ci / rust (push) Successful in 7m22s
`BrokerHandle::resolve_attach` (daemon) and `Registry::create_session` / `kill_session` (registry) insert a pending oneshot into a map, then await the reply. If the awaiting future is cancelled — e.g. an axum handler dropped because the browser closed the tab or aborted the XHR — the entry was never removed, leaking one map slot per cancelled request and growing unboundedly under UI-driven retry traffic. Introduce a small RAII `PendingGuard` that removes the entry on drop, so cleanup happens on every exit path including cancellation. Because a sync `Drop` can't lock a tokio mutex, move the pending maps to `std::sync::Mutex` (only ever locked for a tiny insert/remove, never held across an await): broker `pending`, and the registry's `pending_create` / `pending_kill` lifted out of the async-locked `State`. Removal is idempotent, so the happy path (reply already taken by `complete_*`) and the guard's drop don't conflict; `await_rpc` no longer needs its manual timeout cleanup. Tested: cancelling an in-flight `resolve_attach` (broker) and `kill_session` (registry) leaves the pending map empty. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>