The drain does not read a request body in flight — resolved

A design note from the engineering record, moved out of ROADMAP.md on 2026-09-03 and kept as written. The roadmap itself now holds only the project's state; the reasoning lives here.

Found by the soak driver's uploads population on color-separation (2026-09-02): with 9.7 MB multipart uploads in flight, every SIGTERM drain took exactly its 5 s budget, and the bisection put it on uploads alone. Measured directly with scripts/drain_upload_probe.py: a 10 MB POST with 5 MB delivered when SIGTERM lands and the rest sent a second later was never read — _run_shutdown's loop dispatched EVFILT_WRITE only, by design ("nothing new is read during the drain") — so the client was reset at 5.03 s and the process exited at 5.09 s. Half of docker stop's patience spent on a request that would have completed in milliseconds; gunicorn's graceful timeout keeps reading. The request-side twin of the response-side defect drain_inflight_probe.py pins: that one held the drain for a connection already answered, this one for a request not yet received. The same write-only loop had a second consequence nothing had measured: a response too large for one send was cut at its first write readiness, because that branch closed the slot instead of sending the rest.

The fix is to stop re-implementing the loop. The drain now runs ordinary _run_pass passes for its budget: mid-request bodies are read, responses are written whole, pool completions and bus frames are serviced, buffered submits flushed. The listener is already closed so a pass accepts nothing, and _close_between_requests after every pass is what bounds it: a connection with no request in progress is closed, so only bytes the client had already sent are ever served. The shutdown pipe is deregistered first — its byte is never read, so a registered pipe stays readable and every pass would break at it. Gated by SPEC D9 (smoke-drain-upload, both shapes, two-sided); sabotaged by restoring the old loop, which the probe reports as the reset at 5.03 s and the exit at 5.09 s. Measured after: answered whole and exited at 1.08 s, the extra second being the probe's own delay before sending the rest of the body.