@fitchmultz/pi-subagents 0.50.0 → 0.51.0

package/dist/agent/process.js

@@ -4,28 +4,105 @@ import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import { setTimeout as delay } from "node:timers/promises";
-import { readChildProcessIdentity, trySignalChildTree } from "../shared/post-exit-stdio-guard.js";
-import { processSchema } from "./contracts.js";
-import { conversation, read, write } from "./storage.js";
-export function alive(identity) {
+import { isChildProcessReplaced, observeChildProcessReplaced, readChildProcessIdentity, readProcessClock, trySignalChildTree, } from "../shared/post-exit-stdio-guard.js";
+import { agentObservationSocketPath } from "../pi-intercom/broker/paths.js";
+import { hasErrorCode } from "../shared/unknown.js";
+import { attachmentSchema, processSchema } from "./contracts.js";
+import { conversation, enqueue, launchAt, list, read, write } from "./storage.js";
+import { errorText } from "./host.js";
+/** Owner records follow their process's birth; stat after read only moves the bound later. */
+export function published(file, record) {
+    return record && { ...record, published: fs.statSync(file, { throwIfNoEntry: false })?.mtimeMs };
+}
+/** Settles liveness without a birth lookup; undefined means compare the recorded birth. */
+function probe(identity) {
     try {
         process.kill(identity.pid, 0);
     }
     catch (error) {
-        if (error instanceof Error && "code" in error && error.code === "ESRCH") {
-            return false;
+        // EPERM still names a live PID, possibly another user's reuse; check its birth below.
+        if (!hasErrorCode(error, "EPERM")) {
+            return !hasErrorCode(error, "ESRCH");
         }
-        return true;
     }
-    const actual = readChildProcessIdentity(identity.pid);
-    return identity.identity === "unverified" || actual === undefined || actual === identity.identity;
+    return identity.identity === "unverified" ? true : undefined;
+}
+export function alive(identity) {
+    // Only a proven different birth disproves a live PID; ambiguous identities stay possibly owned.
+    return (probe(identity) ??
+        (readChildProcessIdentity(identity.pid) === identity.identity || !replaced(identity)));
+}
+/** Routine `alive` without waiting on `ps`; signals still use the synchronous proof. */
+export async function observeAlive(identities) {
+    const verdicts = [];
+    for (const claim of identities) {
+        // One `ps` at a time: each spawn briefly holds the event loop, so concurrent spawns add up.
+        const { pid, identity, clock } = claim;
+        verdicts.push(probe(claim) ??
+            // oxlint-disable-next-line no-await-in-loop
+            !(await observeChildProcessReplaced(pid, identity, claim.published, clock)));
+    }
+    return verdicts;
+}
+/**
+ * A child's routine parent check, one observation at a time. A dead parent detaches the child
+ * only while its check is current and the attachment generation is unchanged: a newer parent
+ * may adopt the child meanwhile.
+ */
+export class ParentCheck {
+    current;
+    /**
+     * Reads the attachment synchronously, so an unreadable one still fails the caller at once.
+     * Missing or released attachments detach immediately; a check in flight makes this a no-op.
+     */
+    check(file, detached) {
+        if (this.current !== undefined) {
+            return Promise.resolve();
+        }
+        const attachment = published(file, read(file, attachmentSchema));
+        if (attachment === undefined || !attachment.attached) {
+            detached();
+            return Promise.resolve();
+        }
+        const check = {};
+        this.current = check;
+        const settle = async () => {
+            try {
+                const [live] = await observeAlive([attachment]);
+                if (this.current === check &&
+                    !live &&
+                    read(file, attachmentSchema)?.generation === attachment.generation) {
+                    detached();
+                }
+            }
+            finally {
+                if (this.current === check) {
+                    this.current = undefined;
+                }
+            }
+        };
+        return settle();
+    }
+    /** A check settling later no longer acts. */
+    cancel() {
+        this.current = undefined;
+    }
+}
+function replaced(identity) {
+    return (identity.identity !== "unverified" &&
+        isChildProcessReplaced(identity.pid, identity.identity, identity.published, identity.clock));
 }
-export function ownIdentity() {
-    // An ordinary main need not be a group leader. Ambiguous live PIDs fail closed.
-    return { pid: process.pid, identity: readChildProcessIdentity(process.pid) ?? "unverified" };
+export function ownIdentity(pid = process.pid) {
+    // An ordinary main or managed launcher need not be a group leader. Ambiguous live PIDs fail closed.
