Close executors that Shutdown invalidates while their Run retires (#482)

Shutdown marks every executor invalid but closes only owners without a
Run, leaving a running owner's close to its prepared release. The release
reads r.closed and owner.invalid once, before joining operations and
retiring the Run. When Shutdown took the lock after that reuse decision
and before the Run let go of the owner, nobody closed the executor: it
stayed in r.executors with no close in flight, and Shutdown reported
"cleanup unconfirmed" for a healthy native executor. Device shutdown
has the same window and left the owner permanently invalid.

When the release retires an owner that was invalidated without a close,
start the close under shutdownWG so Shutdown waits for it. Report an
executor that remains without a close error as "cleanup has not
settled" instead of wrapping a nil error.

Author: SaladDay

apps/daemon/internal/dispatch/prepared_handoff.go

@@ -262,6 +262,11 @@ func (r *Router) runPreparedRelease(state *sessionState, handoff *preparedHandof
 	}
 	if !owner.invalid {
 		r.scheduleExecutorIdleLocked(owner)
+	} else if owner.closeDone == nil {
+		// Shutdown invalidated this owner after the reuse decision above and
+		// left its close to this Run, which held it.
+		r.shutdownWG.Add(1)
+		go func() { defer r.shutdownWG.Done(); _ = r.closeExecutor(owner) }()
 	}
 	r.mu.Unlock()
 

apps/daemon/internal/dispatch/shutdown.go

@@ -90,7 +90,11 @@ func (r *Router) runShutdownAttempt(attempt *shutdownAttempt, victims []sessionC
 		}
 	}
 	for _, owner := range r.executors {
-		attempt.err = errors.Join(attempt.err, fmt.Errorf("dispatch: executor %s cleanup unconfirmed: %w", owner.id, owner.closeErr))
+		cause := owner.closeErr
+		if cause == nil {
+			cause = errors.New("cleanup has not settled")
+		}
+		attempt.err = errors.Join(attempt.err, fmt.Errorf("dispatch: executor %s: %w", owner.id, cause))
 	}
 	close(attempt.done)
 	r.mu.Unlock()