[MichalCz]

Summary

Fixes #83.

• Add optional request-scoped Broker AbortSignal support and connect Agent, Fetch, and low-level Dispatcher cancellation to the native HTTP/2 stream, including before headers and through internal redirect/replay handling.
• Preserve unrelated requests and shared sessions; keep normal upload EOF separate from cancellation.
• Add receiving Guest lifecycle support: Node response close/destroyed, Bun handler Request.signal, and Python post-upload ASGI disconnect monitoring with cooperative application cleanup and flow-control accounting.
• Add literal createAgent() + node-fetch regressions, real TLS coverage across Node/Bun/Python Guests, and deterministic response-arrival races for the Node Broker, Agent, and modern/legacy Dispatcher. Update cancellation and compatibility documentation.

Validation

Current PR head: 6b98807. Hosted validation run passed.

• Current-head build/staging and bounded source tests: 594 passed, four intentional packaging-related skips, zero failures/cancellations.
• Dedicated staged/tarball consumer validation: 89 tests passed without skips.
• Real TLS matrix: 12 top-level tests / 24 cases, covering three receiving runtimes × four request paths × pre-header/streaming. No runtime skipped. Verifies caller-visible failure, independent remote cleanup before teardown, native CANCEL reset, active sibling survival, and same-session follow-up.
• Nine deterministic response-arrival race tests passed in current-head CI. The focused Broker/Agent/Dispatcher suite also passed 104 tests, covering held/accepted native headers, pending adapter handoffs, late response disposal/rejection ownership, and response-first aborts without duplicate terminal callbacks or unhandled rejections.
• Bun workspace: 43 tests / 177 assertions; declaration build passed.
• Python workspace: 166 tests; compileall passed.
• Documentation checks: 11 tests passed.
• Current-head hosted whole-root npm run lint: 142 files checked successfully. CodeQL (JavaScript/TypeScript and Python), DCO, and Gitleaks passed.
• git diff --check passed.

The current-head hosted run includes the final race tests and documentation. Bun/Python workspace and focused documentation results remain valid because subsequent changes were limited to CI setup and Node test coverage. Local root lint can still encounter four formatting findings in unrelated, untracked .slim/worktrees/ setup-state files; those files are excluded from this PR and did not affect hosted lint.

Scope and limitations

• Handler cleanup remains cooperative; no full Node HTTP object compatibility is claimed.
• Deterministic Broker header races use real TLS/native streams; adapter handoff tests use the real Agent/Dispatcher with instance-local deferred Broker responses. These are bounded scheduling proofs, not exhaustive proofs of every possible interleaving.
• Python's private 250 ms disconnect-notification opportunity is implementation policy, not a new public setting or ASGI timing guarantee.
• No protocol changes, immediate Host lease-queue removal, WebSocket changes, Python Broker cancellation, or Bun outgoing fetch-wrapper changes.
• node-fetch is a test-only development dependency. No package version bump, release, or publishing operation is included.
• This verifies the PR branch, not a released package or downstream Scramjet-hosted sequence.

Checklist

• Author is the exempt maintainer MichalCz.
• Regression tests and source references were updated for behavior/documentation changes.
• Host/Guest/Broker terminology and supported runtime boundaries remain precise.
• Generated artifacts, local certificates, credentials, and unrelated worktree metadata are excluded.
• Release/publishing remains maintainer-controlled; publishing jobs were skipped for this PR validation run.

Merge manually through the protected main workflow; this PR must not be merged automatically.