fix(gateway): contain output pump shutdown races

docs/prds/0082-authoritative-failure-boundaries.md

@@ -13,9 +13,7 @@ resource-consuming boundary revalidate the assumptions it acts on. This
 finishes the focused quality work begun under #444 without broad rewrites:
 cleanup cannot act on stale identities, policy introspection cannot publish a
 fabricated empty policy, gateway servers bound untrusted work, and daemon
-shutdown does not emit uncaught background-thread failures. Shared
-control-plane storage and gateway credential provisioning also enforce their
-filesystem security contract before sensitive data is written.
+shutdown does not emit uncaught background-thread failures.
 
 ## Problem
 
@@ -47,18 +45,6 @@ misleading behavior:
 8. Firecracker artifact downloads and registry publication have no network
    deadline, so an unresponsive registry can hold setup or release work
    indefinitely.
-9. Authenticated secret blobs select the unauthenticated legacy decoder when
-   their in-band version prefix is changed, allowing storage tampering to
-   bypass tag verification.
-10. Cleanup executes the entire post-confirmation snapshot rather than the
-    intersection with what the operator saw, and mutation failures are not
-    reflected in the command result.
-11. Git smart-HTTP can retain sixteen 100 MiB request bodies concurrently,
-    cleanup mutations have no subprocess deadline, and Firecracker signalling
-    failures bypass shared mutation accounting.
-12. SQLite creates the shared control-plane database before its mode is
-    restricted, then suppresses permission-repair failures. Gateway transports
-    also differ in whether copied deploy-key modes are preserved.
 
 These are one design problem: state used to authorize deletion, replacement,
 or resource allocation must be authoritative at the point of use.
@@ -87,20 +73,6 @@ or resource allocation must be authoritative at the point of use.
   as completion while preserving diagnostics for unexpected failures.
 - Artifact pull, existence-check, and publication requests use explicit
   network deadlines.
-- Persisted secrets accept only the authenticated format. The schema migration
-  intentionally clears legacy rows; local agents are reprovisioned rather
-  than retaining a ciphertext-controlled downgrade path.
-- Cleanup executes only resources present in both the displayed and current
-  authoritative plans, attempts every approved mutation, and returns failure
-  when any mutation does not complete.
-- Git request bodies spool to disk behind a separate heavy-work semaphore;
-  cleanup commands have configurable deadlines; Firecracker signalling
-  failures aggregate while identity-verification uncertainty still aborts.
-- The shared database directory and file are private before SQLite writes any
-  control-plane state; an inability to enforce those modes aborts startup.
-- Gateway credential directories and files receive explicit private modes
-  inside the gateway, independent of Docker, Apple Container, or SSH copy
-  semantics.
 - Unit tests cover PID/path reuse, partial backend enumeration, transient
   policy resolution failure, slow bodies, concurrency saturation, and stream
   closure races.
@@ -163,17 +135,6 @@ The gateway output pump catches only stream-closure exceptions expected after
 the supervisor closes child pipes. Other I/O failures remain visible and are
 reported through the supervisor's normal diagnostic channel.
 
-### Shared filesystem security
-
-The common SQLite store owns database creation for every backend. It creates
-the parent directory and an empty database with private modes before opening
-SQLite, repairs existing modes, verifies the resulting state, and propagates
-every enforcement failure. Backend launchers do not duplicate this policy.
-
-The backend-neutral gateway provisioner likewise applies directory and file
-modes after transport copies complete. This avoids relying on copy behavior
-that differs among Docker, Apple Container, and Firecracker's SSH transport.
-
 ## Implementation chunks
 
 1. Existing fail-closed security and backend enumeration fixes.
@@ -185,12 +146,6 @@ that differs among Docker, Apple Container, and Firecracker's SSH transport.
 7. Gateway shutdown log-pump closure handling.
 8. Lossless Firecracker process identities, authoritative Docker cleanup
    queries, and bounded Firecracker artifact transfers.
-9. Mandatory authenticated secret storage, shared cleanup-plan intersection
-   and mutation accounting, and contained Git backend process failures.
-10. Disk-spooled and separately bounded Git bodies, cleanup command deadlines,
-    and classified Firecracker signalling failures.
-11. Fail-closed shared database creation and backend-neutral gateway credential
-    permissions.
 
 ## Open questions