mustflow 2.117.0 → 2.117.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mustflow",
-	"version": "2.117.0",
+	"version": "2.117.1",
   "description": "Agent workflow documents and CLI for mustflow repository roots.",
   "type": "module",
   "license": "MIT-0",

package/templates/default/i18n.toml

@@ -62,7 +62,7 @@ translations = {}
 [documents."skills.index"]
 source = "locales/en/.mustflow/skills/INDEX.md"
 source_locale = "en"
-revision = 289
+revision = 293
 translations = {}
 
 [documents."skill.ada-code-change"]
@@ -113,6 +113,12 @@ source_locale = "en"
 revision = 1
 translations = {}
 
+[documents."skill.connection-lifecycle-integrity-review"]
+source = "locales/en/.mustflow/skills/connection-lifecycle-integrity-review/SKILL.md"
+source_locale = "en"
+revision = 2
+translations = {}
+
 [documents."skill.behavior-preserving-refactor"]
 source = "locales/en/.mustflow/skills/behavior-preserving-refactor/SKILL.md"
 source_locale = "en"
@@ -278,7 +284,7 @@ translations = {}
 [documents."skill.memory-lifetime-review"]
 source = "locales/en/.mustflow/skills/memory-lifetime-review/SKILL.md"
 source_locale = "en"
-revision = 3
+revision = 5
 translations = {}
 
 [documents."skill.desktop-memory-footprint-review"]

package/templates/default/locales/en/.mustflow/skills/INDEX.md

@@ -2,7 +2,7 @@
 mustflow_doc: skills.index
 locale: en
 canonical: true
-revision: 289
+revision: 293
 authority: router
 lifecycle: mustflow-owned
 ---
@@ -272,7 +272,14 @@ refer to `AGENTS.md` and `.mustflow/config/commands.toml` to implement the most
   review rather than prose polishing.
 - Use `memory-lifetime-review` as an adjunct when code creates, registers, caches, spawns, opens,
   subscribes, schedules, streams, or otherwise retains values or resources whose cleanup,
-  cancellation, eviction, shutdown, or ownership transfer must be reviewed.
+  cancellation, eviction, shutdown, ownership transfer, RSS/heap/external classification,
+  allocator residency, queue-byte growth, end-to-end backpressure, or same-source cross-runtime
+  memory and stream reproduction must be reviewed.
+- Use `connection-lifecycle-integrity-review` as an adjunct when TCP sockets, HTTP keep-alive or
+  pooling, HTTP/2 streams or sessions, Node or Web Streams, FIN/RST, half-close, destroy or abort
+  races, response-body abandonment, reader or writer locks, backpressure, buffer budgets, natural
+  process exit, connection shutdown, fault injection, soak testing, resource-growth gates, or
+  connection-lifetime resolution claims need transport-lifecycle review.
 - Use `desktop-memory-footprint-review` as an adjunct when Windows, macOS, Linux, Electron,
   WebView, WPF, WinUI, Win32, Qt, Java Swing or JavaFX, .NET, JVM, Rust, C++, Python, or other
   desktop app code needs scenario-level memory review across working set versus private memory,
@@ -686,7 +693,8 @@ routes. Event routes stay inactive until their event occurs.
