Context — Practice Tasks¶

package items

import (
    "context"
    "time"
)

func ProcessItems(ctx context.Context, items []string) ([]string, error) {
    out := make([]string, 0, len(items))
    for _, it := range items {
        // Senior decision: cancellation check BEFORE the work. If we checked
        // after, a cancel arriving during the sleep would still cost a full
        // 50 ms of work that nobody is waiting for. The whole point of
        // context is to release wasted compute the moment the caller leaves.
        select {
        case <-ctx.Done():
            return nil, ctx.Err()
        default:
        }
        // Senior decision: the work itself is cancellable. A bare time.Sleep
        // would block the goroutine even if the parent has long since gone
        // home. Real I/O — net.Conn, sql.DB, exec.Cmd — already accepts a
        // ctx, but pure CPU work needs this manual cooperation.
        select {
        case <-ctx.Done():
            return nil, ctx.Err()
        case <-time.After(50 * time.Millisecond):
        }
        out = append(out, "processed:"+it)
    }
    return out, nil
}

package fetch

import (
    "context"
    "fmt"
    "io"
    "net/http"
    "time"
)

func FetchWithTimeout(url string, timeout time.Duration) ([]byte, error) {
    // Senior decision: WithTimeout, not a manual timer. The standard lib
    // already wires ctx.Done() into http.Transport. Rolling our own with
    // time.AfterFunc + resp.Body.Close means we duplicate logic that the
    // transport does better and we lose the ability to compose with a
    // caller-supplied parent context later.
    ctx, cancel := context.WithTimeout(context.Background(), timeout)
    defer cancel() // run even on success — releases the timer goroutine

    req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
    if err != nil {
        return nil, fmt.Errorf("build request: %w", err)
    }
    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        // Senior decision: when the transport aborts due to ctx, err is a
        // *url.Error whose Unwrap chain ends at context.DeadlineExceeded.
        // We rewrap with %w so callers see the same. Don't translate to a
        // custom error here — that erases the signal that callers need to
        // decide retry vs give-up.
        return nil, fmt.Errorf("GET %s: %w", url, err)
    }
    defer resp.Body.Close()

    return io.ReadAll(resp.Body)
}

package reqid

import "context"

// Senior decision: unexported zero-sized struct. Exported types in other
// packages cannot construct it, so the value namespace is private to this
// package. An int constant would also work but a struct{} can't be confused
// with an unrelated int key in a log line.
type ctxKey struct{}

var requestIDKey = ctxKey{}

func WithRequestID(ctx context.Context, id string) context.Context {
    // Senior decision: no validation here. WithValue is a propagation
    // primitive, not a sanitiser. The HTTP middleware that calls us is the
    // boundary; if it lets an empty string in, the bug is in the middleware.
    return context.WithValue(ctx, requestIDKey, id)
}

func RequestID(ctx context.Context) string {
    v, _ := ctx.Value(requestIDKey).(string)
    return v // empty string if absent — caller decides what to do
}

package notes

// From $GOROOT/src/context/context.go (approximate):
//
//   type Context interface {
//       Deadline() (deadline time.Time, ok bool)
//       Done() <-chan struct{}
//       Err() error
//       Value(key any) any
//   }
//
// 1. Deadline()
//    - alive:     returns (zero Time, false) if no deadline set
//                 or (deadline, true) if WithDeadline/WithTimeout was used.
//    - cancelled: same return — the deadline doesn't change on cancel.
//                 Caller checks Err() to see "did we actually trip it".
//
// 2. Done()
//    - alive:     returns a chan that is NOT closed.
//                 Background() / TODO() may return nil — selecting on nil
//                 blocks forever, which is what you want (no cancellation).
//    - cancelled: returns the SAME chan, now closed. Closed chans always
//                 select-receive a zero value immediately.
//
// 3. Err()
//    - alive:     returns nil.
//    - cancelled: returns context.Canceled or context.DeadlineExceeded.
//                 Never returns nil after Done() is closed.
//
// 4. Value()
//    - returns any value or nil if the key is not bound anywhere in the
//      parent chain. nil is a valid "absent" signal; callers must do a
//      typed assert with the comma-ok form to distinguish absent from
//      "present but nil".
//
// All four are documented as safe for concurrent use. The four-method
// surface is intentionally minimal — that's why building a "context-aware
// X" usually means wrapping, not subclassing.
//
// Bonus: Done() and Err() are O(1) and allocation-free in steady state.
// Value() walks parents on every call; cache the lookup if you do it in
// a tight loop.

