@gmickel/gno 2.9.0 → 2.9.2

package/README.md

@@ -139,7 +139,7 @@ See the [guide](docs/COMPILED-CONTEXT.md).
 
 <!-- public-truth:current-version -->
 
-> Current source version: **v2.9.0**. See [CHANGELOG.md](./CHANGELOG.md).
+> Current source version: **v2.9.2**. See [CHANGELOG.md](./CHANGELOG.md).
 
 <!-- /public-truth -->
 

package/browser-extension/artifacts/gno-browser-clipper-v2.9.2.zip.sha256

@@ -0,0 +1 @@
+7073229377bafdffb9fb4834e22fe4531e68afcf615c19c1bb021c205997375a  gno-browser-clipper-v2.9.2.zip

package/browser-extension/dist/manifest.json

@@ -21,5 +21,5 @@
   "content_security_policy": {
     "extension_pages": "script-src 'self'; object-src 'none'; connect-src http://127.0.0.1:*"
   },
-  "version": "2.9.0"
+  "version": "2.9.2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gmickel/gno",
-  "version": "2.9.0",
+  "version": "2.9.2",
   "description": "Local semantic search for your documents. Index Markdown, PDF, and Office files with hybrid BM25 + vector search.",
   "keywords": [
     "embeddings",
@@ -90,6 +90,7 @@
     "test:watcher:filesystem": "bun test test/serve/watch-service-filesystem.test.ts test/serve/resident-runtime.test.ts",
     "bench:watcher-reconciliation": "bun scripts/watcher-reconciliation-benchmark.ts",
     "bench:session-import": "bun scripts/session-import-benchmark.ts",
+    "soak": "bun scripts/soak/index.ts",
     "smoke:watcher-reconciliation": "bun scripts/watcher-reconciliation-smoke.ts",
     "bench:code-embeddings": "bun scripts/code-embedding-benchmark.ts",
     "bench:code-embeddings:write": "bun scripts/code-embedding-benchmark.ts --write",

