Durable stores are never closed on shutdown

[Yatsuiii]

Raised by @rajnisht7 in #661.

#634 released session-scoped resources on every path that ends a session,
including graceful shutdown, and built the hook that does it:

try:
    yield
finally:
    await self._proxy.shutdown(drain_timeout=self._session_close_drain_s)

(mcp/server.py:459)

The three durable stores are a different category. They are opened once in
run_startup (startup.py:781, :804, :814) and carried on
RuntimeContext for the process lifetime, so they were outside #634's
session-scoped remit and are never closed at all. Grepping mcp/server.py
for audit_store, kill_switch_store or session_state_store returns
nothing.

They are also not symmetric, which matters before someone picks this up:

• SqliteAuditStore.close() exists (audit/store.py:92)
• SqliteSessionStateStore.close() exists (session/store.py:272)
• KillSwitchBlockStore has no close(). Its methods are __init__,
  block, unblock, is_blocked, blocked_at.

So closing all three consistently means adding close() to
KillSwitchBlockStore first, then passing the stores into MCPServer and
closing them in the existing finally after proxy.shutdown().

This predates #661 and is not introduced by it.

[rajnisht7]

The store/close() asymmetry breakdown is spot on, and the fix shape (close() on KillSwitchBlockStore, wire into MCPServer, close in the existing finally) seems right.

Two things worth adding, both easy to miss here:

1. Adding the store params to MCPServer.init isn't enough as build_server() in cli.py is the only place MCPServer gets constructed, and it still needs to actually pass ctx.audit_store / ctx.kill_switch_store / ctx.session_state_store in. Skip that and the params just stay None forever, which is basically session_state_path is documented and released but rejected at config load and never constructed at startup #653 all over again.

2. _lifespan currently does finally: await self._proxy.shutdown(...). If the three close() calls just get tacked on right after that, one failure (from shutdown() itself, or from any one store's close()) skips the rest exactly when a clean close matters most, right before a restart. Something like this handles it:

     finally:
         try:
             await self._proxy.shutdown(drain_timeout=self._session_close_drain_s)
         finally:
             for store in (self._audit_store, self._kill_switch_store, self._session_state_store):
                 if store is None:
                     continue
                 try:
                     store.close()
                 except Exception:
                     logger.exception("Failed to close a durable store during shutdown")

Also will be good to add a test that actually checks all three close() get called on shutdown (including a case where shutdown() itself raises), not just that MCPServer accepts the params.

[imran-siddique]

@rajnisht7, the CLI wiring and independent close attempts are needed. One constraint: shutdown() can raise SessionDrainIncomplete while a cancellation-resistant call remains active. Closing its stores then could prevent its final audit write.

Keep admission sealed and retain stores until their writers have stopped. Once safe, attempt every store close independently and preserve the original shutdown error.

Acceptance tests should cover production wiring, normal shutdown, one store-close failure, and incomplete drain followed by successful retry. The incomplete-drain case must prove the outstanding call can still persist its outcome.