package mygroup

import (
    "context"
    "sync"
)

type Group struct {
    cancel context.CancelFunc
    wg     sync.WaitGroup
    once   sync.Once
    err    error
}

func New(ctx context.Context) (*Group, context.Context) {
    // Senior decision: WithCancel, not WithCancelCause. Adding cause-aware
    // behaviour is a deliberate extension (see Task 6) — start with the
    // minimal surface. The returned ctx is the one callers must propagate
    // into their funcs; that's why we return (group, ctx) as a pair.
    ctx, cancel := context.WithCancel(ctx)
    return &Group{cancel: cancel}, ctx
}

func (g *Group) Go(fn func() error) {
    g.wg.Add(1)
    go func() {
        defer g.wg.Done()
        if err := fn(); err != nil {
            // Senior decision: sync.Once for first-error capture. An atomic
            // CAS on a pointer would also work, but Once communicates intent
            // better — "exactly one of the racing goroutines wins". The
            // cancel inside Do triggers sibling shutdown the moment we lose.
            g.once.Do(func() {
                g.err = err
                g.cancel()
            })
        }
    }()
}

func (g *Group) Wait() error {
    g.wg.Wait()
    // Senior decision: cancel on success path too. If no fn errored, the
    // group's derived context is still live — callers might still be reading
    // ctx.Done() from a leaked sibling. cancel() makes the group's lifecycle
    // crisp: after Wait returns, the derived ctx is guaranteed done.
    g.cancel()
    return g.err
}

package worker

import (
    "context"
    "errors"
    "fmt"
    "log"
    "time"
)

var (
    ErrUserQuit   = errors.New("user pressed quit")
    ErrParentGone = errors.New("parent context cancelled")
)

func Run(parent context.Context, quit <-chan struct{}) error {
    // Senior decision: WithCancelCause + WithDeadlineCause (1.21+) so every
    // possible exit path carries an explanation. Without cause, the log
    // would say "context canceled" and the on-call engineer would have to
    // guess between "user quit", "timeout", or "outer cancel". The cost is
    // one extra import and three named errors — cheap.
    ctx, cancel := context.WithCancelCause(parent)
    defer cancel(nil) // nil cause = no-op if already cancelled

    deadline := time.Now().Add(500 * time.Millisecond)
    ctx, cancelDL := context.WithDeadlineCause(ctx, deadline, context.DeadlineExceeded)
    defer cancelDL()

    // Watcher goroutine fans the external signals into our cancel-cause.
    done := make(chan struct{})
    defer close(done)
    go func() {
        select {
        case <-quit:
            cancel(ErrUserQuit)
        case <-parent.Done():
            // Senior decision: distinguish "parent died" from "we cancelled
            // ourselves". context.Cause(parent) carries the upstream reason
            // if any; chain it so the cause we attach explains both layers.
            cancel(fmt.Errorf("%w: %w", ErrParentGone, context.Cause(parent)))
        case <-done:
        }
    }()

    // Simulated work loop.
    for i := 0; i < 100; i++ {
        select {
        case <-ctx.Done():
            cause := context.Cause(ctx)
            log.Printf("worker stopped: ctx.Err=%v cause=%v", ctx.Err(), cause)
            return cause
        case <-time.After(10 * time.Millisecond):
        }
    }
    return nil
}

package fireandforget

import (
    "context"
    "log"
    "time"
)

func LogAfterRequest(reqCtx context.Context, payload string) {
    // Senior decision: WithoutCancel keeps values (request_id, trace_id,
    // tenant) so the audit log still correlates with the request, but the
    // Done channel of reqCtx no longer cancels us. Then we put our own
    // ceiling on it — a stuck audit sink should never leak goroutines.
    detached := context.WithoutCancel(reqCtx)
    ctx, cancel := context.WithTimeout(detached, 5*time.Second)

    go func() {
        defer cancel()
        if err := sendToSink(ctx, payload); err != nil {
            log.Printf("audit log dropped: %v", err)
        }
    }()
}

func sendToSink(ctx context.Context, payload string) error {
    select {
    case <-ctx.Done():
        return ctx.Err()
    case <-time.After(200 * time.Millisecond):
        log.Printf("audit shipped: %s", payload)
        return nil
    }
}

package tempdir

import (
    "context"
    "fmt"
    "log"
    "os"
)

func OpenTempDir(ctx context.Context) (string, func() bool, error) {
    dir, err := os.MkdirTemp("", "demo-*")
    if err != nil {
        return "", nil, fmt.Errorf("mkdir temp: %w", err)
    }