package/spec/cli.md

@@ -1079,6 +1079,9 @@ gno embed [collection] [--collection <name>] [--force] [--model <uri>] [--batch-
 ]
 ````
 
+`updateCmdTimeoutMs` (milliseconds) appears when the collection sets a limit
+for `updateCmd`; without it the command is stopped after 10 minutes.
+
 **Exit Codes:**
 
 - 0: Success

package/spec/output-schemas/collection-list.schema.json

@@ -36,6 +36,11 @@
         "type": "string",
         "description": "Optional shell command to run before indexing"
       },
+      "updateCmdTimeoutMs": {
+        "type": "integer",
+        "minimum": 1,
+        "description": "Optional limit for updateCmd in milliseconds; gno stops the command (and anything it started) after this long. Absent means the 10 minute default."
+      },
       "languageHint": {
         "type": "string",
         "description": "BCP-47 language hint for the collection"

package/src/cli/commands/daemon.ts

@@ -10,6 +10,8 @@ import {
   EGRESS_DENIED_MESSAGE,
   EgressDeniedError,
 } from "../../core/egress-enforcement";
+import { markResidentShutdownHandlerInstalled } from "../../core/resident-shutdown-handler";
+import { sighupHandlerAllowed } from "../../core/sighup-disposition";
 import {
   DEFAULT_HTTP_GATEWAY_PORT,
   isHttpGatewayLoopbackBind,
@@ -164,6 +166,7 @@ function createSignalPromise(
       signal?.removeEventListener("abort", onAbort);
       process.off("SIGINT", onSigint);
       process.off("SIGTERM", onSigterm);
+      process.off("SIGHUP", onSighup);
       if (message && !quiet) {
         logger.log(message);
       }
@@ -174,10 +177,16 @@ function createSignalPromise(
     const onSigint = (): void => complete("Received SIGINT. Shutting down...");
     const onSigterm = (): void =>
       complete("Received SIGTERM. Shutting down...");
+    // A closed terminal or logout: shut down cleanly, as on SIGTERM, unless
+    // SIGHUP was ignored at start (nohup), which must keep working.
+    const handleSighup = sighupHandlerAllowed();
+    const onSighup = (): void => complete("Received SIGHUP. Shutting down...");
 
     signal?.addEventListener("abort", onAbort, { once: true });
     process.once("SIGINT", onSigint);
     process.once("SIGTERM", onSigterm);
+    if (handleSighup) process.once("SIGHUP", onSighup);
+    markResidentShutdownHandlerInstalled();
   });
 }
 

package/src/cli/detach.ts

@@ -510,6 +510,17 @@ function acquireStartLock(pidFile: string, kind: DetachKind): string {
   );
 }
 
+/** Take the start lock if it is free right now; null when someone holds it. */
+function tryAcquireStartLock(pidFile: string): string | null {
+  const lockPath = startLockPath(pidFile);
+  try {
+    closeSync(openSync(lockPath, "wx", 0o600));
+    return lockPath;
+  } catch {
+    return null;
+  }
+}
+
 function releaseStartLock(lockPath: string): void {
   try {
     unlinkSync(lockPath);
@@ -943,12 +954,35 @@ async function waitForExit(
 /**
  * Stop a detached process: SIGTERM → poll → SIGKILL → poll → error.
  *
- * The pid-file is **not** unlinked on success by this helper — we let the
- * target's own signal handler clean it up (see `createSignalPromise` in
- * `src/cli/commands/daemon.ts`). Callers may unlink the file as a fallback
- * when liveness is `false` after the kill sequence; `stopProcess` itself only
- * unlinks stale pid-files it discovers on entry.
+ * The target's own signal handler normally removes the pid-file. A target
+ * killed before that handler existed (SIGTERM during early startup, or the
+ * SIGKILL escalation) cannot, so once the exit is confirmed this helper
+ * removes the pid-file if it still names the pid it stopped.
+ */
+/**
+ * Remove the pid-file only if it still names `pid` (never a newer instance's).
+ * The check and the unlink run under the start lock, so a concurrent
+ * `--detach` cannot write its pid-file in between. If a start holds the lock,
+ * the file is left alone: `guardDoubleStart` already treats a dead pid as
+ * stale.
  */
+async function removePidFileIfOwnedBy(
+  pidFile: string,
+  pid: number
+): Promise<void> {
+  const lockPath = tryAcquireStartLock(pidFile);
+  if (!lockPath) return;
+  try {
+    const current = await readPidFile(pidFile).catch(() => null);
+    if (current?.pid !== pid) return;
+    await unlink(pidFile).catch(() => {
+      /* already gone */
+    });
+  } finally {
+    releaseStartLock(lockPath);
+  }
+}
+
 export async function stopProcess(options: StopOptions): Promise<StopOutcome> {
   const timeoutMs = options.timeoutMs ?? RESIDENT_STOP_GRACE_MS;
   const pollIntervalMs = options.pollIntervalMs ?? 100;
@@ -1004,6 +1038,7 @@ export async function stopProcess(options: StopOptions): Promise<StopOutcome> {
     sleep
   );
   if (exitedOnSigterm) {
+    await removePidFileIfOwnedBy(options.pidFile, payload.pid);
