Asynchronous Flows

Assert on a settled invariant, a property that stays true once the flow has finished, such as a terminal status or a final total. Do not assert on a counter or an intermediate status that is true for only a moment.

Publish the identical order message twice — same identity, same body — wait for evidence that the second delivery was consumed, then assert a single visible effect: one row appended, one balance movement, one outbound notification.

Order is promised only inside a scope — usually a routing value such as an account or order identifier, or a single producing path. Read the design to find that scope, then confine the assertion to events sharing it.

Publish the bad message through the same path a real producer uses, give it a payload that fails at exactly one nameable stage, and tag it with a unique identifier so the case can find it wherever it lands.

Assert on the read model the user actually queries — the projected value on the read path — not the acknowledgement the write returned. An accepted write proves only that the request was taken, never that the user-visible view changed.

Open first, then act. A push connection delivers only what is emitted after it is established, so a case that triggers first can miss the update it exists to check and then passes or fails on timing alone.

Leaked connections accumulate until the run exhausts its limits, and their receivers keep collecting, so a later case can match an update an earlier one caused. Close in a cleanup step the harness runs even when the case fails.

An ordered assertion is illegitimate whenever the design promises only that both effects happen, not the order they arrive in. Replace it with an unordered check: assert the set of effects, and assert sequence only where the contract states one.

Parking leaves evidence that endless redelivery cannot fake: a record in the parking destination carrying this run's correlation identifier, a processing-attempt count that stops growing between two readings, and a later good message that gets processed.

Generate a value unique to that run, send it with the triggering request, and let the flow carry it. Then poll for the step records written under that value and assert the expected set of hops appeared.

Mint a value the case controls before triggering - a generated reference on the record it creates - and require that value to come back in the callback body or in the destination path. Select by that value, never by recency.

Prefer routing over sharing: register a destination per case, usually one receiver with a per-case path segment, through the product's own configuration surface. Where the address truly is global, make every read filtered and non-destructive so no case drains another's evidence.

Assert on an effect that accumulates — appended ledger rows, a balance, a revision counter, outbound notifications sent — because a second application moves it. Status flags and repeated overwrites absorb the second application and pass whatever the consumer does.

Produce the awkward sequence deliberately instead of waiting for it: deliver the dependent event before its cause under one routing key, assert the settled outcome rather than the arrival log, and confirm the case goes red when the handling is removed.

Assert three facts: redelivery stopped at the declared attempt ceiling, the parked record carries a reason, an attempt count and the correlation identifier, and the park moved an operator-visible signal. An unannounced park is contained failure, not success.

Assert the value together with the freshness marker the view publishes — the figure is inside its tolerance and the as-of stamp is no older than the allowance. Exact instantaneous equality invents a stricter contract than the design offers.

Collect, then assert over the collection. Attach a receiver at subscription time that appends every delivery to a buffer the case owns, then assert that the buffer eventually holds one matching a correlation identifier the case injected.

A final-record assertion sees only the last write, so a step whose effect never reaches that record can vanish. Assert instead on the marker each step writes after its own work, and fail when the expected set is incomplete.

A signature covers the byte sequence that was sent. Parsing the body and encoding it again changes whitespace, key order or number formatting, so the recomputed value no longer matches and the check fails on a perfectly genuine callback.

Green proves only that the behaviour held once. Check the contract, the interface's stated promises and the state machine, and ask whether anything forbids the opposite. If nothing does, the behaviour is incidental and the case should not assert on it.

Hold identical copies behind one release point so consumer instances process them in parallel. Concurrency exposes the gap between deciding a copy is new and recording its effect, which a sequential replay never opens.

Assert the invariant every permitted sequence must satisfy — no confirmation stored without its matching charge, and the same settled balance either way — rather than an arrival sequence nothing in the design preserves.

Check what the earlier failed attempts left behind, and whether the resubmitted message is now stale: partial work must not double the totals, newer state must not be overwritten, and the parked copy must not stay replayable.

Evidence that the flow already moved past the record: a progress position the projection has consumed to beyond that write, a terminal failure recorded against the record, or an abandoned delivery parked in a dead-letter destination. Elapsed time alone proves nothing.

Only assertions that survive missing evidence. A gap leaves the case holding an incomplete record, so existence checks on items received after the reopen can stand, while counts, ordering and any claim that nothing was sent are void.

Only that the recorded hops were reached. Anything unrecorded is unknown, not proven absent and not proven correct. Scope the claim to the covered segment, verify uncovered steps by their effects, and say plainly which parts stay unverified.