Function map_bounded 

pub async fn map_bounded<T, R, F, Fut>(
    items: Vec<T>,
    limit: usize,
    work: F,
) -> Vec<IndexedResult<R>>
where
    T: Send + 'static,
    R: Send + 'static,
    F: Fn(T) -> Fut + Send + Sync + 'static,
    Fut: Future<Output = R> + Send + 'static,

Bounded map over independent I/O units.

Admission: Semaphore + acquire_owned before JoinSet::spawn, interleaved with join_next so completed tasks free permits (no deadlock).

Panic index (G-PAR-24)

Input indices are tracked by Tokio TaskId outside the task payload so a panicking unit still reports the correct IndexedResult::index (not usize::MAX). Callers that need to re-raise panics still use JoinError::is_panic.

Cancel safety

Not cancel-safe as a whole: dropping the future aborts the JoinSet (pending tasks cancelled). Individual unit futures should tolerate cancel if they hold remote resources (SSH disconnect on drop of client).

Cooperative cancel (G-PAR-39 / G-PAR-44)

• crate::signals::should_stop: stops admission (no new spawn_one); in-flight units drain cooperatively (units should poll should_stop).
• crate::signals::is_force_exit: JoinSet::abort_all then drain (same pattern as tunnel forwards). Aborted units surface as JoinError::is_cancelled.
• Units never admitted are omitted from the result vec (callers treat partial batch as cancelled remainder).