[JasonStys]

Windows native acceptance reached an authenticated shutdown acknowledgement but stalled before Uvicorn's lifespan cleanup. The native service now gives HTTP work five seconds to drain, cancels and joins its remaining HTTP tasks, and then uses normal vault sealing. It never force-kills the service or skips recovery protection.

Protected disk work and coherent account transitions finish under the existing request mutex before raw asyncio cancellation is reported. This covers full unlock/lock, provider destination/key/consent publication, authorized deletion, logout and recovery reset; request bodies and AI/network calls remain cancellable. Numeric native drain observations and the actual owned-process exit checks distinguish acknowledgement, request cleanup, sealing and termination.

Validation:

• Full controller/training gate: 265 tests and 28 subtests, 85.12% coverage with the unchanged 80% floor.
• Real authenticated loopback regressions: held handler, partial POST body, actual offloaded snapshot and authenticated restore; exact revision recovered from the sealed AES-GCM archive.
• Actual repeated-cancellation/thread error controls and real provider/deletion transition tests, plus an independent provider cancellation/restore review.
• All 48 controller and 18 private-account browser checks across Chromium, Firefox and WebKit; strict TypeScript/Vite build, Ruff and 86 checked source maps.
• Fresh frozen Windows SDK journey and freshly compiled unpacked Windows application passed. The final compiled test observed actual drain counts, sealing/lifespan/thread completion and absence of both owned service/bootloader PIDs. Native 60-second journey, existing launcher deadlines and zero retries are unchanged.

The reproduced drain mechanism does not identify the exact request in the historical hosted failure. Critical filesystem/container cleanup can safely outlive the HTTP budget; this is not a universal process-exit guarantee. Local compiled evidence is an unsigned dirty development build, not a published asset or clean-machine installation claim. Exact-source hosted checks on all three operating systems and full-main CodeQL remain required. Documentation PR6 remains held pending this accepted runtime baseline; existing releases and installed apps are untouched.