test(audience): cancellation exits FlushAsync and SendBatchAsync cleanly

Two regression guards for PR #701 review from @nattb8.

SendBatchAsync_CallerCancelled_Throws: pre-cancel the token, confirm
the method throws OperationCanceledException, confirm the batch stays
on disk, confirm no backoff and no onError. Sabotage: re-add the empty
catch body and this fails because SendBatchAsync returns true silently.

FlushAsync_CancelledToken_Terminates_DoesNotHotLoop: pre-cancel the
token, start FlushAsync, race against a 2s timeout. With the fix the
task faults quickly; without it the task never completes. Also flips
the handler to 200 and runs a follow-up FlushAsync to prove
_sendInFlight was released (the finally block didn't get stranded).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ImmutableJeffrey

src/Packages/Audience/Tests/Runtime/ImmutableAudienceTests.cs

@@ -1178,6 +1178,63 @@ public void FlushAsync_ConcurrentCallers_OnlyOneReachesTransport()
                 "both FlushAsync calls should complete after release");
         }
 
+        [Test]
+        public async Task FlushAsync_CancelledToken_Terminates_DoesNotHotLoop()
+        {
+            // Regression for PR #701 review (@nattb8): if SendBatchAsync
+            // silently swallowed caller cancellation, the inner while-loop
+            // here would re-enter on the same cancelled token and spin
+            // because the batch is never deleted on that code path. The
+            // task below would never complete. After the fix, cancellation
+            // propagates and the task faults quickly.
+            var handler = new CancellingHandler();
+            var config = MakeConfig();
+            config.HttpHandler = handler;
+
+            ImmutableAudience.Init(config);
+            ImmutableAudience.Track("event_to_send");
+            ImmutableAudience.FlushQueueToDiskForTesting();
+
+            using var cts = new CancellationTokenSource();
+            cts.Cancel();
+
+            var flush = ImmutableAudience.FlushAsync(cts.Token);
+            var finishedFirst = await Task.WhenAny(flush, Task.Delay(TimeSpan.FromSeconds(2)));
+
+            Assert.AreSame(flush, finishedFirst,
+                "FlushAsync must terminate (not hot-loop) when the token is cancelled");
+            Assert.IsTrue(flush.IsCanceled || flush.IsFaulted,
+                "FlushAsync must propagate the cancellation, not return normally");
+            Assert.LessOrEqual(handler.CallCount, 1,
+                "a cancelled token must not drive repeated SendAsync attempts");
+
+            // Gate must be released by the finally block — a follow-up flush
+            // on an uncancelled token should proceed, proving _sendInFlight
+            // is not stranded at 1.
+            handler.AcceptNextAsSuccess = true;
+            var followUp = ImmutableAudience.FlushAsync();
+            Assert.IsTrue(followUp.Wait(TimeSpan.FromSeconds(2)),
+                "_sendInFlight must be released after a cancelled flush");
+        }
+
+        private class CancellingHandler : HttpMessageHandler
+        {
+            public int CallCount;
+            public bool AcceptNextAsSuccess;
+
+            protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken ct)
+            {
+                Interlocked.Increment(ref CallCount);
+                ct.ThrowIfCancellationRequested();
+                var status = AcceptNextAsSuccess ? HttpStatusCode.OK : HttpStatusCode.ServiceUnavailable;
+                var body = AcceptNextAsSuccess ? "{\"accepted\":1,\"rejected\":0}" : "";
+                return Task.FromResult(new HttpResponseMessage(status)
+                {
+                    Content = new StringContent(body)
+                });
+            }
+        }
+
         private class BlockingHandler : HttpMessageHandler
         {
             public readonly ManualResetEventSlim EnteredSendAsync = new ManualResetEventSlim(false);

src/Packages/Audience/Tests/Runtime/Transport/HttpTransportTests.cs

@@ -396,6 +396,33 @@ public async Task SendBatchAsync_HttpClientTimeout_TreatedAsNetworkError()
             Assert.AreEqual(AudienceErrorCode.NetworkError, reportedError.Code);
         }
 
+        [Test]
+        public void SendBatchAsync_CallerCancelled_Throws_DoesNotDeleteOrRecordFailure()
+        {
+            // Regression guard for PR #701 review: caller cancellation must
+            // propagate. If the `when (ct.IsCancellationRequested)` branch
+            // swallowed the exception, SendBatchAsync would return `true`
+            // with the batch still on disk, and a FlushAsync loop watching
+            // that return value would re-enter on the same cancelled token
+            // forever — nothing ever drains, nothing ever throws.
+            _store.Write("{\"type\":\"track\"}");
+
+            var handler = new MockHandler(() => throw new OperationCanceledException("simulated"));
+            AudienceError reportedError = null;
+            using var transport = new HttpTransport(_store, "pk_imapik-test-key1",
+                onError: e => reportedError = e, handler: handler);
+
+            using var cts = new CancellationTokenSource();
+            cts.Cancel();
+
+            Assert.ThrowsAsync<OperationCanceledException>(
+                async () => await transport.SendBatchAsync(cts.Token));
+
+            Assert.AreEqual(1, _store.Count(), "cancelled send must not delete the batch");
+            Assert.IsFalse(transport.IsInBackoffWindow, "cancel is not a failure — no backoff engaged");
+            Assert.IsNull(reportedError, "cancel is caller-initiated — no onError fires");
+        }
+
         [Test]
         public async Task IsInBackoffWindow_ClearsAfterNextAttemptAtElapses()
         {