[ChrisKrawczyk]

Summary

Implement the Rust-core portion of the cross-SDK runtime lifecycle redesign. Shutdown completion now means the owned execution tree and registered foreign cleanup have actually retired, rather than merely that top-level tasks were cancelled.

• Add fallible preparation/startup and retained rollback ownership.
• Use one shutdown operation with immutable grace and total deadlines. Timeout or a dropped waiter does not discard cleanup or renew the budget.
• Track parent/child tasks, maintenance tasks, and foreign invocation cleanup through actual completion.
• Finalize replay decisions before teardown so cleanup-induced cancellation cannot rewrite durable history.
• Add per-runtime lifecycle diagnostics, controlled fault/race coverage, and lifecycle/provider documentation while preserving the existing polling policy.

Reviewer focus

The principal changes are in src/runtime/task_group.rs, invocation_scope.rs, shutdown.rs, runtime startup, both dispatchers, and the replay engine. Review the ownership transitions, deadline/result ordering, partial-startup rollback, and the distinction between execution quiescence and independent provider lifetime.

Legacy entry points remain available. Finite grace cannot guarantee bounded forced cleanup; an incomplete shutdown requires application/supervisor termination policy. The SDK does not terminate the process.

Verification

Local Windows evidence includes controlled lifecycle/task-tree/replay coverage and full default/all-feature Rust suites during implementation. After the final diagnostic corrections, nine focused diagnostic/shutdown cases and all-target/all-feature Clippy passed. Independent implementation/final-review follow-ups found no actionable issues in their reviewed scope.

These are local results, not a claim that this PR's CI or all delivery gates are green. PostgreSQL, non-Windows execution, and the broader cross-SDK regression gate remain outstanding.

Draft and dependency status

This is a maintainer-review draft, not a release request. The commit preserves the reviewed source snapshot and applies cleanly to main at 6a458861763a7aa5b78a7c1c97691a6f00489a8b.

The dependent SDK drafts require this new core contract. The crate remains at its existing development version; a compatible published core/provider dependency graph and final SDK registry pinning must be agreed and validated before distribution. No version number, release, tag, or publication is requested by this PR.

Local workflow artifacts, development binaries, and package outputs are intentionally excluded.

Generated with PAW.

[ChrisKrawczyk]

Upstream-first reconciliation is pushed in 82b2572 (normal merge of main, no history rewrite). GitHub reports this draft conflict-free. Native ownership now uses upstream TaskTracker, direct dispatcher handles and child abort guards; the custom task-group and core total-deadline modules are removed. Narrow fallible activation, typed actual-cleanup results and foreign finalization/retirement remain. Legacy native grace-then-cleanup and provider-cancellation semantics are preserved; SDKs own their bounded observations.

The feature-only diff falls from 6,976 to 4,774 changed lines, about 32%, excluding imported upstream fixes. The independent scoped integration review is PASS after correcting an inherited .NET concurrent-test assertion. Current core verification passed 156 focused cases (one recorder ignored); doctests passed 46 with 74 ignored. The reviewed tree exactly matches this commit.

Coordinated adapters: microsoft/duroxide-net#21, microsoft/duroxide-node#23, microsoft/duroxide-python#25. These remain draft/development integrations: published core 0.1.32 lacks the additive APIs, so approved registry dependency delivery, PostgreSQL, non-Windows/five-RID, broader regression and hosted CI gates remain OPEN. Nothing was merged, released or published.