    // Senior decision: AfterFunc is the right tool when cleanup is purely
    // a function of ctx-done, not of the work itself. We could spawn a
    // goroutine that does `<-ctx.Done(); os.RemoveAll(dir)` — that's what
    // AfterFunc does internally — but the API documents the intent better
    // and lets callers stop the cleanup with a single call (the returned
    // stop func) if the dir is being deliberately kept past ctx lifetime.
    stop := context.AfterFunc(ctx, func() {
        if err := os.RemoveAll(dir); err != nil {
            log.Printf("temp cleanup failed for %s: %v", dir, err)
        }
    })

    return dir, stop, nil
}

package leakdemo

import (
    "bytes"
    "context"
    "fmt"
    "runtime/pprof"
    "strings"
    "time"
)

// Leaky version — preserved as the bug for the test.
func StartWorkerLeaky(parent context.Context) {
    // Senior decision: this is the canonical bug. Discarding cancel means
    // the goroutine's ctx never reaches Done unless parent does. If parent
    // is context.Background() (as in many CLIs), the goroutine pins memory
    // and a timer entry forever. go vet's lostcancel check exists for this.
    ctx, _ := context.WithCancel(parent)
    go func() {
        select {
        case <-ctx.Done():
        case <-time.After(time.Hour):
        }
    }()
}

// Fixed version — returns the cancel so the caller can release.
func StartWorker(parent context.Context) context.CancelFunc {
    ctx, cancel := context.WithCancel(parent)
    go func() {
        select {
        case <-ctx.Done():
        case <-time.After(time.Hour):
        }
    }()
    return cancel
}

// CountGoroutines returns how many goroutines reference the given symbol.
func CountGoroutines(symbol string) (int, error) {
    var buf bytes.Buffer
    if err := pprof.Lookup("goroutine").WriteTo(&buf, 1); err != nil {
        return 0, fmt.Errorf("pprof: %w", err)
    }
    return strings.Count(buf.String(), symbol), nil
}

package authmw

import (
    "context"
    "net/http"
    "strings"
)

type Claims struct {
    UserID string
    Scopes []string
}

type ctxKey struct{}

var claimsKey = ctxKey{}

func AuthMiddleware(verify func(token string) (Claims, error)) func(http.Handler) http.Handler {
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            // Senior decision: parse + validate before allocating anything.
            // A flood of unauthenticated requests should hit the cheapest
            // possible reject path.
            h := r.Header.Get("Authorization")
            if h == "" {
                http.Error(w, "missing Authorization", http.StatusUnauthorized)
                return
            }
            token, ok := strings.CutPrefix(h, "Bearer ")
            if !ok || token == "" {
                http.Error(w, "expected Bearer token", http.StatusUnauthorized)
                return
            }
            claims, err := verify(token)
            if err != nil {
                http.Error(w, "invalid token", http.StatusUnauthorized)
                return
            }
            // Senior decision: derive a new ctx; don't mutate r.Context().
            // r.WithContext returns a shallow-cloned *Request — the original
            // r is still referenced by the caller; mutating it would be a
            // data race in any reverse-proxy scenario.
            ctx := context.WithValue(r.Context(), claimsKey, claims)
            next.ServeHTTP(w, r.WithContext(ctx))
        })
    }
}

func Current(ctx context.Context) (Claims, bool) {
    c, ok := ctx.Value(claimsKey).(Claims)
    return c, ok
}

package structured

import (
    "context"
    "sync"
)

