[shoedog]

Summary

Fixes #268. In served SSE fan-out fallback, a client disconnect awaited cancellation without polling the retained fan-out work. Both paths acquire the coordinator-wide bindings mutex, which is FIFO, so a local driver queued for it kept the released permit reserved while unpolled: the producer hung forever and every later bindings acquisition blocked.

• The disconnect arm now polls cancellation and the retained work concurrently, so the queued driver can take and release its reservation.
• Cancellation precedence is preserved ahead of aggregate finalization (review round 1 found a concurrent-completion race that could defeat it; fixed in round 2).
• Tests: queued-driver disconnect (RED on base: hang), completed and idle peers, cancellation after SSE exposure; the reviewed-version completion race is RED before the round-2 fix.

The deployed serve release predates the affected code; the next serve swap would have shipped it.

Verification

• Container (Sol): workspace 6,370 passed / 0 failed / 13 ignored (CARGO_INCREMENTAL=0); fmt, clippy -D warnings, hygiene; goldens unchanged; wire SHA equals base.
• Host: fmt, clippy (bridge-a2a-inbound, -D warnings) clean; bridge-a2a-inbound 321/321; uncapped_order_and_wire_control byte-identical to base.
• Review: gpt-6-astra, 2 rounds, APPROVE. Deferred SMELL: the completed-peer cancellation assertion observes an unused fake.

🤖 Generated with Claude Code

https://claude.ai/code/session_017izEynabPeSUBT573AtvaZ