Four related hardening items from an adversarial re-review of the shutdown/teardown path. Conservative throughout — a teardown that hangs is worse than the issues fixed, so every new wait is bounded and the cancel/close happens before the wait (no new deadlock).

Items

1. S4 — wait for background goroutines on shutdown. New App.bgWG. The projector, consumer, changes/broadcast tailers and the three TTL sweepers each bgWG.Add(1) at spawn + defer bgWG.Done(). Shutdown waits on bgWG after backplaneCancel() + backplane.Close() + closing stopSweep (so the goroutines observe the stop and exit), and the wait is bounded by the shutdown ctx via a done-chan + select { case <-done: case <-ctx.Done(): }. A goroutine wedged on a backend that ignores cancellation cannot hang the drain past its deadline — a leaked goroutine is strictly better than a hung shutdown.

2. S3 — prompt Subscribe teardown regardless of backend. The projector/consumer/changes/broadcast loops now select on the record channel and backplaneDone, so teardown is prompt even against a backend that doesn't close the channel on ctx cancel. Reconnect-on-transient-close semantics are unchanged (a real channel close still re-subscribes from the cursor).

3. S10 — ctx-aware CAS backoff. casSleep now takes a context.Context and selects on ctx.Done(), so a contended StateApp/StateSess.Update mid-retry aborts the backoff the instant the backplane ctx is cancelled instead of adding up to ~10ms to the drain. Threaded app.backplaneCtx from both Update call sites.

4. Theme-1 — surface swallowed backplane errors. WARN-log (greppable via: backplane … prefix) the previously dropped errors: backplane.Close in Shutdown; Subscribe/Head failure before a tailer goroutine returns; the broadcast Append error; the reconcile/applyChange LoadSnapshot errors in appval.go. Control flow unchanged; the ok=false non-error case still does not log.

Tested vs. couldn't

Covered by tests:

• S10 — casSleep returns promptly when the ctx is already cancelled (internal test); existing within-ceiling bound test updated to the new signature.
• S4 — Shutdown does not hang on a backend whose Subscribe channel never closes, and returns before its own deadline (proves the bounded wait + the S3 ctx.Done wake).
• Theme-1 — a failing-Subscribe stub backplane surfaces the greppable WARN through a capturing Logger.
• Existing backplane-context cancellation tests (TestShutdownCancelsInflight…, …WritePathContext) stay green.

Implemented but not directly unit-tested (asserted via the full -race suite + existing conformance/backplanetest, not a bespoke test): the per-loop backplaneDone wake on the consumer/changes/broadcast tailers in isolation, and each individual LoadSnapshot/Append/Close WARN site beyond the projector-subscribe one. These are log-only / control-flow-preserving changes verified by the existing suite staying green.

No deadlock + bounded shutdown

backplaneCancel() + Close() + close(stopSweep) all run before bgWG.Wait(), so every tracked goroutine can observe its stop signal first; the wait itself is wrapped in a ctx-bounded select. Verified Shutdown(context.Background()) (no deadline) still completes because all goroutines exit on backplaneDone/stopSweep.

CI

./ci-check.sh green: gofmt, vet, golangci-lint, govulncheck, API-compat baselines, -race across all packages, and the allocation gates (CounterRender 183/185, Action 137/149, ActionWithLogger 137/149 — unchanged).