+    return {
+        pid,
+        identity: readChildProcessIdentity(pid) ?? "unverified",
+        clock: readProcessClock(),
+    };
 }
 export function actor(base, launch) {
-    return read(path.join(conversation(base, launch), "actor.lock", "process.json"), processSchema);
+    const file = path.join(conversation(base, launch), "actor.lock", "process.json");
+    return published(file, read(file, processSchema));
 }
 function childEnvironment(launch) {
     const env = { ...process.env };
@@ -73,12 +150,14 @@ function spawnActor(base, launch, token) {
         pid: child.pid,
         identity: readChildProcessIdentity(child.pid) ?? "unverified",
         token,
+        clock: readProcessClock(),
     });
 }
-async function awaitStopping(dir, existing) {
+async function awaitStopping(dir, existing, signal) {
     if (existing && fs.existsSync(path.join(dir, `stopping-${existing.token}.json`))) {
         const deadline = Date.now() + 5000;
         while (alive(existing)) {
+            signal?.throwIfAborted();
             if (Date.now() > deadline) {
                 throw new Error("Previous actor is still stopping; no replacement was launched.");
             }
@@ -88,10 +167,11 @@ async function awaitStopping(dir, existing) {
         }
     }
 }
-export async function ensureActor(base, launch) {
+export async function ensureActor(base, launch, signal) {
     const dir = conversation(base, launch);
     const lock = path.join(dir, "actor.lock");
-    await awaitStopping(dir, actor(base, launch));
+    await awaitStopping(dir, actor(base, launch), signal);
+    signal?.throwIfAborted();
     // Another parallel tool may replace the claim while this invocation yields.
     const existing = actor(base, launch);
     if (existing && alive(existing)) {
@@ -101,6 +181,7 @@ export async function ensureActor(base, launch) {
         if (shells(base, launch, existing.token).some(alive)) {
             throw new Error("Owned native shell work remains live; stop it before continuing.");
         }
+        removeObservationEndpoint(existing.token);
         fs.rmSync(lock, { recursive: true });
     }
     try {
@@ -118,12 +199,25 @@ export async function ensureActor(base, launch) {
     write(path.join(lock, "claim.json"), { ...ownIdentity(), token });
     spawnActor(base, launch, token);
 }
-function verifyLiveness(pid) {
+/** A crashed generation cannot unlink its endpoint; its exact token names the leftover. */
+function removeObservationEndpoint(token) {
+    try {
+        const socketPath = agentObservationSocketPath(token);
+        if (fs.lstatSync(socketPath, { throwIfNoEntry: false })?.isSocket() === true) {
+            fs.rmSync(socketPath, { force: true });
+        }
+    }
+    catch {
+        // Observation leftovers are inert to a new token and must never block native work.
+    }
+}
+function verifyLiveness(identity) {
     try {
-        process.kill(pid, 0);
+        process.kill(identity.pid, 0);
     }
     catch (error) {
-        if (error instanceof Error && "code" in error && error.code === "ESRCH") {
+        // Another user's live PID is released only by the same proof as a signalable one.
+        if (hasErrorCode(error, "ESRCH") || (hasErrorCode(error, "EPERM") && replaced(identity))) {
             return false;
         }
         throw new Error("Actor liveness is ambiguous; no stop was sent.", { cause: error });
@@ -131,13 +225,19 @@ function verifyLiveness(pid) {
     return true;
 }
 export function verifyProcess(identity) {
-    if (!verifyLiveness(identity.pid)) {
+    if (!verifyLiveness(identity)) {
         return false;
     }
     const actual = readChildProcessIdentity(identity.pid);
-    if (identity.identity !== "unverified" && actual === undefined && !verifyLiveness(identity.pid)) {
-        // Native abort can reap a shell between the liveness probe and birth lookup.
-        return false;
+    if (identity.identity !== "unverified" && actual !== identity.identity) {
+        if (actual === undefined && !verifyLiveness(identity)) {
+            // Native abort can reap a shell between the liveness probe and birth lookup.
+            return false;
+        }
+        // A different-birth process at the PID proves the recorded process is gone.
