Adopt real-socket adapter cancellation and timeout conformance guard

[smiggleworth]

Summary

Adopt the shared @askrjs/server/testing adapter conformance runner against the real @askrjs/node listener, so response cancellation and incomplete-request timeouts remain executable cross-package guarantees.

Dependency and implementation contract

Depends on askrjs/askr-server#20 and its released @askrjs/server/testing entry point.

Use real loopback sockets, not a mocked ServerResponse:

• cancellation exercise: serve the runner's infinite response, read at least one chunk over TCP, destroy the client, and wait for the runner to observe ReadableStream.cancel();
• timeout exercise: listen with explicit finite requestTimeout/headersTimeout, send an incomplete chunked request over a raw socket, and resolve only when Node closes the connection;
• every exercise owns deterministic cleanup and alternate ephemeral ports; no default-port assumptions;
• retain the existing direct unit coverage for writeNodeResponse() and timeout option validation.

The red transport run proved a real timeout gap: assigning server.requestTimeout and server.headersTimeout only after createServer() leaves Node's incomplete-connection checker at its 30-second construction default, so authored 100 ms values did not terminate the stalled body within two seconds. Initialize request/header/keep-alive timeouts and connectionsCheckingInterval during construction in both listen() and serve(). Choose a positive check interval no slower than the smallest configured request/header timeout, capped at one second, then restore the exact authored public property values so existing mixed timeout configurations remain compatible.

Acceptance criteria

• Verify the issue author is smiggleworth.
• Upgrade to the released server version that exports @askrjs/server/testing.
• Run the shared adapter conformance runner through the real Node listener.
• A real client abort cancels the infinite Web response body within the conformance deadline.
• An incomplete raw HTTP request is terminated by explicit finite adapter timeouts within the conformance deadline.
• listen() and serve() initialize Node timeout/checking machinery during server construction while retaining the exact authored timeout property values.
• Both exercises honor cleanup signals and close sockets/servers on success and failure.
• Existing adapter response, timeout-option, WebSocket, and package tests remain green.
• Guardrail (prevent this class of bug): Keep the shared real-socket conformance test in the normal unit/CI suite so future response-loop or timeout wiring changes cannot bypass it.
• Full unit, type, build, package-artifact, audit, and exact-head hosted CI gates pass.

Definition of done

• Every criterion above is checked with evidence before squash merge, and version 0.0.12 is release-ready at the exact head.

Severity

Medium — response cancellation was correct, but the real-transport guard proved authored timeout values were not enforced promptly because the checker was initialized too late.

[smiggleworth]

Acceptance evidence for exact head 0d6baad9dba2a4d3a49c3012624d292397d73634:

• issue author verified as smiggleworth
• dependency raised to released @askrjs/server >=0.0.18; lock resolves 0.0.18 and imports @askrjs/server/testing
• red 1f92e83: the old dependency did not export the shared guard
• transport red 3a3e6a5: after adopting the runner, real client-abort cancellation passed, but a stalled chunked request exceeded the 2-second deadline despite public 100 ms timeout properties
• green 03eaf42: listen() and serve() now initialize request/header/keep-alive timeouts and connectionsCheckingInterval in createServer(); the checker interval is no slower than the smallest positive request/header timeout and capped at one second
• exact authored public timeout properties are restored after construction, preserving the existing mixed requestTimeout: 123 / headersTimeout: 456 compatibility test while still initializing a valid native server
• the real conformance lane reads a chunk from the supplied infinite response, destroys the HTTP client, observes body cancellation, then sends an incomplete chunked body over raw TCP and observes Node's 408/close in roughly 120 ms
• both exercises bind only to loopback/ephemeral ports, honor cleanup signals, destroy clients, close all connections, and await server closure
• all existing adapter request/response, direct writer cancellation, backpressure, timeout validation/property, WebSocket, static serving, shutdown, and package tests remain green
• local npm run check: lint, types, 58 tests, build, publint, and packed-artifact checks passed
• local runtime npm audit --omit=dev: zero vulnerabilities
• hosted CI run 31907334627 passed at the exact head on Ubuntu, macOS, and Windows
• manifests are release-prepared as @askrjs/node@0.0.12; worktree and local/tracking/remote SHA are clean and equal

[smiggleworth]

Release proof: PR #24 squash-merged as b74939ddeebd937170cf4f6a6665442c268bc69c. Publish run https://github.com/askrjs/askr-node/actions/runs/31907419752 completed successfully from that exact main SHA on Ubuntu, macOS, and Windows. Annotated tag v0.0.12 peels to the same commit. npm serves @askrjs/node@0.0.12 with integrity sha512-UkVUo8D5KLes7L2cn5OKtxu9bMbQtBXVo+15wKRkzhjKcyvXqis9GTypm/GaOVX2L/CL62VvQVQzgB09iys7tg==; clean-consumer verification follows in the PR audit.