Neil, about this comment:

#   - ct is not yet trash (it actually is but the GC doesn't know because of
#     the missing tp_traverse method).

I believe gc should know ct is trash.  ct is in the cf list, and the latter does have tp_traverse.

What gc won't know is that `a` is trash, because `a` is attached to ct, and ct doesn't have tp_traverse.

It should blow up anyway :-)

Maybe with a simpler structure it would be easier to rearrange code to nudge the callback into getting cleared before use?

Z <- Y <- A <-> B -> WZ -> C

where WZ is a weakref to Z with callback C, and Y doesn't implement tp_traverse.  The only cycle is between A and B, which could just as well be the same object.  All the other stuff hangs off that cycle.

It's all trash, but we won't know in advance that Z is part of it.