func Run(ctx context.Context, fns ...func(context.Context) error) error {
    // Senior decision: check entry state explicitly. WithCancel on an
    // already-done parent would still launch the goroutines — they'd see
    // ctx.Done() immediately and return ctx.Err(), but we still paid the
    // goroutine launch cost. A pre-check elides the cost entirely.
    if err := ctx.Err(); err != nil {
        return err
    }
    if len(fns) == 0 {
        return nil
    }

    ctx, cancel := context.WithCancel(ctx)
    defer cancel()

    var (
        wg   sync.WaitGroup
        once sync.Once
        err  error
    )
    wg.Add(len(fns))
    for _, fn := range fns {
        fn := fn
        go func() {
            defer wg.Done()
            if e := fn(ctx); e != nil {
                // Senior decision: capture FIRST error, cancel siblings.
                // We do NOT capture the LAST error — by that point all
                // siblings have observed cancellation and may return
                // ctx.Err() as a "secondary" failure that masks the real
                // cause. First-wins is the policy the standard library's
                // errgroup uses for the same reason.
                once.Do(func() {
                    err = e
                    cancel()
                })
            }
        }()
    }
    // Senior decision: the wg.Wait() before return is the entire structural
    // guarantee. After Run returns, no goroutine launched by Run is alive.
    // Callers can rely on this to reason about resource cleanup — the
    // alternative (background goroutines) is the bug class this whole
    // exercise exists to prevent.
    wg.Wait()
    return err
}

package notes

// propagateCancel in $GOROOT/src/context/context.go (Go 1.22 line numbers
// are approximate; the logic is stable across recent versions):
//
//   func propagateCancel(parent Context, child canceler) {
//       done := parent.Done()
//       if done == nil {
//           return // parent is never cancelled (e.g. Background)
//       }
//       select {
//       case <-done:
//           child.cancel(false, parent.Err(), Cause(parent))
//           return
//       default:
//       }
//       if p, ok := parentCancelCtx(parent); ok {
//           p.mu.Lock()
//           if p.err != nil {
//               child.cancel(false, p.err, p.cause)
//           } else {
//               if p.children == nil {
//                   p.children = make(map[canceler]struct{})
//               }
//               p.children[child] = struct{}{}
//           }
//           p.mu.Unlock()
//       } else {
//           goroutines.Add(1)
//           go func() {
//               select {
//               case <-parent.Done():
//                   child.cancel(false, parent.Err(), Cause(parent))
//               case <-child.Done():
//               }
//           }()
//       }
//   }
//
// Three cases:
//
// 1. parent.Done() == nil  -> no goroutine, no registration. Background
//    and TODO take this path. It's an O(1) early return; this is why
//    deriving children from Background is essentially free.
//
// 2. parent is *cancelCtx (or *timerCtx wrapping one) -> NO goroutine.
//    The child is added to parent.children, and parent's own cancel will
//    iterate that map and cancel each child synchronously. This is the
//    common case — almost every real context tree is built out of the
//    standard concrete types — so it's the case the stdlib optimised for.
//
// 3. parent is a custom Context implementation -> goroutine spawned. The
//    stdlib has no way to register into a foreign type, so the only option
//    is "watch parent.Done() on a goroutine". This is the slow path; it
//    costs ~2 KB of stack per child. The runtime counter goroutines.Add(1)
//    exists for testing — see TestCustomContextGoroutines.
//
// Server impact at 100k concurrent requests: if all parents are stdlib
// types, the cancellation tree costs O(1) goroutines (just the user
// goroutines, not the context tree). If even 10% of requests pass through
// a custom Context wrapper, you've added 10k extra goroutines and ~20 MB
// of stack. This is why "wrap with WithValue, don't reimplement Context"
// is the universal advice — keeping the type *cancelCtx-compatible at
// every layer is what lets the stdlib elide the goroutine.

package reqidmw

import (
    "context"
    "crypto/rand"
    "encoding/hex"
    "net/http"

    "google.golang.org/grpc"
    "google.golang.org/grpc/metadata"
)

type ctxKey struct{}

var reqIDKey = ctxKey{}

const headerName = "X-Request-ID"
const mdName = "x-request-id"

func newID() string {
    var b [8]byte
    _, _ = rand.Read(b[:])
    return hex.EncodeToString(b[:])
}

func FromContext(ctx context.Context) string {
    v, _ := ctx.Value(reqIDKey).(string)
    return v
}

func with(ctx context.Context, id string) context.Context {
    return context.WithValue(ctx, reqIDKey, id)
}

