Follow-ups from #746: the adapted #692 assertion is not forced, the ctx-bound test's unbounded-wait failure mode, CI runs the drain-order test in one shape

[FumingPower3925]

Follow-ups from the review of #746 (#703). The blocking findings were fixed in round 2 (head 3d2ab72). This lists the minor and nit findings.

Handled in round 2:

• epoll's "drain" is "the handlers returned", not "the responses were sent" (minor). Filed as epoll: shutdown closes connections with their pending writes unflushed, so a response larger than the socket buffers loses its tail (no counterpart of io_uring's #595 send drain) #760. The Shutdown godoc and the listenDone comment now say so, and neither calls the wait a full drain.
• The listenDone comment was false for std (minor). It said std's Listen returns after the drain, but it returns when Engine.Shutdown closes the listener, at the start. The comment is rewritten. The engine difference it pointed at, std's Start returning at t=0 on a direct Shutdown, is gone: a Start* call stopped by a direct Shutdown now returns after that Shutdown on every engine.
• A 4 MiB HTTP/1.1 response sends only its headers on epoll and io_uring (nit, out of scope). Filed as epoll/io_uring: an HTTP/1.1 response of 4 MiB or more sends only its headers; the body is dropped and a keep-alive client waits until its own timeout #761.
• The body said the controls ran at 8b72c10 "and the only later commit is comment-only" (nit). The round-2 body's numbers are all from the final head's text.

Open (tests and CI):

1. The adapted fix(server): shut down on every context cancel, and return only after it (celeris#673) #692 assertion is not forced. In start_context_shutdown_test.go (TestStartContextWatcherDoesNotRepeatADirectShutdown, "the hook ran %d times while Listen was still tearing down"), the check races the Shutdown goroutine under the negative control. The review measured 300/300 FAIL without -race and 296/300 with it. The deterministic detector is TestShutdownRunsHooksOnlyAfterListenReturns, so the test's doc should not present it as one.
2. TestShutdownWaitForListenIsBoundedByCtx catches an unbounded wait only through the package -timeout panic. That panic gives no --- FAIL line, and in CI's root step it costs 300 s and aborts the whole root package. Also, start is taken after context.WithTimeout, so elapsed < 100ms is not a strict bound (it is redundant with the DeadlineExceeded check). Fix: run Shutdown on a goroutine with its own 10 s watchdog, and take start before WithTimeout.
3. CI covers TestShutdownHooksRunAfterTheDrain in one shape only. The Unit job's root step runs without -v at the runner's 8 MiB memlock, so io_uring has one worker. The multi-worker drain is checked only on the laptop (unconstrained memlock) and in the queued cluster row. go test $pkgs runs packages concurrently and they share the per-UID ring budget; the test retries an ENOMEM start for up to 10 s and has no skip path. Consider a named -v step for this test, as Follow-ups from #698: shutdown leaves a deferred transplant's descriptor open (pre-existing), EPOLLOUT comment premise, CI visibility of the new test, stale comments #727 item 3 asks for another test.

[FumingPower3925]

Consolidated on 2026-10-02 (maintainer decision): polish items -> #890; defects -> none. Nothing was dropped.

Already done or superseded here, per this thread: item(s) r2-epoll-drain-wording, r2-listenDone-comment, r2-4MiB-response, r2-body-numbers.