[ravi-pplx]

Summary

Make close() stop admission without cancelling admitted work. Add cancel() and a deadline-aware drain returning IncompleteExecutionDrain until owned work settles. Track physical I/O, worker startup/retirement, stream cleanup and watch teardown.

Interrupted read/list streams now end with Unavailable after buffered results, even with a full output queue. Worker watches retire with recoverable Unavailable at close or cancellation; Direct watches retire quietly during drain or cancellation. Producer panics terminate read/list/relay streams with Internal after buffered output. The daemon keeps cancelling before drain; wire schemas are unchanged.

Stacked on #790; implements lifecycle ownership from the embedding RFC. Admission metrics are in #833.

Validation

137 filesystem/admission tests passed on the updated stack, including regressions for producer panics and recoverable watch closure. Formatting, affected all-feature/no-default-feature Clippy and doctests passed on Linux. Native macOS and Kind/Firecracker were not rerun locally; CI is pending on this head.

Severity and risk

Moderate: interrupted output must not appear complete, and drain must retain outstanding cleanup. Embedders must consume or drop admitted futures/streams and keep the runtime alive after incomplete drain. Revert after dependent changes to roll back.

AI assistance: Codex contributed code, tests and this description.

[cla-assistant]

All committers have signed the CLA.

[zibi-pplx]

Follow-up review at 02131d12da24, including downstream consumers and the complete stack through #833.

Two issues are worth resolving before merge:

1. [P2] Quiet worker-watch retirement changes downstream recovery. StreamEnd::Watch(self.lifecycle.closed()) ends an admitted worker watch with successful EOF on close/cancellation. The host relay preserves EOF. Both the native SSE consumer and WebSocket consumer treat that as terminal Closed { BackendClosed }; Unavailable enters route refresh/reconnect. This changes active daemon behavior during shutdown, despite the README saying active requests are unchanged. Please preserve the recoverable daemon status, or explicitly redesign and test the downstream shutdown contract. Updating the README alone would leave the behavior change. The new test asserting quiet EOF only proves the local implementation, not that its downstream meaning is correct.

2. [P2] A producer panic can turn partial output into successful EOF. The error tails in filesystem/read.rs, filesystem/list.rs, and the new worker relay use once(failure_rx).filter_map(|failure| ... failure.ok().map(Err)). A producer panic drops the sender; the receive error is discarded, so buffered output is followed by clean EOF. A disposable fault-injection test against stream_file reproduced this after consuming a chunk. Ordinary cancellation still returned Unavailable. Please send an explicit completion value on every normal exit (for example, Result<(), Status>) and map an unexpectedly dropped sender to Internal. A small shared terminal-channel helper could keep the three paths consistent. Read/list already had this failure mode; the detached worker relay adds another instance. I did not identify ordinary external input that currently triggers the panic.

Documentation follow-ups:

• Carry over the cancellation-grace correction posted on spaced: close operation admission consistently #790: service cancellation reaches worker kill tokens immediately; the grace applies to request cancellation, not universally to cancel() or drain expiry.
• The stream_file comment still promises immediate release when ended completes, but it now awaits file.into_std() to settle physical I/O. Update that latency/ownership statement.
• The shutdown recipe should mention closing stdin before admission closes: close_stdin and send_signal are refused after close, just like send_input. This is an explanation of the existing policy, not a request to reopen control admission.

Validation: the previous macOS unused-import finding is fixed and targeted macOS Clippy now passes. The temporary panic probe failed as described; the cancellation probe passed. Probes were removed. The latest stack-head CI run has passed all four Kind/Firecracker shards and its aggregate gate. The earlier rapid aggregate failure belonged to a cancelled run, not a non-main-base rejection.

Codex-assisted follow-up review. No implementation changes are included in this comment.