 | Notification generation, email, push, SMS, in-app inbox, digest, reminder, campaign, announcement, marketing message, transactional message, security alert, receipt, legal notice, notification preference, unsubscribe, suppression, quiet hours, timezone schedule, provider webhook, delivery attempt, notification template, or notification audit work needs notification-delivery triage for duplicate, late, suppressed, unsubscribed, wrong-channel, quiet-hours, timezone, retry, provider-webhook, hard-bounce, complaint, invalid-token, fallback, or audit risk | `.mustflow/skills/notification-delivery-integrity-review/SKILL.md` | User goal, current diff or target files, notification event ledger, notification intent ledger, recipient/channel/category ledger, preference and legal policy ledger, suppression ledger, schedule/timezone/quiet-hours/digest ledger, delivery job and attempt ledger, provider event ledger, in-app inbox ledger, audit/security/privacy/operations ledger, existing tests, and configured command intents | Source event and outbox records, notification intent records, preference snapshots, final pre-send rechecks, suppression records, schedule records, timezone-safe recurring intent, quiet-hours behavior, digest records, delivery jobs, delivery attempts, provider event receipts, provider webhook signature and dedupe handling, in-app inbox state, semantic dedupe keys, queue priority, retry classification, template snapshots, redacted audit logs, campaign dry run/sample/canary/ramp-up/kill-switch controls, focused hostile-path tests, and directly synchronized docs or templates | sendNotification shortcut, global opt-out, marketing consent bypass, provider acceptance treated as delivery, missing outbox, stale recipient scope, hard bounce ignored, complaint ignored, one-click unsubscribe missing, link-scanner mutation, stale push token, logout token leak, collapse key misuse, lockscreen data leak, in-app inbox count drift, mark_all_read_before race, semantic dedupe key missing, aggregation hidden as dedupe, digest window drift, quiet-hours delayed blast, timezone DST bug, provider limit starvation, unknown provider outcome blind retry, poison notification loop, provider webhook signature or dedupe gap, template render-time leak, account deletion pending-send leak, fallback spam, dry-run/sample/canary gap, no why-sent or why-suppressed audit, or happy-path-only notification tests | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Notification delivery reviewed, source-event/intent/recipient/preference/suppression/schedule/digest/delivery/provider/inbox/audit map, findings, fixes or recommendation, hostile-path evidence, verification, and remaining notification-delivery risk |
 | Code review or implementation needs api-misuse-resistance triage for APIs, SDKs, function boundaries, service methods, endpoints, command methods, DTOs, request shapes, response shapes, operation names, call ordering, lifecycle setup, boolean parameters, option bags, null or empty semantics, internal table leakage, string-only errors, success-only failure models, idempotency, pagination, sorting, filtering, authorization shape, status mutation, PATCH command buses, time formats, money amounts, open enums, async jobs, bulk partial failures, cacheability, response size, overfragmented calls, internal/external API mixing, version policy, deprecation telemetry, rate limits, retry hints, observability, SDK ergonomics, or caller contract tests | `.mustflow/skills/api-misuse-resistance-review/SKILL.md` | User goal, current diff or target files, caller ledger, operation ledger, shape ledger, compatibility evidence, existing style, and configured command intents | Operation-centered names, explicit lifecycle or builder boundaries, named options or split operations, narrowed option bags, explicit absence and PATCH semantics, public DTO mapping, stable errors, idempotency metadata, cursor stability, auth-specific operations, command-shaped state changes, time and money units, unknown enum handling, job resources, item-level bulk results, cache and rate-limit hints, observability fields, SDK examples, focused tests, and directly synchronized docs or templates | implementation-leaking name, hidden state machine, boolean riddle, trash-can options, null folklore, DB schema frozen as API, string-only error, success-only design, duplicate side effect, moving-list pagination, random default order, hidden permission mode, illegal status transition, PATCH-as-command bus, timezone ambiguity, floating money, closed external enum, fake synchronous completion, erased partial failure, uncacheable expensive read, all-in-one payload bloat, frontend-as-backend call graph, internal/external contract blur, decorative version number, unmeasured deprecation, retry-hostile rate limit, untraceable operation, awkward SDK, happy-path-only contract test, or first-time caller trap | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `test_audit`, `docs_validate_fast`, `test_release`, `mustflow_check` | API misuse resistance reviewed, caller and operation ledgers, shape and contract findings, fixes or recommendation, compatibility notes, verification, and remaining caller-misuse risk |
