[forhappy]

Fix durability and CI failures inherited from #163 while preserving acknowledgement proofs, ownership and epoch checks, FULL-synchronous durability, correctness assertions and timeout budgets.

• Drain persisted Raft configuration notifications before membership revocation. Retire unclaimed snapshot offers only after authenticated fresh-seed authorization, retaining active transfers and physical reservations through cancellation.
• Retain one next snapshot event with its original admission while the preceding durably installed image finishes SQL publication. Exact ticket/image read fences remain enforced; pre-install overlap and a second deferred event still fail closed.
• Preserve completed worker reclamation during concurrent inspection of an empty worker mutex. Publish the monotonic proof only after worker destruction, retaining active-work, cell, facet and slot-reuse guards.
• Return typed cancellation when shutdown listener or drain-token task admission encounters a closed execution domain; retain owned joins and refuse graceful completion without proof.
• Make recovery fault tests interrupt the actual bulk transfer and verify the recovered incompressible SQL payload. Preserve signed closure, physical process joins and operation-specific retry rules. The Python recovery read validates the exact unknown-response envelope and never replays a mutation.
• Give durability fixtures one coherent FULL-sync namespace with independent node-key writers. Prebuild and drain build writes before live lease qualification; retain debug assertions, overflow checks and every original qualification command and aggregate gate. Restore RPC runner writeback policy afterward.

Validation on published head 300df5ceb64d70f796d811f7c565e1232bcb1954 is complete: all six original workflows succeeded; 33 checks passed, all four original Rust framework/SDK aggregate gates passed, and the same six optional contexts were skipped. All four native campaigns passed the strengthened retained-route regression, 970 library tests, all 292 fleet cases and 54 snapshot cases, retaining the existing ignores. All four ABI/SDK jobs, JavaScript qualification, both Python example workflows, all release application jobs and every Typed RPC job passed. All four RPC jobs restored the runner writeback policy successfully. No correctness assertion or timeout budget was relaxed.

Additional regression evidence:

• Pool reclamation qualification: the baseline fails both the native drain-proof assertion and the forced-contention retained-route test at its original 35-second retirement deadline. The identical published candidate passes both, the full 970-test library, 30 forced-contention route cases in 30.010–30.023 seconds, strict Clippy and repository checks. All original 2/35/45-second deadlines and epoch/cancellation/retired-route assertions remain intact.
• Snapshot publication overlap reproduced in three fresh baseline cases. The candidate passes 200 fresh balance cases and six snapshot/crash suites totaling 324 tests; added ownership tests preserve event charges and reject invalid overlap phases. Separate balance and strict-lint campaign.
• Closed-domain shutdown admission reproduces the original panic; the new boundary tests, full library, 109 native-node tests and 200 fresh management-stop receipt cases pass.
• Both full RPC ABI matrices, five unchanged saturation campaigns per ABI, ten alternating complete Axum package runs, all-features tests and strict relevant Clippy pass.

Measured Linux qualification gains: dense proof p95 408 → 103 ms and median first post-recovery write 369 → 120 ms; unchanged 144-case saturation campaign median 28.08 → 16.04 seconds with regular Python and 28.40 → 22.76 seconds free-threaded; sampled Axum lease-write commit p95 7.25 → 3.91 ms. These are qualification workload measurements, not production TPS.

Limits: the earlier Node delivery timeout at the original 250 ms budget did not recur in 2,000 original-Cargo diagnostic cases and 67 traced cases, a separate complete 200-case syscall campaign, or the 100-case original package qualification on the current head. No Node root-cause fix is claimed. Direct artifact execution shortened campaign launch time but worsened Worker-side restart POST p95/p99, so that experiment was discarded. Two earlier isolated fleet refusals also remain unexplained after the full fleet suite and 100 fresh targeted cases each. Focused failure context remains; assertions, refusal handling and deadlines were not relaxed.

Private combined diagnostic jobs were intentionally stopped before their unchanged 60-minute ceilings after preserving completed scopes; their cancelled workflows are not reported as whole-run successes. Production capacity, failover qualification and global Cloudflare latency remain separate work.