@@ -112,6 +112,59 @@ class DexpaceTransportAsyncHTTPCancellationTest < DexpaceTestCase
       adapter&.close
       server&.close
     end
+
+    # Review round 2's R2-1. `Cancellation::Source#cancel` steals its hooks under its mutex, flips
+    # the flag and runs them OUTSIDE it, on the canceller's thread -- so the exchange can end
+    # between the flip and the adapter's hook: check-after-resume sees the flag, the pivot
+    # settles cancelled and the exchange closes its queue before the hook pushes onto it, and a
+    # push onto a closed queue raises `ClosedQueueError`, which `Hooks.notify` would hand back to
+    # the caller's `Source#cancel`. Deterministic through an ordinary caller's hook registered
+    # FIRST, which parks the canceller across exactly that window; the same ordering needs no
+    # slow hook when the canceller is merely descheduled there. A cancel that lost the race
+    # against the exchange's own end is not the caller's failure.
+    test "a token cancel in flight while the exchange finishes never raises out of " \
+         "Source#cancel on the canceller's thread, and the future is cancelled" do
+      source = Dexpace::Cancellation.source
+      flagged = ::Thread::Queue.new  # the canceller has flipped the flag and is in its hooks
+      finished = ::Thread::Queue.new # the exchange has ended: let the adapter's hook run now
+      outcome = ::Thread::Queue.new
+      source.token.on_cancel do |_reason|
+        flagged.push(true)
+        finished.pop
+      end
+      client = Object.new
+      client.define_singleton_method(:retries) { 0 }
+      client.define_singleton_method(:pool) { Object.new.tap { |pool| def pool.close = nil } }
+      client.define_singleton_method(:call) do |_native|
+        flagged.pop # scheduler-aware: the reactor keeps turning until the cancel is in flight
+        ::Protocol::HTTP::Response.new("HTTP/1.1", 204, ::Protocol::HTTP::Headers.new, nil)
+      end
+      adapter = AsyncHTTP.using(client)
+      canceller = nil
+
+      Sync do |task|
+        future = adapter.call(request("http://example.test/"), nil, source.token)
+        canceller = ::Thread.new do
+          outcome.push(begin
+            source.cancel(:racing)
+          rescue ::StandardError => error
+            error
+          end)
+        end
+
+        error = assert_raises(Dexpace::CancelledError) { value_within(future) }
+
+        assert_equal(:racing, error.reason)
+        assert_predicate(future, :cancelled?)
+        assert_exchange_released(task) # the exchange ended and closed its queue...
+      ensure
+        finished.push(true) # ...and only now does the adapter's hook run (on every path)
+      end
+      canceller.join
+      result = outcome.pop
+
+      assert_same(true, result, "Source#cancel raised #{result.inspect} out of the adapter's hook")
+    end
   end
 
   # A cancel racing the delivery (TRANSPORT-9), landing after it (ASYNC-20), or reaching a blocked
@@ -146,12 +199,18 @@ class DexpaceTransportAsyncHTTPCancellationDeliveryTest < DexpaceTestCase
     end
 
     # The negative twin (ASYNC-20): a response already delivered to the caller must not be closed
-    # by a late cancellation of the future -- a cancel on a settled pivot is a no-op.
-    test "ASYNC-20: cancelling the future after delivery does not close the delivered response" do
+    # by a late cancellation of the future -- a cancel on a settled pivot is a no-op. The watcher
+    # that would close it on a TOKEN cancel stays for the life of the delivered response, and
+    # transient: a body a caller never closes must not hold the caller's `Sync` block open --
+    # without `transient: true` that property fails as a hang and never by name (review round
+    # 2's R2-3), so it is asserted here before the body is released and its release is asserted
+    # to end the watcher.
+    test "ASYNC-20: cancelling the future after delivery does not close the delivered response; " \
+         "its watcher stays, transient, until the body is released" do
       server = AsyncHTTPHoldingServer.new(hold: :head)
       adapter = AsyncHTTP.build
 
-      reactor_over(server) do
+      reactor_over(server) do |task|
         future = adapter.call(request("http://127.0.0.1:#{server.port}/"), nil, nil)
         server.wait_for_accept
         server.release("ok")
@@ -161,7 +220,13 @@ class DexpaceTransportAsyncHTTPCancellationDeliveryTest < DexpaceTestCase
 
         refute_predicate(response.body, :closed?)
         refute_predicate(future, :cancelled?)
+        # Read while the body is open and asserted only after its release: a non-transient
+        # watcher under a still-open body would hold the reactor open on the failing assertion.
+        transient = watcher_tasks(task).map(&:transient?)
+
         assert_equal("ok", response.body_string)
+        assert_equal([true], transient, "one watcher per delivered response, and transient")
+        assert_exchange_released(task) # the body's release is what ends the watcher
       end
     ensure
       adapter&.close
 