+        if (replaced(identity)) {
+            return false;
+        }
     }
     if (identity.identity === "unverified" || actual !== identity.identity) {
         throw new Error("Cannot verify actor process identity; no signal sent.");
@@ -150,13 +250,86 @@ export function signalProcess(identity, signal) {
     }
     return trySignalChildTree({ pid: identity.pid, kill: (s) => process.kill(identity.pid, s) }, signal);
 }
+export function requestStop(base, launch, onError) {
+    const attempt = (operation) => {
+        try {
+            return operation();
+        }
+        catch (error) {
+            if (onError === undefined) {
+                throw error;
+            }
+            onError(error);
+            return false;
+        }
+    };
+    const identity = actor(base, launch);
+    const targets = identity ? [identity, ...shells(base, launch, identity.token)] : [];
+    // Interactive Stop validates the whole set; shutdown reports and skips only ambiguous targets.
+    const live = targets.filter((target) => attempt(() => verifyProcess(target)));
+    const command = identity && live.includes(identity)
+        ? enqueue(base, launch, "stop", { actorToken: identity.token })
+        : undefined;
+    if (identity && live.length > 0) {
+        write(path.join(conversation(base, launch), `stopping-${identity.token}.json`), {
+            at: Date.now(),
+        });
+    }
+    live.forEach((target) => {
+        attempt(() => signalProcess(target, "SIGTERM"));
+    });
+    return { targets: live, command };
+}
+export async function stopChildren(base, owner) {
+    const roots = new Set();
+    const targets = [];
+    for (const id of list(base)) {
+        try {
+            const launch = launchAt(base, id, owner);
+            if (!roots.has(launch.rootId)) {
+                roots.add(launch.rootId);
+                targets.push(...requestStop(base, launch, (error) => {
+                    console.error(`Child shutdown ${id}: ${errorText(error)}`);
+                }).targets);
+            }
+        }
+        catch (error) {
+            console.error(`Child shutdown ${id}: ${errorText(error)}`);
+        }
+    }
+    await waitForExit(targets, 3000);
+    for (const target of targets) {
+        try {
+            signalProcess(target, "SIGKILL");
+        }
+        catch (error) {
+            console.error(`Child shutdown ${target.pid}: ${errorText(error)}`);
+        }
+    }
+    await waitForExit(targets, 1000);
+    if (targets.some(alive)) {
+        console.error("Child shutdown could not confirm every owned process exit.");
+    }
+}
+async function waitForExit(targets, timeout) {
+    const deadline = Date.now() + timeout;
+    while (Date.now() < deadline && targets.some(alive)) {
+        // Join actual process exit while native abort persists the interrupted turn.
+        // oxlint-disable-next-line no-await-in-loop
+        await delay(25);
+    }
+}
 export function shells(base, launch, token) {
     const dir = path.join(conversation(base, launch), "shells", token);
     if (!fs.existsSync(dir)) {
         return [];
     }
-    return fs.readdirSync(dir).map((name) => {
-        const identity = read(path.join(dir, name), processSchema);
+    return fs
+        .readdirSync(dir)
+        .filter((name) => name.endsWith(".json"))
+        .map((name) => {
+        const file = path.join(dir, name);
+        const identity = published(file, read(file, processSchema));
         if (!identity || identity.token !== token) {
             throw new Error("Foreign or missing native shell identity.");
         }

package/dist/agent/receipts.js

@@ -1,6 +1,7 @@
 import * as fs from "node:fs";
 import { scanJournal } from "../shared/journal-frames.js";
-import { journalStamp } from "../shared/native-journal.js";
+import { journalStamp, nativeAppend } from "../shared/native-journal.js";
+import { isRecord } from "../shared/unknown.js";
 const detailFields = new Set([
     "owner",
     "id",
@@ -30,7 +31,7 @@ const receiptProjection = (keys) => {
     if (keys.length === 0) {
         return true;
     }
-    if (["type", "id", "customType"].includes(String(keys[0]))) {
+    if (["type", "id", "customType", "version"].includes(String(keys[0]))) {
         return keys.length === 1 ? 4096 : false;
     }
     if (keys[0] !== "message") {
@@ -44,32 +45,103 @@ const receiptProjection = (keys) => {
     }
     return detailsProjection(keys.slice(1));
