fix(session): join routing cache refresh before close returns

[santoshkumarradha]

Real product workflow — recorded on Spark

Goal: Continue an existing pantry shopping CLI: harden invalid-input handling through natural follow-ups, preserve its JSON and fractional-quantity behavior, then close the real session cleanly.

Observed outcome: The completed CLI passed 28 tests and produced the expected shopping quantities. Natural follow-ups covered blank names, non-finite or negative values, fractional quantities and negative thresholds. The inventory stayed unchanged. After normal exit there were no remaining product processes and all 109 recorded profile files remained unchanged for five seconds.

Watch the workflow (MP4) · Animated GIF · Original terminal recording (.cast)

Evidence: tested revision aad6ef9a868a60b0c4c9b3ef5cd5b0d2cd70335e; Spark session critical-extended-1499-v2. Execution/binary identity, model receipts, checksums and playback details. All 61 recorded calls used OpenRouter deepseek/deepseek-v4.1-flash, including auxiliary calls. Independent artifact runs, post-close observation, working CLI source and its tests.

Playback and limits: Original .cast is preserved; GIF/MP4 play at 3× speed with idle intervals capped at 3 seconds. This live run exercises ordinary work and shutdown; a deterministic blocked-refresh regression separately proves the specific late-writer lifetime. Five seconds of observed quiescence does not establish every possible shutdown race is fixed. Model Pool was disabled for separately tracked #1608. The CLI uses ordinary float subtraction, so some fractional displays have normal floating-point precision artifacts; no rounding fix is claimed. Full affected-package checks remain tracked below.

Closing a session cancelled its routing-cache refresh without joining the goroutine. A refresh finishing a cache or ledger write could still use the state directory after Close returned. The session now cancels and joins its own beat before returning, with the same optional lifetime as the existing beat.

Related to #1499 and #1491. This proves and fixes one late-writer lifecycle gap; it does not claim that every previously reported cleanup race has this cause.

A deterministic blocked-sheet test fails on unchanged base (Close returned while cancelled refresh was held) and exercises the final join. Focused regression and live close verification passed. Full affected-package verification also passed on Spark.

Validation: final head 061c9f7441ff9c81de7d50e82c99aeacaca616db passed Spark make pr-ready SHARDS=2 (exit 0; full session suite, both shards, 266 seconds) and all GitHub checks. Recorded runtime aad6ef9a8 differs only in six test files: fixes synchronize receipt journaling, run/store teardown, reading observation, decision ownership, and the young-bash fixture. No runtime behavior or timeout changed after recording. The two earlier failed local runs are retained; those fixture corrections and pinned Go caches address their established causes. Full local evidence: extended/1499-verified-ready.log, .exit, host/revision records and 1616-runtime-equivalence.json.

[santoshkumarradha]

Superseded by the consolidated draft #1627. Exact reviewed head 061c9f7441ff9c81de7d50e82c99aeacaca616db is included in published Santosh/dev integration ef1ba797ab6adbf4ff519d5808316d07d982c002; ancestry was verified after push. Source findings, validation, recordings and limitations are preserved in #1627. This closes the separate review destination; dev/main were not merged and final aggregate acceptance is still pending.