[futurepaul]

Fixes a leak #743 brought in.

What leaked: each connection a client closed while the user runtime kept its end open: a pass thread and two sockets, held for good, in the node process. workerd keeps a WebSocket connection open after its client closes, whether the client half-closes or sends a Close frame (checked straight against workerd; it closes at once after a plain answer, and after a stream's end). #743's front door relayed the client's close as a half-close of the runtime's connection, then waited on the runtime, which never closed. So every WebSocket a page closed leaked: the shell's own /api/fragments/watch on each page close or reload, and the chats' sockets.

How fast: in a repro of page reloads through the front door, each load closing two WebSockets (4 Chromes, about 12 loads a second), the node process held 28,207 threads and 56,413 fds after about ten minutes, and workerd 58,484 fds. From then on, connections were reset: module loads failed net::ERR_CONNECTION_RESET, so pages never started. An e2e shard leaks far fewer (one or two per page load), but every xtask dev session and e2e run has accumulated them since #743.

Fix: when the client's end is done (closed, or failed), the front door closes the runtime's connection whole (Shutdown::Both), as a proxy does once its client goes. The pass then ends and lets both sockets go. The trade-off, stated beside it: a client that half-closes and waits for its answer gets none. No client here does (no Shutdown::Write anywhere in our code outside front.rs).

Test: a_client_that_goes_ends_its_pass_though_the_runtime_stays. A runtime answers a 101, then keeps the connection open and silent after the client goes (as workerd does). The client takes the 101 and closes. The pass must end; its wait is bounded only so a failure reports instead of hanging.

• Without the fix: fails (the pass never ends; the 10 s bound reports it).
• With it: passes.

Also run: devstack's lib tests and clippy with -D warnings, and --test debug_terminal (a real node, started and reloaded through the front door).

🤖 Generated with Claude Code

[alexlwn123]

Pass at a233fcd64fb4d0eee0cf3eb690b60c8f0baa4a0c.

The full runtime shutdown after client EOF or failure wakes the downstream copy and lets the pass finish even when workerd keeps its WebSocket open. The change is appropriately small, and the half-close tradeoff is explicit; I found no repository caller relying on that behavior and no blocking regression.

Validation: cargo test -p fragment-devstack --lib passed all 29 tests, including the new disconnect regression. GitHub check and all four e2e shards are still pending; full e2e was not run locally. The referenced external engineering-style file is unavailable on this machine.