 | Code review or implementation needs error-message-integrity triage for error text, error codes, validation messages, parse failures, API or CLI error envelopes, public user messages, internal logs, structured diagnostics, exception wrapping, provider errors, retryable flags, idempotency errors, queue or batch failures, partial failures, permission errors, conflict errors, impossible-state errors, support IDs, redaction, stable machine fields, monitoring fields, or troubleshooting text | `.mustflow/skills/error-message-integrity-review/SKILL.md` | User goal, current diff or target files, error audience ledger, error contract ledger, disclosure ledger, recovery ledger, and configured command intents | Stable error codes, expected/actual fields, failed-operation context, reasons, safe identifiers, public/internal message split, redaction, retryability, idempotency metadata, provider metadata, parse positions, range bounds, conflict facts, partial-failure summaries, structured log fields, focused tests, and directly synchronized docs or templates | empty failed label, invalid-value fog, missing action, result repeated as cause, no work context, public/internal message mixing, sensitive value leak, missing safe identifier, retry ambiguity, try-again-later dodge, unstable string-only code, overbroad error bucket, validation info leak, parse location missing, range without bounds, timezone ambiguity, provider evidence loss, cause destruction, brittle message concatenation, prose-only logs, internal jargon in user text, permission existence leak, should-never-happen message, vague conflict, idempotency uncertainty, missing attempt count, partial failure erased, untested error contract, no 30-second next action, or call-site-specific taxonomy drift | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `test_audit`, `docs_validate_fast`, `test_release`, `mustflow_check` | Error message integrity reviewed, surfaces and audiences, code/message contract, evidence and redaction findings, fixes or recommendation, verification, and remaining error-message risk |
-| Object lifetime, retained references, cleanup symmetry, event listeners, timers, subscriptions, goroutines, threads, workers, streams, native handles, caches, queues, registries, closures, or memory/resource leak risk is created, changed, reviewed, or reported | `.mustflow/skills/memory-lifetime-review/SKILL.md` | Lifetime surface, setup sites, cleanup sites, retainer graph, repetition path, success and error paths, and configured command intents | Teardown, cancellation, ownership, weak-reference, eviction, queue-bound, stream-close, worker-shutdown, lifecycle-symmetry code, focused tests, and directly synchronized docs or templates | long-lived owner retaining short-lived object, setup without cleanup, unstable listener identity, timeout without cancellation, unbounded cache or queue, debug/log retention, leaked goroutine/thread/worker, native handle leak, finalizer-only cleanup, weak-reference cover-up, or missing repeated-lifecycle proof | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Lifetime boundary, setup and cleanup owners, retainer paths, long-lived owners and short-lived objects, repeated-lifecycle proof, verification, and remaining lifetime risk |
+| Object lifetime, retained references, cleanup symmetry, event listeners, timers, subscriptions, goroutines, threads, workers, streams, native handles, caches, queues, registries, closures, RSS, heap, external memory, ArrayBuffer or Buffer retention, allocator fragmentation, unbounded buffering, backpressure, or memory/resource leak risk is created, changed, reviewed, diagnosed, validated, or reported | `.mustflow/skills/memory-lifetime-review/SKILL.md` | Lifetime surface, setup and cleanup sites, retainer graph, repetition path, success and error paths, storage-location/retention-owner/terminal-status classification, controlled workload phases, post-GC and post-quiescent slopes, request-attempt-branch-stream ownership DAG, byte-flow and queue ledgers, cache/pool/handle evidence, protocol backpressure evidence, statistical tolerance, and configured command intents | Teardown, cancellation, ownership, weak-reference, eviction, queue-bound, stream-close, worker-shutdown, lifecycle-symmetry code, bounded memory and resource instrumentation, queue-byte accounting, terminal invariants, stop/plateau/resume fixtures, focused tests, and directly synchronized docs or templates | long-lived owner retaining short-lived object, setup without cleanup, unstable listener identity, timeout without cancellation, RSS-only diagnosis, overlapping totals subtracted as native memory, heapTotal called live memory, TIME_WAIT called a process leak, unbounded queue called safe because it drains, cache called bounded by TTL alone, fragmentation claimed before live native allocations are ruled out, accepted bytes confused with committed bytes, count HWM used as a byte cap, clone/tee branch abandoned, whole HTTP/2 transport paused for one stream, finalizer-only cleanup, weak-reference cover-up, or missing repeated-lifecycle proof | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Lifetime boundary, storage/owner/terminal classification, setup and cleanup owners, ownership DAG, retainer paths, memory floors and slopes, queue/backpressure envelope, stop and resume evidence, repeated-lifecycle proof, verification, and remaining lifetime risk |