 };
-/** Physical LF publication owns delivery, including when native memory is stale. */
-export function receiptId(file, owner, matches) {
-    if (file === undefined || !fs.existsSync(file)) {
-        return;
+const indexes = new Map();
+function toolCompletion(message) {
+    return isRecord(message) &&
+        message.role === "toolResult" &&
+        (message.toolName === "delegate" || message.toolName === "agent_runs") &&
+        isRecord(message.details) &&
+        message.details.receivedResult === true
+        ? message.details
+        : undefined;
+}
+function completionDetails(entry) {
+    if (entry.type === "custom_message" && entry.customType === "agent-completion") {
+        return entry.details;
+    }
+    return entry.type === "message" ? toolCompletion(entry.message) : undefined;
+}
+function addEntry(journal, entry) {
+    const header = journal.entries.at(0);
+    const owner = header?.type === "session" ? header.id : undefined;
+    const details = typeof owner === "string" ? completionDetails(entry) : undefined;
+    if (isRecord(details) &&
+        details.owner === owner &&
+        details.completed === true &&
+        typeof details.id === "string" &&
+        !journal.completions.has(details.id)) {
+        journal.completions.set(details.id, typeof entry.id === "string" ? entry.id : undefined);
+    }
+    journal.entries.push(entry);
+}
+function prefix(stat, cached) {
+    return cached && nativeAppend(cached.stat, stat, cached.entries[0])
+        ? cached
+        : { end: 0, entries: [], completions: new Map() };
+}
+function index(file, observed) {
+    const cached = indexes.get(file);
+    if (cached?.stamp === journalStamp(observed)) {
+        return cached;
     }
     const fd = fs.openSync(file, "r");
-    let first = true;
-    let owned = false;
-    let found;
     try {
-        const stamp = journalStamp(fs.fstatSync(fd, { bigint: true }));
-        scanJournal(fd, receiptProjection, ({ value }) => {
-            if (first) {
-                first = false;
-                owned = value.type === "session" && value.id === owner;
-            }
-            else if (owned && found === undefined && typeof value.id === "string" && matches(value)) {
-                found = value.id;
-            }
-        }, { policy: "live", requireNewline: true });
+        const stat = fs.fstatSync(fd, { bigint: true });
+        const stamp = journalStamp(stat);
+        if (cached?.stamp === stamp) {
+            return cached;
+        }
+        const retained = prefix(stat, cached);
+        const appended = [];
+        const end = scanJournal(fd, receiptProjection, ({ value }) => {
+            appended.push(value);
+        }, {
+            policy: "live",
+            requireNewline: true,
+            start: retained.end,
+        });
         if (journalStamp(fs.fstatSync(fd, { bigint: true })) !== stamp) {
             throw new Error("Native receipt journal changed while reading.");
         }
-        return found;
+        for (const entry of appended) {
+            addEntry(retained, entry);
+        }
+        const result = { ...retained, stamp, end, stat };
+        indexes.delete(file);
+        indexes.set(file, result);
+        if (indexes.size > 8) {
+            const oldest = indexes.keys().next().value;
+            if (oldest !== undefined) {
+                indexes.delete(oldest);
+            }
+        }
+        return result;
+    }
+    catch (error) {
+        indexes.delete(file);
+        throw error;
     }
     finally {
         fs.closeSync(fd);
     }
 }
+/** Physical LF publication owns delivery, including when native memory is stale. */
+function owned(file, owner) {
+    const stat = file === undefined ? undefined : fs.statSync(file, { bigint: true, throwIfNoEntry: false });
+    if (file === undefined || stat === undefined) {
+        return;
+    }
+    const journal = index(file, stat);
+    const header = journal.entries.at(0);
+    return header?.type === "session" && header.id === owner ? journal : undefined;
+}
+export function receiptId(file, owner, matches) {
+    const found = owned(file, owner)?.entries.find((entry) => entry.type !== "session" && matches(entry));
+    return typeof found?.id === "string" ? found.id : undefined;
+}
+/** Live read-only completion IDs by run; later appends extend this view.
+ * A matching entry without an ID is unpublished. Invalidations replace the view.
