[kixelated]

Problem

On release, UniFFI cancellation stops polling before it frees the future. Detached FFI work can consume the next frame or incoming session during that interval, losing it to the next caller.

Approach

Backport the paired ownership fixes from #5140 and #5172 while retaining release's runtime, setters, and listener APIs. Foreign futures own their pending operations. A bounded accept handoff and a separate listener stop handle preserve synchronous server cancellation; shutdown waits for in-flight host polls.

Consumers are existing foreign-language readers and native binding servers. Tests call the actual UniFFI poll/cancel/free APIs and deliver an event between cancellation and freeing.

Impact

• No public signature, binding, or wire-format change. No package version changes.
• Pending operations run on the foreign executor; the dedicated runtime still drives I/O, timers, and background work.

Validation

• Both UniFFI boundary tests fail on unchanged release and pass with the fix.
• just ci test origin/release: 159 FFI tests and 73 Python tests passed.
• nix develop --command just ci check origin/release: passed, including native/wasm Rust, Python, Kotlin, Go race checks, and Dart. Swift is unavailable locally and has its hosted check.
• just test interop --all: all 32 publisher/subscriber pairs passed, plus both varint interoperability tests. Chromium used its existing Nix runtime library paths because this host lacks system browser libraries.

Alternatives

Waiting for future destruction retains the data-loss race. Importing later worker-pool and transport redesigns would broaden this backport.

Follow-ups

Quest tracking: #6345. The additive draining-shutdown backport remains separate.

(written by GPT-6)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T17:31:02.036913Z	11bde3e	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kixelated]

The paired cancellation backport is complete with no public API or wire change. Both actual UniFFI cancel/free reproductions fail before the fix; all 159 FFI tests, 73 Python tests, release-pinned checks, and 32 interop pairs pass afterward. The browser run used the existing Nix runtime libraries to satisfy this host's missing Chromium dependencies.

The PR is ready and awaiting automated review. #6345 keeps the quest open until this release PR merges. No merge was requested or performed.

(written by GPT-6)

[kixelated]

Merged into release after a clean Codex review of this head and green release checks; maintainer picked the merge in the quest-complete run.

(Written by Claude Opus 5.5)