+| TCP sockets, HTTP keep-alive or pooling, HTTP/2 streams or sessions, Node.js streams, Web Streams readers or writers, FIN/RST, half-close, destroy or abort races, unconsumed response bodies, backpressure, connection shutdown, transport resource leaks, fault injection, soak tests, or connection-lifetime resolution claims are created, changed, reviewed, debugged, validated, or reported | `.mustflow/skills/connection-lifecycle-integrity-review/SKILL.md` | Protocol and role, physical connection, request, body, lock and pool ownership, event and action ledger, orthogonal lifecycle dimensions, terminal-cause policy, reuse gate, buffer and resource ledgers, shutdown paths, harness isolation, closed-cohort request ledger, fault schedule, clean comparator, seed and duration policy, resource-growth gates, and configured command intents | Transport, read, write, pool, request, body, reader or writer, termination admission, quarantine, body lease, buffer budget, resource scope, shutdown state, diagnostics, fault and soak fixtures, measurement gates, regression contracts, docs, route metadata, and synchronized templates | single closing enum, destroy-everywhere cleanup, duplicate finalize, total-order event assumption, request/socket lifetime collapse, body cancel killing an HTTP/2 session, unsafe keep-alive reuse, unbounded discard, backpressure ignored, pending write double settlement, TIME_WAIT called a leak, flat RSS called a fix, contaminated harness counts, retry-until-green, restart called resolution, unref as cleanup, upgraded transport leak, or natural-exit theater | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Protocol and ownership layers, orthogonal states, event/action and primary-cause decisions, finalize/destroy admission, reuse/quarantine and body disposition, resource and buffer invariants, fault and soak evidence, application/library/runtime/environment attribution, resolution classification, verification, and remaining connection-lifecycle risk |
 | Desktop app memory footprint needs scenario-level review for Windows, macOS, Linux, Electron, WebView, WPF, WinUI, Win32, Qt, Java Swing or JavaFX, .NET, JVM, Rust, C++, Python, working set versus private memory, RSS, dirty pages, live set, peak and after-close memory, UI virtualization, data virtualization, renderer and window count, module loading, image decode size, OS-discardable caches, memory-mapped files, `madvise`, `EmptyWorkingSet`, .NET LOH, `ArrayPool<T>`, WPF visual trees, GDI or USER handles, detached DOM nodes, hidden windows or tabs, string deduplication, large buffer capacity, struct padding, object graph shape, undo history, inactive views, low-memory signals, or scenario memory budgets | `.mustflow/skills/desktop-memory-footprint-review/SKILL.md` | Scenario ledger, measurement ledger, UI residency ledger, data residency ledger, cache ledger, runtime ledger, existing tests, package surfaces, synchronized docs or templates, and configured command intents | UI virtualization, data virtualization, container recycling, lazy model fetch, renderer or window disposal, feature-entry module loading, image downsampling, cache cost limits, discardable cache behavior, streaming or memory-mapped file access, mapped-range release hints, low-memory handlers, after-close cleanup, undo compaction, object-shape flattening, string or symbol tables, pooled-buffer scope, native handle release, and focused tests | working-set theater, full UI object creation, UI-only virtualization, hidden renderer retention, eager feature module, original-size thumbnail, item-count-only cache, full file read, mapped range held forever, unsafe pooled buffer return, GDI or USER handle leak, detached DOM retention, console measurement artifact, duplicate string bloat, live-set staircase, cleared-but-huge buffer, padded bulk struct, pointer-heavy row model, whole-document undo snapshot, inactive tab kept fully rendered, no-op low-memory handler, or missing after-close evidence | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Desktop memory footprint boundary reviewed, scenario budget, measurement metric, UI/data virtualization, renderer/window, module, media, cache, file, runtime, native handle, UI retention, string, data model, history, inactive view, memory-pressure, after-close evidence, verification, and remaining desktop-memory risk |
 | Code review or implementation needs hot-path triage for repeated ordinary work, external round trips, multi-pass collection chains, hidden quadratic lookup, per-item allocation or serialization, transaction or lock hold time, sequential async waits, unbounded fan-out, cache stampede, queue throughput, retry multiplication, timeout waits, or missing observability before a broader optimization pass | `.mustflow/skills/hot-path-performance-review/SKILL.md` | Hot path, multipliers, per-iteration cost, boundary ledger, data-size and tail-latency evidence, correctness boundaries, and configured command intents | Batching, projection, lookup tables, bounded concurrency, timeout and cancellation wiring, bulk writes, cache-key boundaries, queue backpressure, transaction or lock narrowing, focused tests, and lightweight observability tied to the hot path | repeated I/O in loops, N+1 query, multi-pass array traversal, hidden `O(n^2)` lookup, unbounded `SELECT *`, large offset pagination, index defeat, wide transaction, lock-held slow work, sequential `await`, unbounded `Promise.all`, per-item client creation, cache key explosion, cache stampede, hot-path logging, deep clone, repeated JSON conversion, CPU-heavy request work, queue bottleneck relocation, retry storm, or p95/p99 blind spot | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Hot path reviewed, cost ledger, repeated-boundary and hidden-complexity findings, semantics preserved, evidence level, verification, and remaining hot-path performance risk |