// HTTPMiddleware stamps inbound HTTP requests.
func HTTPMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        id := r.Header.Get(headerName)
        if id == "" {
            id = newID()
        }
        // Senior decision: echo the ID back to the client. Useful for
        // support — the user can quote the ID from the response header
        // when filing a bug. Also makes test assertions trivial.
        w.Header().Set(headerName, id)
        next.ServeHTTP(w, r.WithContext(with(r.Context(), id)))
    })
}

// UnaryServerInterceptor stamps inbound gRPC calls.
func UnaryServerInterceptor() grpc.UnaryServerInterceptor {
    return func(ctx context.Context, req any, _ *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
        var id string
        if md, ok := metadata.FromIncomingContext(ctx); ok {
            if v := md.Get(mdName); len(v) > 0 {
                id = v[0]
            }
        }
        if id == "" {
            id = newID()
        }
        return handler(with(ctx, id), req)
    }
}

// UnaryClientInterceptor propagates the ID on outbound gRPC calls.
func UnaryClientInterceptor() grpc.UnaryClientInterceptor {
    return func(ctx context.Context, method string, req, reply any, cc *grpc.ClientConn, invoker grpc.UnaryInvoker, opts ...grpc.CallOption) error {
        // Senior decision: if there's no ID in ctx, do NOT mint one here.
        // The edge mints; the middle propagates. Minting in the middle
        // would silently break the "same ID end-to-end" invariant when an
        // upstream service forgot to install the server interceptor.
        if id := FromContext(ctx); id != "" {
            ctx = metadata.AppendToOutgoingContext(ctx, mdName, id)
        }
        return invoker(ctx, method, req, reply, cc, opts...)
    }
}

package leakdiag

import (
    "context"
    "fmt"
    "net/http"
    _ "net/http/pprof"
    "runtime"
    "time"
)

func fetchOnce(url string) error {
    // Senior decision: defer cancel() even when the function looks like
    // "we always wait for the response anyway". WithTimeout schedules a
    // runtime timer; without cancel, the timer survives until its deadline
    // even though the response has already been read. At 10 RPS that's
    // 10 timer heap entries per second, all live until 1 s old — average
    // 10 outstanding. At 10k RPS that's 10k. Multiply by GC scan cost.
    ctx, cancel := context.WithTimeout(context.Background(), time.Second)
    defer cancel()

    req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
    if err != nil {
        return fmt.Errorf("build req: %w", err)
    }
    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        return err
    }
    defer resp.Body.Close()
    // ... consume body
    return nil
}

// SoakProbe samples goroutine count over time. Use in the test to assert
// "no growth after warmup".
func SoakProbe(d time.Duration, sampleEvery time.Duration) []int {
    samples := []int{}
    deadline := time.Now().Add(d)
    for time.Now().Before(deadline) {
        samples = append(samples, runtime.NumGoroutine())
        time.Sleep(sampleEvery)
    }
    return samples
}

package ctxmutex

import (
    "context"
    "errors"
    "sync"
)

type CtxMutex struct {
    once sync.Once
    ch   chan struct{}
}

func (m *CtxMutex) init() {
    m.once.Do(func() {
        // Senior decision: buffered chan of capacity 1 is the canonical
        // "binary semaphore". Send blocks if full (= lock held); receive
        // unblocks the next sender. Building on sync.Mutex would force us
        // to spawn a goroutine to do the wait — that goroutine can't be
        // cancelled cleanly, defeating the whole API.
        m.ch = make(chan struct{}, 1)
    })
}

var ErrNotHeld = errors.New("ctxmutex: Unlock of unheld mutex")

func (m *CtxMutex) Lock(ctx context.Context) error {
    m.init()
    // Senior decision: fast path. If the lock is free, take it without
    // entering the select. Saves an alloc per acquisition under low
    // contention. Real measurement: ~30 ns vs ~120 ns for the select path
    // on Go 1.22 / Apple M2.
    select {
    case m.ch <- struct{}{}:
        return nil
    default:
    }
    // Slow path: block on lock or cancel, whichever wins.
    select {
    case m.ch <- struct{}{}:
        // Senior decision: re-check ctx AFTER acquiring. If the lock was
        // free at exactly the moment ctx died, the runtime might have
        // picked the lock-acquired branch. Re-checking lets us honour
        // cancellation strictly — we release immediately and return err.
        if err := ctx.Err(); err != nil {
            <-m.ch // give it back
            return err
        }
        return nil
    case <-ctx.Done():
        return ctx.Err()
    }
}

