fix(daemon): keep a discarded rejection from shutting the daemon down

[thymikee]

Summary

Closes #2519.

acquireSimulatorProcess abandoned an aborted acquisition with void started.then(rollback).
localTransport.start awaits two dynamic imports and then rejects with the abort reason, so every
aborted record start delivered that rejection to the daemon's only unhandledRejection handler
(src/daemon/server/daemon-runtime.ts:644), which exits 1 and kills every open session. Both abandon
sites now end the rollback chain in a handler, which also covers a rollback that itself fails.

Swept all 24 void … .then( sites rather than adding the proposed regex guard. Three rows changed
shape:

• Site 2 refuted. The losing delay branch is a Promise.race member, and Promise.race
  attaches a rejection handler to every member, so the post-settlement abort rejection is already
  handled. Verified in Node and by a test that passes at origin/main. No no-op handler added.
• Site 3 unreachable, and the proposed shape was unsafe. work is renew(...), which cannot
  reject: every path ends in a return or stop(). Resolving a rejection as "renewal settled" would
  make run re-arm pending = renew(...) with no backoff, so a broken renew becomes a renewal
  spin instead of a daemon exit. A rejection now routes through the closure's own stop as
  teardown-required/authority-unconfirmed, which is what renew's catch already reports. No
  failing test exists because no reachable rejection does.
• Site 4 is a resolve-only deferred. Deleted the discarded continuation at its construction path —
  settled now removes itself from pending — instead of adding a dead handler.

Adds packages/provider-limrun/src/request-cancellation.test.ts, which pins the drain's
abort-while-in-flight ownership contract that site 4 edits; those three tests pass before and after,
so they are contract coverage, not a regression test. 5 files.

Two review findings were rejected as unreachable rather than guarded: child.kill('SIGINT') inside
rollbackAcquiredSimulatorProcess cannot throw for a valid signal name (ChildProcess#kill returns
false for a dead child), so the SIGKILL escalation is not reachable through a thrown kill; and a
rejected start() cannot have spawned anything, because the local transport spawns synchronously
after its last throwIfAborted.

Validation

Tested at 1326c85c71. pnpm check:affected --run passed (14 checks: format, lint, typecheck,
layering, fallow; 1,684 unit tests). Both new abort tests fail at
origin/main, capturing cancel simulator transport start as an unhandledRejection, and pass at
HEAD; the grace-race assertions pass both ways, which is the site-2 refutation. The unhandled-
rejection observer now flushes with two setImmediate hops instead of a 10 ms timer, so it is immune
to fake timers. The transport is injected and no device-facing path changed, so no live run applies.
Coverage and provider integration stay CI-owned.

[github-actions]

Size Report

Metric	Base	Current	Diff
Installed (including dependencies)	4.50 MB	4.50 MB	+32 B
Package (unpacked)	4.50 MB	4.50 MB	+32 B
Package (download)	1.32 MB	1.32 MB	-1 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	27.5 ms	28.6 ms	+1.0 ms
CLI --help	75.4 ms	77.3 ms	+1.9 ms

[thymikee]

No actionable findings on 1326c85. The renewal rejection path stops admission before finishing the wait, preserving normalized failure handling without a retry loop. The focused race regressions cover the changed behavior. Current checks pass and there are no conflicts. Ready for human review and merge.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-09-13 05:56 UTC