 | API endpoints, handlers, controllers, resolvers, serializers, mappers, service methods, middleware, webhook receivers, backend-for-frontend paths, admin APIs, or route-level request paths need latency review for repeated work inside one request | `.mustflow/skills/api-request-performance-review/SKILL.md` | API request boundary, Request cost ledger, route span, DB query count, Redis count, external API calls, pool acquire wait, transaction scope, cache hit or miss, payload and response bytes, serialization time, ORM behavior, correctness boundaries, and configured command intents | Projection narrowing, query-count or lazy-loading guards, bounded batching, request-scope memoization, Redis `MGET` or pipeline use, app-side filtering or sorting cleanup, transaction narrowing, route-level observability, focused tests, and directly synchronized docs or templates | per-request I/O fan-out, ORM serializer lazy loading, eager-load row explosion, `SELECT *`, app-side filtering after overfetch, deep `OFFSET`, expensive `COUNT(*)`, index mismatch for `WHERE` plus `ORDER BY` plus `LIMIT`, external API inside transaction, pool acquire wait hidden behind fast queries, Redis loop, cache miss amplification, repeated JSON serialization, huge response bytes, CPU-heavy request work, Node flame graph gap, Go pprof gap, MongoDB `explain()` gap, or missing OpenTelemetry span evidence | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | API request path reviewed, Request cost ledger, route-level DB/Redis/external/cache/serialization/CPU findings, evidence level, verification, and remaining API request performance risk |

package/templates/default/locales/en/.mustflow/skills/connection-lifecycle-integrity-review/SKILL.md

@@ -0,0 +1,302 @@
+---
+mustflow_doc: skill.connection-lifecycle-integrity-review
+locale: en
+canonical: true
+revision: 2
+lifecycle: mustflow-owned
+authority: procedure
+name: connection-lifecycle-integrity-review
+description: Apply this skill when TCP sockets, HTTP keep-alive or pooling, HTTP/2 streams or sessions, Node.js streams, Web Streams readers or writers, FIN/RST handling, half-close behavior, destroy or abort races, unconsumed response bodies, backpressure, connection shutdown, transport resource leaks, fault injection, soak tests, or connection-lifetime resolution claims are created, changed, reviewed, debugged, validated, or reported.
+metadata:
+  mustflow_schema: "1"
+  mustflow_kind: procedure
+  pack_id: mustflow.core
+  skill_id: mustflow.core.connection-lifecycle-integrity-review
+  command_intents:
+    - changes_status
+    - changes_diff_summary
+    - lint
+    - build
+    - test_related
+    - test
+    - docs_validate_fast
+    - test_release
+    - mustflow_check
+---
+
+# Connection Lifecycle Integrity Review
+
+<!-- mustflow-section: purpose -->
+## Purpose
+
+Keep physical connections, transport read and write sides, logical requests, response bodies,
+reader or writer ownership, pool eligibility, and process shutdown from being collapsed into one
+misleading lifecycle flag.
+
+The central invariant is not that every connection is destroyed. Graceful FIN paths may never call
+`destroy`. The stronger invariant is that every owned connection record is finalized exactly once,
+and an abortive destroy or reset action is accepted at most once.
+
+<!-- mustflow-section: use-when -->
+## Use When
+
+- TCP, TLS, HTTP/1.1 keep-alive, HTTP/2 multiplexing, HTTP clients, servers, agents, dispatchers,
+  connection pools, upgraded sockets, WebSocket, CONNECT, or raw stream transports change.
+- Code handles `end`, `finish`, `error`, `close`, FIN, RST, timeout, abort, `destroy`,
+  `resetAndDestroy`, half-close, pending writes, drain, or shutdown deadlines.
+- A logical request, response body, body reader, stream, or HTTP/2 stream can finish or cancel while
+  its physical connection or session remains alive.
+- Response bodies can be partially read, paused, abandoned, discarded, cancelled, or left locked.
+- Slow consumers, backpressure, retries, transforms, adapters, or observability capture can retain
+  unbounded buffers.
+- A review or report claims that sockets are leak-free, safely reusable, fully drained, naturally
+  terminating, or closed exactly once.
+
+<!-- mustflow-section: do-not-use-when -->
+## Do Not Use When
+
+- The task only changes HTTP schemas, status codes, or headers with no connection, body, pooling,
+  cancellation, streaming, or shutdown behavior; use `api-contract-change` or
+  `http-api-semantics-review`.
+- The task only changes compression, CDN caching, SSE replay, WebTransport delivery choice, or proxy
+  buffering without transport lifetime risk; use `http-delivery-streaming`.
+- The task is a general retained-object or cleanup review without network or stream lifecycle
+  semantics; use `memory-lifetime-review`.
+- The task models a durable business entity lifecycle rather than independently closing transport
+  dimensions; use `state-machine-pattern`.
+- No connection, request, body, stream, pool, timer, listener, buffer, or shutdown boundary is
+  present to inspect.