+ */
+export function completionReceipts(file, owner) {
+    return owned(file, owner)?.completions ?? new Map();
+}

package/dist/agent/runner.js

@@ -1,12 +1,25 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { setTimeout as delay } from "node:timers/promises";
-import { attachmentSchema, commandSchema, } from "./contracts.js";
-import { launchAt, read, runDirectory, write } from "./storage.js";
-import { alive, ownIdentity, shellCommand } from "./process.js";
+import { commandSchema } from "./contracts.js";
+import { launchAt, missing, read, runDirectory, write } from "./storage.js";
+import { ownIdentity, ParentCheck, shellCommand, shells, signalProcess } from "./process.js";
 import { errorText, loadSDK } from "./host.js";
 import { childUsage } from "./usage.js";
 import { initializeCwd, localCwdOwner } from "./cwd.js";
+import { ActorObservation } from "./observation.js";
+import { DirectoryWatch, Wake } from "./wake.js";
+function commandIdentity(file) {
+    try {
+        const stat = fs.statSync(file, { bigint: true });
+        return `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`;
+    }
+    catch (error) {
+        if (missing(error)) {
+            return;
+        }
+        throw error;
+    }
+}
 function completionStatus(stopping, message, error) {
     if (stopping || message?.stopReason === "aborted") {
         return "stopped";
@@ -36,10 +49,20 @@ function guard(pi, directory, token) {
 class Actor {
     active;
     stopping = false;
+    stopDeadline;
+    nextParentCheck = 0;
+    parent = new ParentCheck();
+    // Raised when durable commands may need admission: change hints and stop.
+    wake = new Wake();
+    // A deferred run waits for an idle session, which has no command-file event.
+    retry = false;
     current;
     errors = [];
     started = new Set();
+    // Actor-local validation metadata only; never retain command prompts or receipt authority.
+    validated = new Map();
     session;
+    observation;
     context;
     base;
     initial;
@@ -133,6 +156,11 @@ class Actor {
                             pi.on("session_start", (_event, ctx) => {
                                 this.context = { pi, ctx };
                             });
+                            // Sparse tool lifecycle keeps the live view's tools even while nobody watches.
+                            const tool = (event) => this.observation?.tool(event);
+                            pi.on("tool_execution_start", tool);
+                            pi.on("tool_execution_update", tool);
+                            pi.on("tool_execution_end", tool);
                         },
                     ],
                 },
@@ -158,12 +186,39 @@ class Actor {
         };
     }
     stop = () => {
-        write(path.join(this.dir, "stop-acknowledged.json"), { at: Date.now(), id: this.current?.id });
+        if (this.stopping) {
+            return;
+        }
         this.stopping = true;
+        this.wake.raise();
+        write(path.join(this.dir, `stopping-${this.token}.json`), { at: Date.now() });
+        write(path.join(this.dir, "stop-acknowledged.json"), { at: Date.now(), id: this.current?.id });
         this.session?.abort().catch((error) => {
             this.errors.push(errorText(error));
         });
+        this.stopShells("SIGTERM");
+        // Parent death leaves no parent-side escalation timer to stop an uncooperative tool.
+        this.stopDeadline = setTimeout(() => {
+            this.stopShells("SIGKILL");
+            process.exit(1);
+        }, 3000);
+        this.stopDeadline.unref();
     };
+    stopShells(signal) {
+        try {
+            for (const identity of shells(this.base, this.initial, this.token)) {
+                try {
+                    signalProcess(identity, signal);
+                }
+                catch (error) {
+                    this.errors.push(errorText(error));
+                }
+            }
+        }
+        catch (error) {
+            this.errors.push(errorText(error));
+        }
+    }
     run(launch) {
         const session = this.session;
         if (!session) {
@@ -171,6 +226,7 @@ class Actor {
         }
         this.current = launch;
         const baseline = new Set(session.sessionManager.getEntries().map((entry) => entry.id));
+        this.observation?.working(true);
         this.active = (async () => {
             try {
                 if (launch.provider !== this.initial.provider ||
@@ -188,6 +244,7 @@ class Actor {
             finally {
                 this.active = undefined;
                 this.current = undefined;
+                this.observation?.working(false);
             }
         })();
     }
@@ -219,6 +276,7 @@ class Actor {
         }
         if (command.action === "run" &&
             (this.stopping || this.active !== undefined || !session.isIdle)) {
+            this.retry = true;
             return;
         }
         this.started.add(command.id);
@@ -263,6 +321,22 @@ class Actor {
             timestamp: Date.now(),
         });
     }
+    pendingCommand(file) {
+        const identity = commandIdentity(file);
+        const cached = this.validated.get(file);
+        if (identity !== undefined &&
+            cached?.identity === identity &&
+            fs.existsSync(path.join(this.dir, "admissions", `${cached.id}.json`))) {
+            return;
+        }
+        this.validated.delete(file);
+        const command = read(file, commandSchema);
+        // A replacement during validation must not inherit the old body's validated identity.
