fix(runs): contain state Worker background tasks

[coreplane-switchboard]

Keeps best-effort state Worker pushes inside the Durable Object request lifetime and fails the originating test when registered work remains pending. This prevents detached I/O from delaying an unrelated memory Worker test.

Why: #2119 kept failing a different fast Durable Object case after #2146 closed the alarm leak; #2156 exposed the remainder. A detached effect push could outlive its case and contend in the shared workerd isolate.

Where to look

1. Runtime-owned background task seam Registers deliberately detached work with waitUntil and records a label until the promise settles. ⚠ A task omitted from this seam remains invisible to the test-end guard.
2. Plane effect push ownership Routes the remaining fire-and-forget Worker I/O through the owned task seam while preserving best-effort delivery. ⚠ Incorrect handling could turn a failed push into an unhandled rejection.
3. Leaked push reproduction Blocks the bot double, proves the pending label is visible, then explicitly releases and settles the push.
4. Guard fixture Proves an intentionally pending promise trips the guard and a settled promise clears it.
5. Memory Worker pool contract Binds runtime ownership and the per-test pending-work refusal into the Worker verification spec.

Feedback wanted: Check that waitUntil is the right ownership boundary for best-effort effect pushes and that the global label map cannot hide a production rejection.

Risk: Blast radius is state Worker plane-effect delivery and its test pool. A bad guard may fail tests that legitimately retain work; revert f2da680 to restore the prior behavior.

Verified: 62 focused tests, scoped ESLint, Worker tsc, formatting, hygiene, specs and coverage passed. Full verify and ten-run Depot stress remain CI-gated.

Decisions (3)

• Own the push without delaying its caller. Awaiting bot delivery in the RPC path would couple durable state transitions to a best-effort transport. DurableObjectState.waitUntil preserves the response boundary while giving workerd ownership of the promise.
• Fix the detached task, not the timeout. The reported victim remained fast locally while the intentionally bounded shrink case consumed seconds. The varying victim and sole unowned promise pointed to cross-test I/O, not a slow victim.
• Keep the shared serial pool. Per-file pool isolation would mask the detached push and increase setup cost. The existing serial pool is deterministic once deliberately detached tasks are runtime-owned and guarded.

Validation (9 criteria)

Criterion	Proof
Pending-task fixture and plane push behavior pass	npm test --workspace deploy/cloudflare-memory -- backgroundTasks.test.ts runLedger.test.ts → 62/62 passed.
Review lint failure is fixed	npx eslint on the six changed TypeScript files → exit 0.
Memory Worker types are valid	NODE_OPTIONS=--max-old-space-size=6144 npx tsc --noEmit -p deploy/cloudflare-memory/tsconfig.json → exit 0.
Changed files are formatted	npx prettier --check on all seven changed files → all matched.
Public hygiene ratchet stays clean	npm run hygiene:check → exit 0; 9 files and 37 listed hits remain.
Spec proofs resolve	npm run specs:check → exit 0; 51 specs and 5,634 references checked.
Changed paths retain specification coverage	npm run specs:coverage -- --changed origin/main...HEAD --test-guard → all paths covered; test guard passed.
PR title is accepted	npm run check:pr-title -- "fix(runs): contain state Worker background tasks" → exit 0.
Initial root-level test filters were invalid	Two root npx vitest attempts exited 1 after selecting zero files; the workspace-scoped command above used Vitest 4.1.11 and passed.

For agents

Rebased onto origin/main at 1073acc immediately before validation and force-pushed as one commit at f2da680. The two alarm unavailable lines are expected output from explicit rejection fixtures and remained handled. Full memory Worker verify and ten consecutive CI-pool runs remain CI-gated. No generated files changed.
Requested by @justinhelmer in slack:C0BRRHKFLCB

🤖 Generated with Claude Code

[coreplane-switchboard]

LGTM: The pending-work seam correctly keeps plane pushes within the Durable Object lifetime and makes cross-test leakage fail at its source.

Note

Approved · head 514cdf3 · no findings

Full review

No findings. The pending-task guard and waitUntil integration address the cross-test leak without changing plane delivery semantics.

[github-actions]

Auto-approved: coreplane-switchboard[bot] reviewed this PR and posted an LGTM verdict (see its review). This repository opted in through its REVIEW_BOT_LOGIN and REVIEW_BOT_ID variables.

[coreplane-switchboard]

LGTM: The round-two lint fix is correct, and both prior failed-check findings are resolved.

Note

Approved · head f2da680 · no findings

Full review

The round-two fix resolves the lint failure without changing promise settlement behavior. No findings remain.

[github-actions]

Auto-approved: coreplane-switchboard[bot] reviewed this PR and posted an LGTM verdict (see its review). This repository opted in through its REVIEW_BOT_LOGIN and REVIEW_BOT_ID variables.