+
+<!-- mustflow-section: required-inputs -->
+## Required Inputs
+
+- Protocol and role: raw TCP, TLS, HTTP/1.1, HTTP/2, WebSocket, CONNECT, client, server, proxy, or
+  adapter.
+- Ownership ledger for the physical connection or session, logical request, response body, reader,
+  writer, pool slot, timers, listeners, retry entries, and buffer reservations.
+- Event and action ledger distinguishing observed events from local actions such as graceful end,
+  cancel, destroy, reset, quarantine, pool return, or forced shutdown.
+- State dimensions for transport, readable side, writable side, pool membership, request, body
+  disposition, reader or writer lock, and server or client shutdown when each is relevant.
+- Terminal-cause policy, including which contender records the primary cause and how later causes
+  are retained for diagnostics without repeating side effects.
+- Reuse criteria, parser or framing boundary evidence, pending write state, buffered bytes, protocol
+  corruption state, and body disposition.
+- Success, half-close, timeout, abort, peer reset, writer error, reader cancel, unconsumed body,
+  slow-consumer, and shutdown paths that the implementation supports.
+- Relevant command-intent contract entries for tests, build, docs, release checks, and mustflow
+  validation.
+- For Node.js, Web Streams, or Undici-specific work, read
+  `references/node-stream-transport-lifecycle-checklist.md` before changing event-order,
+  cancellation, body-consumption, active-resource, or natural-exit behavior.
+- For repeated fault injection, soak testing, resource-growth gates, runtime or library attribution,
+  operational containment, or permanent-resolution claims, read
+  `references/connection-fault-injection-resource-lifetime-validation.md` before designing the
+  campaign or accepting its conclusion.
+
+<!-- mustflow-section: preconditions -->
+## Preconditions
+
+- Higher-priority instructions and `.mustflow/config/commands.toml` have been checked for the
+  selected repository.
+- Required inputs are available, or missing protocol and ownership decisions can be reported
+  without inventing behavior.
+- Version-sensitive runtime behavior is tied to current official documentation or repository tests;
+  supplied reference material is guidance, not proof that every runtime version behaves identically.
+- If general retained-reference risk dominates, also use `memory-lifetime-review`.
+- If races between termination contenders dominate, also use `race-condition-review`.
+- If delivery, cache, reconnect, or proxy semantics dominate, also use `http-delivery-streaming`.
+
+<!-- mustflow-section: allowed-edits -->
+## Allowed Edits
+
+- Add or tighten lifecycle state, terminal-cause arbitration, connection and request scopes, body
+  lease policy, pool quarantine, buffer budgets, shutdown phases, diagnostics, and focused tests.
+- Separate physical connection finalization from logical request and body settlement.
+- Centralize graceful-end and abortive-termination actions so timers, abort signals, writer errors,
+  and shutdown do not each perform duplicate cleanup.
+- Add bounded discard, cancellation, drain, grace, or force deadlines where protocol semantics allow.
+- Do not call `destroy` from every completion path merely because repeated destruction is a runtime
+  no-op.
+- Do not remove a connection from the active registry before its physical close event is observed.
+- Do not return a connection to a pool from writable/readable flags alone without parser or framing
+  boundary and body-disposition evidence.
+- Do not use `unref`, garbage collection, finalization registries, or process exit as connection
+  cleanup.
+- Do not weaken event-count, callback-settlement, buffer-bound, natural-exit, or open-handle tests.
+- Do not treat static review, one green reproducer, a flat RSS graph, a restart, or traffic limiting
+  as proof that a connection-lifetime defect is permanently resolved.
+
+<!-- mustflow-section: procedure -->
+## Procedure
+
+1. Draw the ownership layers before editing.
+   - Separate physical connection or HTTP/2 session, logical request, response body or stream,
+     reader and writer locks, pool lease, and process or server lifecycle.
+   - Name which layer owns each timer, listener, pending callback, retry item, buffer reservation,
+     and registry entry.
+2. Replace a single closing enum with orthogonal dimensions where shutdown can happen
+   independently.
+   - Model transport, read side, write side, pool membership, request state, body disposition, and
+     reader or writer ownership separately when the protocol permits independent progress.
+   - Treat remote and local half-close as valid combinations, not impossible intermediate states.
+3. Separate events from actions.
+   - Treat EOF or `end`, write completion or `finish`, `error`, and physical `close` as observed
+     events.
+   - Treat graceful `end`, cancel, discard, quarantine, `destroy`, reset, and force-close as local
+     actions whose admission must be controlled.