@@ -44,13 +44,14 @@ def map(request, logger: Dexpace::Instrumentation::Logger::NULL, policy: DropPol
     def names(native) = native.headers.to_a.map { |name, _| name.downcase }
 
     # A request-shaped object answering the four readers the seam contract types nothing about,
-    # carrying headers no Dexpace validation has seen -- design §10.10's admitted hole.
+    # carrying headers no Dexpace validation has seen -- design §10.10's admitted hole -- and,
+    # with `body:`, a body on a method the builder's HTTP-7 would have refused it on.
     def forged_request(name, value)
       forged_request_with([name, value])
     end
 
-    def forged_request_with(*pairs)
-      template = request
+    def forged_request_with(*pairs, method: "GET", body: nil)
+      template = request(method: method)
       headers = Object.new
       headers.define_singleton_method(:each_entry) do |&block|
         pairs.each do |pair|
@@ -61,7 +62,7 @@ def forged_request_with(*pairs)
       forged.define_singleton_method(:method) { template.method }
       forged.define_singleton_method(:url) { template.url }
       forged.define_singleton_method(:headers) { headers }
-      forged.define_singleton_method(:body) { nil }
+      forged.define_singleton_method(:body) { body }
       forged
     end
   end
@@ -169,12 +170,30 @@ class MappingTest < DexpaceTestCase
       refute_includes(names(native), "content-type")
     end
 
-    test "a body-less request maps to a nil native body, and a body-forbidden method attaches " \
-         "none" do
+    test "a body-less request maps to a nil native body" do
       assert_nil(map(request(method: "POST")).body)
       assert_nil(map(request(method: "GET")).body)
     end
 
+    # Dispatch step 8: a body-forbidden method gets no body attached. Through the model the guard
+    # is unreachable -- HTTP-7 already makes a GET's body nil at the builder -- so it is asserted
+    # over the forged shape that met no builder (design §10.10's hole), where a body on a GET or
+    # a HEAD would otherwise go out chunked; the forged POST is the control that shows the
+    # fixture carries its body through (review round 2's R2-2).
+    test "a body-forbidden method attaches none, even on a forged request carrying one" do
+      smuggled = Dexpace::Body.bytes("smuggled".b)
+
+      %w[GET HEAD].each do |method|
+        forged = forged_request_with(%w[X-Ok 1], method: method, body: smuggled)
+
+        assert_predicate(forged.method, :body_forbidden?, method)
+        assert_nil(map(forged).body, method)
+      end
+      control = map(forged_request_with(%w[X-Ok 1], method: "POST", body: smuggled))
+
+      assert_kind_of(RequestBody, control.body)
+    end
+
     test "a body maps to a RequestBody the library pulls; framing is never copied from a header" do
       native = map(request(headers: { "Content-Length" => "999" },
                            body: Dexpace::Body.bytes("abc".b), method: "POST",))
 
@@ -28,20 +28,29 @@ def reactor_over(server)
     end
   end
 
-  # After a settlement that delivered no response, the exchange task and its transient watcher
-  # are both gone from the reactor: a turn or two for them to finish, then no non-transient child
-  # remains and no child is a watcher. The pool's own transient gardener is the one child that
-  # legitimately stays for the client's life, which is why the watcher is found by its
-  # annotation rather than by counting. The watcher's release is what keeps a long-lived reactor
-  # from accumulating one parked task per failed exchange, and this is what turns its absence red.
+  # The watcher tasks alive under `task`, found by the adapter's own annotation: one per exchange
+  # whose queue is still open -- in flight, or delivered with its body not yet released.
   #
   # @param task [Async::Task] the task the exchange was spawned under
-  def assert_exchange_released(task)
+  # @return [Array<Async::Task>]
+  def watcher_tasks(task)
     watcher = Dexpace::Transport::AsyncHTTP.const_get(:Exchange, false)::WATCHER_ANNOTATION
+    Array(task.children).select { |child| child.annotation == watcher }
+  end
+
+  # After a settlement that delivered no response, or after a delivered body's release, the
+  # exchange task and its transient watcher are both gone from the reactor: a turn or two for
+  # them to finish, then no non-transient child remains and no child is a watcher. The pool's own
+  # transient gardener is the one child that legitimately stays for the client's life, which is
+  # why the watcher is found by its annotation rather than by counting. The watcher's release is
+  # what keeps a long-lived reactor from accumulating one parked task per failed exchange, and
+  # this is what turns its absence red.
+  #
+  # @param task [Async::Task] the task the exchange was spawned under
+  def assert_exchange_released(task)
     RELEASE_TURNS.times do
       task.yield
-      children = Array(task.children)
-      return if children.all?(&:transient?) && children.none? { |c| c.annotation == watcher }
+      return if Array(task.children).all?(&:transient?) && watcher_tasks(task).empty?
     end
 
     flunk("the exchange task or its watcher outlived the settlement by #{RELEASE_TURNS} turns")