+        if (command && identity !== undefined && commandIdentity(file) === identity) {
+            this.validated.set(file, { identity, id: command.id });
+        }
+        return command;
+    }
     pending() {
         const dir = path.join(this.dir, "commands");
         fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
@@ -270,23 +344,47 @@ class Actor {
             .readdirSync(dir)
             .filter((file) => file.endsWith(".json"))
             .flatMap((file) => {
-            const command = read(path.join(dir, file), commandSchema);
+            const command = this.pendingCommand(path.join(dir, file));
             return command ? [command] : [];
         })
             .sort((a, b) => a.createdAt - b.createdAt);
     }
     shouldExit() {
-        if (this.active !== undefined) {
-            return false;
+        const now = performance.now();
+        if (!this.stopping && now >= this.nextParentCheck) {
+            this.nextParentCheck = now + 1000;
+            // One observation at a time; a slow one keeps the regular schedule.
+            const file = path.join(this.base, "attachment.json");
+            this.parent.check(file, this.stop).catch((error) => {
+                this.errors.push(errorText(error));
+            });
         }
-        if (this.stopping) {
-            return true;
+        return this.stopping && this.active === undefined && (this.session?.isIdle ?? true);
+    }
+    /** Durable command readiness, not elapsed time, defines admission. */
+    async admitCommands() {
+        // Queued commands create this directory; otherwise pending() does and the next pass arms.
+        const directory = path.join(this.dir, "commands");
+        const commands = new DirectoryWatch(directory, () => true, this.wake.raise);
+        try {
+            while (!this.shouldExit()) {
+                // Each liveness tick also rechecks the directory for change hints the OS dropped.
+                const watch = commands.ensure();
+                if ((this.wake.take() || this.retry || watch !== "watching") && !this.stopping) {
+                    this.retry = false;
+                    this.pending().forEach((command) => this.accept(command));
+                }
+                const polling = this.retry || this.stopping || watch === "unwatched";
+                const tick = Math.max(1, this.nextParentCheck - performance.now());
+                // oxlint-disable-next-line no-await-in-loop
+                await this.wake.sleep(polling ? 100 : tick);
+            }
         }
-        if (this.session && (!this.session.isIdle || this.session.pendingMessageCount > 0)) {
-            return false;
+        finally {
+            // A verdict settling after the loop ends must not act.
+            this.parent.cancel();
+            commands.close();
         }
-        const attachment = read(path.join(this.base, "attachment.json"), attachmentSchema);
-        return attachment === undefined || !attachment.attached || !alive(attachment);
     }
     failure(error) {
         const launch = this.current ?? this.initial;
@@ -327,6 +425,12 @@ class Actor {
             if (this.initial.name !== undefined) {
                 this.session.sessionManager.appendSessionInfo(this.initial.name);
             }
+            // Optional live view, bound before readiness; its faults never change native execution.
+            this.observation = await ActorObservation.open(this.session, {
+                token: this.token,
+                rootId: this.initial.rootId,
+                sessionId: this.session.sessionManager.getSessionId(),
+            });
             write(path.join(this.dir, "actor.lock", "process.json"), {
                 ...ownIdentity(),
                 token: this.token,
@@ -339,12 +443,7 @@ class Actor {
             });
             process.on("SIGTERM", this.stop);
             process.on("SIGINT", this.stop);
-            do {
-                this.pending().forEach((command) => this.accept(command));
-                // Durable command readiness, not elapsed time, defines admission.
-                // oxlint-disable-next-line no-await-in-loop
-                await delay(100);
-            } while (!this.shouldExit());
+            await this.admitCommands();
             await this.active;
         }
         catch (error) {
@@ -353,10 +452,16 @@ class Actor {
         finally {
             process.off("SIGTERM", this.stop);
             process.off("SIGINT", this.stop);
+            const observation = this.observation?.close();
             await runtime?.dispose();
+            if (this.stopping) {
+                this.stopShells("SIGKILL");
+            }
+            clearTimeout(this.stopDeadline);
             write(path.join(this.dir, `shutdown-${this.token}.json`), {
                 at: Date.now(),
                 errors: this.errors,
+                ...(observation === undefined ? {} : { observation }),
             });
             // Keep the process claim until a launcher proves this exact actor is gone.
         }