Harden native runtime shutdown evidence

Author: eldryoth

CHANGELOG.md

@@ -28,6 +28,11 @@ behavior when the change improves security or project direction.
   bounds on decoded header-list bytes.
 - Keep HTTP/2 body, URI, trailer, response lifetime, flow-control, reset, and
   handler-timeout parity covered by the native server test suite.
+- Join aborted native stream and UDP listener tasks during shutdown so listener
+  sockets are released before the background task returns.
+- Make the native runtime cutover evidence script assert that the
+  representative config has zero blockers instead of relying on an empty
+  expected-blocker set.
 - Keep the Pingora dependency policy active and enforce all remaining Pingora
   crates against the next deletion target.
 

crates/fluxheim-runtime/src/lib.rs

@@ -277,6 +277,10 @@ impl NativeBackgroundSupervisor {
     /// The returned handle represents the watchdog task itself. Do not register
     /// that handle with another watchdog: its exit only means all watched tasks
     /// have exited, not that an independent service failed.
+    ///
+    /// Aborting or dropping the returned handle cancels only the collector that
+    /// joins per-critical-task watchers. The individual watcher tasks continue
+    /// running and still request supervisor shutdown if a critical task exits.
     pub fn spawn_critical_watchdog<I>(&self, handles: I) -> NativeBackgroundJoinHandle
     where
         I: IntoIterator<Item = NativeBackgroundJoinHandle>,

packaging/rpm/fluxheim.spec

@@ -157,6 +157,8 @@ fi
 * Sat Jun 20 2026 Fluxheim Maintainers <1921261+eldryoth@users.noreply.github.com> - 1.6.24-1
 - Promote native HTTP/2 downstream parity to cutover-ready after completing
   the safety-hook proof.
+- Join aborted native stream and UDP listener tasks during shutdown.
+- Assert zero representative native-runtime blockers in release evidence.
 - Keep remaining Pingora runtime dependency removal targeted at 1.6.25 for a
   focused final deletion release.
 - Update release metadata for 1.6.24.

release-notes/RELEASE_NOTES_1.6.24.md

@@ -22,6 +22,10 @@ targeted for a focused `1.6.25` deletion release.
 
 - Keep decoded HTTP/2 header-count enforcement before routing and document the
   paired decoded header-list byte bound from `h2` `max_header_list_size`.
+- Join aborted native stream and UDP listener tasks during shutdown, closing
+  the short file-descriptor release window after an operator-triggered stop.
+- Add an explicit zero-blocker assertion to the native runtime cutover evidence
+  script for the representative config.
 - Preserve native HTTP/2 tests for oversized URI rejection, oversized request
   bodies, decoded header count, request trailers, response trailers, prohibited
   HTTP/2 response headers, request flow-control release, response flow-control

scripts/validate-native-runtime-cutover.sh

@@ -164,5 +164,26 @@ awk -F '\t' '
 ' "$expected_blockers" "$out_dir/representative-runtime-cutover.tsv" \
     >"$out_dir/representative-runtime-cutover-expected-check.txt"
 
+awk -F '\t' '
+    /^native-runtime-adapter:/ { next }
+    /^config tester: ok$/ { next }
+    $1 == "blocker" { next }
+    NF == 0 { next }
+    NF != 3 {
+        print "native runtime cutover evidence: malformed report row: " $0 > "/dev/stderr"
+        exit 2
+    }
+    {
+        unexpected_blocker_count++
+    }
+    END {
+        if (unexpected_blocker_count > 0) {
+            print "native runtime cutover evidence: expected zero representative blockers but found " unexpected_blocker_count > "/dev/stderr"
+            exit 1
+        }
+    }
+' "$out_dir/representative-runtime-cutover.tsv" \
+    >"$out_dir/representative-runtime-cutover-zero-blockers-check.txt"
+
 echo "native runtime cutover evidence: wrote $out_dir"
 echo "native runtime cutover evidence: ok"

src/stream_proxy.rs

@@ -170,6 +170,7 @@ impl FluxBackgroundTask for StreamProxyTask {
         let _ = shutdown.wait_for_shutdown().await;
         for task in tasks {
             task.abort();
+            let _ = task.await;
         }
     }
 }

src/udp_proxy.rs

@@ -182,6 +182,7 @@ impl FluxBackgroundTask for UdpProxyTask {
         let _ = shutdown.wait_for_shutdown().await;
         for task in tasks {
             task.abort();
+            let _ = task.await;
         }
     }
 }