func (m *CtxMutex) Unlock() {
    m.init()
    select {
    case <-m.ch:
    default:
        panic(ErrNotHeld)
    }
}

package walldeadline

import (
    "context"
    "fmt"
    "time"
)

func WithDeadlineAt(parent context.Context, t time.Time) (context.Context, context.CancelFunc) {
    // Senior decision: delegate to WithDeadline. The implementation already
    // (a) handles past times by cancelling immediately, (b) intersects with
    // parent deadlines (tighter wins), (c) registers a timer in the runtime
    // heap. Wrapping it adds zero value EXCEPT the named alternative API —
    // which makes call sites self-documenting. Compare:
    //
    //   WithTimeout(ctx, time.Until(endOfWindow))    // why? what window?
    //   WithDeadlineAt(ctx, endOfWindow)             // obvious
    //
    // That readability swap is the entire reason to define this helper.
    return context.WithDeadline(parent, t)
}

// DeadlineSafe is a convenience for schedulers: if the deadline is already
// in the past, return a sentinel error rather than spinning up a doomed ctx.
func DeadlineSafe(parent context.Context, t time.Time, minBudget time.Duration) (context.Context, context.CancelFunc, error) {
    remaining := time.Until(t)
    if remaining < minBudget {
        return nil, nil, fmt.Errorf("deadline-safe: only %v until %v, need at least %v", remaining, t, minBudget)
    }
    ctx, cancel := context.WithDeadline(parent, t)
    return ctx, cancel, nil
}

package mutablectx

import (
    "context"
    "sync"
    "sync/atomic"
)

type ctxKey struct{}

// UNSAFE — for the demo only.
type UnsafeCounter struct {
    Hits int
}

func WithUnsafeCounter(ctx context.Context, c *UnsafeCounter) context.Context {
    return context.WithValue(ctx, ctxKey{}, c)
}

func UnsafeFrom(ctx context.Context) *UnsafeCounter {
    c, _ := ctx.Value(ctxKey{}).(*UnsafeCounter)
    return c
}

// SAFE alternative A — immutable value. The counter is a snapshot at
// stamp time; downstream goroutines see the value they were handed and
// no later. Use when the ctx-carried datum is informational, not shared
// state (request_id, tenant, user_role, locale).
type Snapshot struct {
    RequestID string
    Tenant    string
}

func WithSnapshot(ctx context.Context, s Snapshot) context.Context {
    // Senior decision: store the value, not a pointer. Even if the caller
    // later mutates their local Snapshot, the ctx's copy is unaffected.
    // This is the property that makes context.Value's documentation say
    // "only request-scoped data" — the implicit assumption is that the
    // datum is immutable for the lifetime of the request.
    return context.WithValue(ctx, ctxKey{}, s)
}

// SAFE alternative B — sync-protected handle. The ctx propagates the
// pointer; concurrency is the handle's responsibility.
type SafeCounter struct {
    n atomic.Int64
}

func (c *SafeCounter) Inc()           { c.n.Add(1) }
func (c *SafeCounter) Load() int64    { return c.n.Load() }

func WithSafe(ctx context.Context, c *SafeCounter) context.Context {
    return context.WithValue(ctx, ctxKey{}, c)
}

// SAFE alternative B' — mutex-protected struct. Use when the field set
// is complex enough that atomic ops don't compose.
type GuardedSet struct {
    mu   sync.Mutex
    seen map[string]struct{}
}

func NewGuardedSet() *GuardedSet { return &GuardedSet{seen: map[string]struct{}{}} }

func (g *GuardedSet) Add(k string) {
    g.mu.Lock()
    defer g.mu.Unlock()
    g.seen[k] = struct{}{}
}

func (g *GuardedSet) Has(k string) bool {
    g.mu.Lock()
    defer g.mu.Unlock()
    _, ok := g.seen[k]
    return ok
}