancelled POST/DELETE still sends the mutation) and the caller receives success instead ofCancellationError. Fix: latchcancel()and cancel any task assigned after the fact, and/or checkTask.isCancelledbefore resuming.