+   - Do not require an abortive action on a graceful path.
+4. Centralize terminal-cause arbitration.
+   - Route timeout, abort signal, writer error, protocol error, peer reset, body abandonment, and
+     forced shutdown through one termination admission function.
+   - Atomically accept the first terminal cause and at most one abortive action.
+   - Record later competing causes as secondary diagnostics without repeating destroy, reset,
+     callback settlement, metrics, or registry removal.
+5. Define finalization boundaries.
+   - Finalize and remove a physical connection record once, after physical close is observed.
+   - Permit a request to settle earlier after its request-scoped timers, listeners, retries, body
+     lease, and user result are finalized.
+   - Keep connection-core close and error observation alive even after request cleanup.
+6. Write the protocol-specific reuse gate as a conjunction of observable conditions.
+   - Require open transport sides, parser or framing boundary, terminal body disposition, no pending
+     writes, no reserved buffers, no terminal cause, no protocol corruption, and correct pool owner.
+   - Quarantine any HTTP/1.1 connection that observed premature close, truncated framing, parser
+     failure, content-length mismatch, reset, or unrecoverable body abandonment.
+   - Apply cancellation and reuse at HTTP/2 stream scope unless connection-level GOAWAY, session
+     error, or flow-control corruption invalidates the whole session.
+7. Give every response body a disposition and deadline.
+   - Require consume, bounded discard, protocol-specific cancel, or failure.
+   - Use both byte and wall-clock limits for discard; endless discard is a denial-of-service path.
+   - Settle cancellation separately from releasing a reader lock, and release the owner in a
+     finally-like boundary.
+8. Make write and backpressure accounting explicit.
+   - Stop or pause production after a write or enqueue signal reports backpressure.
+   - Settle every accepted write callback or promise exactly once as success or failure.
+   - Reserve bytes before enqueueing across readable, writable, adapter, parser, transform, retry,
+     discard, and observability layers; do not mistake a high-water mark for a global hard limit.
+9. Build connection and request resource scopes.
+   - Register timers, listener removers, retry tokens, body leases, locks, pending writes, buffer
+     reservations, and close waiters at creation time.
+   - Make disposal idempotent and keep request cleanup from deleting connection-core observers.
+10. Define server and client shutdown as bounded phases.
+    - Stop new accepts or requests first, then drain idle and active work, reject new HTTP/2 streams
+      when applicable, escalate after a deadline, and wait for physical closes.
+    - Track WebSocket, CONNECT, HTTP/2, and other upgraded or separately owned transports explicitly;
+      generic HTTP close-all helpers may not own them.
+11. Add observable conservation and cleanup invariants.
+    - Compare created, active, and closed connections; started and terminal requests; accepted and
+      settled writes; opened and disposed body leases; reserved, current, and released buffers.
+    - Keep identifiers in logs or traces and metric labels bounded to reason, protocol, role, or
+      mode.
+12. Test races and partial orders, not one pretty sequence.
+    - Cover local-first, remote-first, simultaneous FIN, RST, timeout plus abort, pending write plus
+      reset, body end plus cancel, paused read, unconsumed body, slow consumer, and shutdown races.
+    - Assert event counts, primary cause, accepted destroy count, request result, pool state,
+      registry size, pending writes, body disposition, lock ownership, and peak reserved bytes.
+    - Add a child-process natural-exit test without `process.exit` when configured test surfaces can
+      exercise event-loop handle leaks.
+13. Separate heap retention from event-loop liveness and native resource leakage.
+    - An unresolved promise alone does not keep the event loop alive, but a reachable promise chain
+      can retain request state.
+    - Check active timers, sockets, DNS/TLS work, file descriptors or handles, and heap retaining
+      paths with the configured diagnostics available to the repository.
+14. Design fault campaigns around closed cohorts and uncontaminated resource evidence when the task
+    requires more than focused lifecycle tests.
+    - Separate the system under test from load generators, raw fault peers, proxies, and packet or
+      network injectors so their timers and handles do not enter the system ledger.
+    - Give each request deterministic bytes, digest, idempotency identity, lifecycle timestamps, and
+      exactly one terminal outcome; compare clean and faulted traffic under predeclared load, seed,
+      duration, and statistical gates.
+    - Keep explicit-agent teardown campaigns separate from pool-reuse steady-state campaigns.
+15. Attribute the owner with differential reproduction before choosing a fix.
+    - Repeat the same fault schedule through the full application, a library-only reproducer, a
+      runtime-core reproducer, and direct versus production-like network paths where available.
