Retire controlled Service Worker fetches on abort and timeout

[wieslawsoltes]

Parent resource issue: #266
Webview epic: #264
Host-message streaming: #329
Connected resources: #308

Proven gap

Current fetch(..., { signal }) races the native fetch promise and rejects the JavaScript caller when the signal aborts, but it does not cancel the underlying controlled Service Worker fetch. A worker whose respondWith() promise remains pending keeps one of the 32 active fetch slots until the independent 30-second waiter expires, and that timeout does not explicitly retire the worker-side request. Repeated aborts can therefore exhaust the controlled-fetch cap and retain worker promises, host-message stream writers, or response-body leases after the caller is gone.

Navigation and unregister retire some client state, but there is no per-request cancellation identity connecting the Window fetch task to the Service Worker fetch queue/promise.

Scope

• Give each abortable Window fetch a bounded native request identity and connect it to its controlled Service Worker request.
• Propagate AbortSignal cancellation, native 30-second timeout, navigation, unregister, and shutdown to queued or dispatched worker fetches.
• Release the 32-fetch slot exactly once and reject/ignore every late response, host chunk, or settlement for a canceled request.
• Preserve browser AbortError/custom abort reason behavior and removal of abort listeners after settlement.
• Keep parser/connected element loads, localResourceRoots admission, localhost mapping, CSS routing, and product-specific message channels outside this slice.

Acceptance

• Chromium and native contracts cover pre-aborted signals, abort before worker dispatch, abort while respondWith() is pending, custom abort reasons, completion-vs-abort races, and late worker settlement.
• Thirty-two canceled controlled requests immediately free capacity for a succeeding request; no 30-second tail remains.
• Timeout, navigation, unregister, and shutdown leave zero queued/active controlled fetches and no retained response-body bytes.
• One hundred abort/settle cycles retain no more than 8 MiB V8 heap and 64 MiB RSS after warm-up, with p95 cancellation-to-capacity-release <= 100 ms.
• Existing Preserve range and cache headers in controlled fetches #323 range/header/body caps and Stream host-supplied Service Worker responses with bounded backpressure #329 streaming/backpressure contracts remain green.

Proposed focused PR

One product-neutral controlled-fetch cancellation tranche from current main, limited to the native fetch/Service Worker state machine and a reduced WebPlatformSubset contract plus native lifecycle/performance gate.

[wieslawsoltes]

Owned on branch feature/controlled-fetch-cancellation-340 from exact main bea90e8edb14dcb5a4c8e0257117934c3d462ea0 (the requested 33b7e8dd plus CSS-only PRs #338/#339).

Implementation boundary:

• experiments/WebScene.NativeEngine.Probe/native/webscene_v8_runtime.cpp: attach a bounded native identity to abortable Window fetches and forward abort to the runtime.
• webscene_v8_runtime_service_workers.inc, state_types.inc, and lifecycle/navigation cleanup only: cancel queued/dispatched controlled FetchEvents, wake their worker, release the 32-fetch slot once, and reject late settlement.
• tests/native_v8_runtime_stream_fetch_tests.inc plus focused test registration/CMake as needed: 32-slot release, timeout/navigation/unregister retirement, 100-cycle latency/heap/RSS evidence.
• New reduced tests/WebPlatformSubset/contracts/service-worker-controlled-fetch-abort* document/worker pair and additive component-profile entry for Chromium/native semantics.

Excluded: parser/connected/CSS resource scheduling (#308), host-message chunk/backpressure code (#329), localResourceRoots and localhost host policy, CSS metadata/cascade, consolidation #76, and Release worktrees.

[wieslawsoltes]

PR #341 is open from final source head ca6f0fa90f15bdbcf80f44d00f16fa0a68fb99a5, based on exact main bea90e8edb14dcb5a4c8e0257117934c3d462ea0.

Focused evidence:

• native 100-cycle abort gate p95 0.0325 ms; V8 heap 1,236,680 -> 1,236,680 bytes; current RSS 46,153,728 -> 54,493,184 bytes;
• all 32 pending controlled fetches release capacity in about 3 ms; unregister retirement completes in about 2 ms;
• native reduced contract 1/1 document, 4/4 subtests, 126 ms;
• Chrome 153 contract 4/4, 131 ms;
• adjacent resource plane, host stream, lifecycle, connected-resource, parser/frame, and range/cache native gates pass.

The implementation preserves the existing 32-fetch and response-body limits, uses single-settlement and single-slot-release state, and ignores late worker completion. Local-resource admission and localhost mapping remain separately owned host-policy work.

[wieslawsoltes]

Correction: the exact final source head is ca6f0fa91dea0fac90bb9758e7bff2a6f289f5f3.