+    - Classify application, library, runtime, or environment cause only from the layer where the
+      failure appears or disappears, retaining-path evidence, version bisect, or reproducible
+      infrastructure mechanics.
+16. Calibrate the conclusion to the evidence.
+    - Distinguish fix candidate, mitigation, symptom suppression, and permanent resolution.
+    - Require pre-fix failure, post-fix success, compatible correctness and performance regression,
+      bounded repeated and soak evidence, and a causal owner before claiming permanent resolution.
+    - Treat long-running soak, packet, native-handle, heap, or production-path checks as manual-only
+      or missing unless the selected repository configures them.
+17. Verify through configured command intents and report unavailable protocol, fault-injection,
+    active-resource, heap, file-descriptor, or natural-exit evidence instead of inventing commands.
+
+<!-- mustflow-section: postconditions -->
+## Postconditions
+
+- Physical connection, request, body, stream, lock, pool, and shutdown ownership are distinct where
+  their lifetimes can diverge.
+- Every connection record has one observable finalization path; graceful paths do not require
+  destroy, and abortive paths accept at most one destroy or reset action.
+- Primary terminal cause, secondary contenders, event counts, callback settlement, and registry
+  removal are deterministic under supported races.
+- Connection reuse requires framing completion, terminal body disposition, clean transport state,
+  zero pending writes or reservations, and protocol-specific eligibility.
+- Response bodies, locks, timers, listeners, retries, buffers, and upgraded connections have bounded
+  ownership and shutdown behavior.
+- Tests or explicitly reported evidence gaps cover the highest-risk FIN, RST, timeout, abort,
+  cancellation, backpressure, and shutdown paths.
+- Fault and soak conclusions preserve the tested protocol, role, environment, cohort, seed,
+  duration, measurement gate, and causal-owner boundary instead of generalizing from one run.
+
+<!-- mustflow-section: verification -->
+## Verification
+
+Use configured oneshot command intents when available:
+
+- `changes_status`
+- `changes_diff_summary`
+- `lint`
+- `build`
+- `test_related`
+- `test`
+- `docs_validate_fast`
+- `test_release`
+- `mustflow_check`
+
+Prefer the narrowest configured tests that exercise the changed protocol and lifecycle boundary.
+Do not infer raw packet tools, load generators, heap profilers, active-handle inspectors, open-FD
+commands, or child-process harnesses from this skill.
+
+<!-- mustflow-section: failure-handling -->
+## Failure Handling
+
+- If protocol and ownership boundaries are unknown, stop and list the missing decisions before
+  inventing a universal state machine.
+- If observed event order differs across valid runs, encode the supported partial order and event
+  counts instead of forcing one total order.
+- If a second termination contender repeats side effects, centralize admission before patching each
+  callback independently.
+- If safe reuse cannot be proved from parser or framing and body evidence, quarantine the connection.
+- If a body cannot be consumed, discarded, or cancelled within bounds, fail the body and retire the
+  owning stream or connection at the narrowest safe protocol scope.
+- If shutdown passes only after adding `unref` or `process.exit`, keep the test failing and report the
+  live handle or missing owner.
+- If exact runtime behavior is version-sensitive and current official evidence is unavailable,
+  narrow the claim and report the freshness gap.
+- If a reproducer turns green without retained-owner, handle, version, or infrastructure evidence,
+  report a fix candidate rather than a resolved root cause.
+- If only traffic limiting, isolation, version pinning, or process restart prevents exhaustion,
+  report mitigation and preserve the unresolved ownership risk.
+
+<!-- mustflow-section: output-format -->
+## Output Format
+
+- Protocol, role, and ownership layers reviewed
+- Transport, read, write, pool, request, body, lock, and shutdown states
+- Event versus action ledger
+- Primary and secondary termination-cause policy
+- Finalization and destroy or reset admission result
+- Reuse and quarantine gate
+- Body disposition, reader or writer ownership, and backpressure or buffer budget
+- Resource scopes, timers, listeners, retries, registries, and upgraded transports
+- Shutdown phases and escalation deadline
+- Invariants, fault matrix, event counts, and natural-exit or active-resource evidence
+- Harness isolation, closed-cohort ledger, repeated-fault and soak gates, and clean-traffic isolation
+- Application, library, runtime, or environment attribution evidence
+- Fix candidate, mitigation, symptom suppression, or permanent-resolution classification
+- Command intents run
+- Skipped diagnostics and reasons
+- Remaining connection lifecycle risk