     return { kind: "stopped", pid: payload.pid, signal: "SIGTERM" };
   }
 
@@ -1011,6 +1046,7 @@ export async function stopProcess(options: StopOptions): Promise<StopOutcome> {
     kill(payload.pid, "SIGKILL");
   } catch (error) {
     if (isErrnoException(error) && error.code === "ESRCH") {
+      await removePidFileIfOwnedBy(options.pidFile, payload.pid);
       return { kind: "stopped", pid: payload.pid, signal: "SIGTERM" };
     }
     throw error;
@@ -1025,6 +1061,7 @@ export async function stopProcess(options: StopOptions): Promise<StopOutcome> {
     sleep
   );
   if (exitedOnSigkill) {
+    await removePidFileIfOwnedBy(options.pidFile, payload.pid);
     return { kind: "stopped", pid: payload.pid, signal: "SIGKILL" };
   }
 

package/src/cli/program.ts

@@ -25,6 +25,7 @@ import {
   formatFindingsRunStatusLine,
   readFindingsRunStatus,
 } from "../core/findings-run-state";
+import { residentShutdownHandlerInstalled } from "../core/resident-shutdown-handler";
 import { parseAndValidateTagFilter } from "../core/tags";
 import {
   formatWriteLeaseBusyJson,
@@ -5564,8 +5565,16 @@ function installPidFileCleanup(pidFile: string): void {
       // Already gone or permission-denied — nothing actionable here.
     }
   };
-  process.once("SIGINT", cleanup);
-  process.once("SIGTERM", cleanup);
+  // Registering a listener disables the default terminate action. A signal
+  // that arrives before the daemon/server installs its own shutdown handler
+  // (still starting up) would otherwise be swallowed, and `--stop` would wait
+  // out its grace period and SIGKILL. Until that handler exists, exit now.
+  const onSignal = (exitCode: number) => () => {
+    cleanup();
+    if (!residentShutdownHandlerInstalled()) process.exit(exitCode);
+  };
+  process.once("SIGINT", onSignal(130));
+  process.once("SIGTERM", onSignal(143));
   // Also run on a clean (`exit(0)`) path so crashes leave a stale pid-file
   // that `--status` can detect via liveness check, but orderly shutdown
   // (e.g. startServer returned) still cleans up.

package/src/config/types.ts

@@ -138,6 +138,9 @@ export const CollectionSchema = z.object({
   /** Optional shell command to run before indexing */
   updateCmd: z.string().optional(),
 
+  /** Kill `updateCmd` (and anything it started) after this long; default 10 min */
+  updateCmdTimeoutMs: z.number().int().positive().optional(),
+
   /** Optional BCP-47 language hint */
   languageHint: z
     .string()

package/src/core/project-profile-apply-state.ts

@@ -78,6 +78,9 @@ export function applyProjectProfileDesiredState(
     include: [],
     exclude: desired.collection.exclude,
     ...(existing?.updateCmd ? { updateCmd: existing.updateCmd } : {}),
+    ...(existing?.updateCmdTimeoutMs
+      ? { updateCmdTimeoutMs: existing.updateCmdTimeoutMs }
+      : {}),
     ...(desired.collection.languageHint
       ? { languageHint: desired.collection.languageHint }
       : existing?.languageHint

package/src/core/resident-shutdown-handler.ts

@@ -0,0 +1,23 @@
+/**
+ * Whether this process's resident (serve or daemon) has installed its own
+ * SIGINT/SIGTERM shutdown handler.
+ *
+ * A detached resident registers a pid-file cleanup listener before startup,
+ * and registering any listener disables the default terminate action. Until
+ * the resident's handler exists, that cleanup listener must exit the process
+ * itself, or a stop sent during startup is swallowed. Counting listeners
+ * cannot tell: the CLI bootstrap and the file processor add their own.
+ *
+ * @module src/core/resident-shutdown-handler
+ */
+
+let installed = false;
+
+/** Called by serve and the daemon right after registering their handlers. */
+export function markResidentShutdownHandlerInstalled(): void {
+  installed = true;
+}
+
+export function residentShutdownHandlerInstalled(): boolean {
+  return installed;
+}

package/src/core/sighup-disposition.ts

@@ -0,0 +1,66 @@
+/**
+ * Whether a resident may take over SIGHUP (fn-210).
+ *
+ * Registering any SIGHUP listener replaces the inherited disposition, so a
+ * resident started under `nohup` (or `trap '' HUP`) would start shutting down
+ * when its terminal closes. The disposition is read once with sigaction(2):
+ * if SIGHUP was ignored at start, it stays ignored. When it cannot be read
+ * (Windows, no FFI), the default is kept and no handler is installed.
+ *
+ * @module src/core/sighup-disposition
+ */
+
+const SIGHUP = 1;
+/** `SIG_IGN` is handler value 1 on Linux and macOS. */
+const SIG_IGN = 1n;
+/** Comfortably larger than `struct sigaction` on Linux and macOS. */
+const SIGACTION_BYTES = 256;
+const LIBC_NAMES: Record<string, string[]> = {
+  linux: ["libc.so.6", "libc.so"],
+  darwin: ["libc.dylib", "libSystem.B.dylib"],
+};
+
+let cached: boolean | undefined;
+
+function readSighupIgnored(): boolean | null {
+  const names = LIBC_NAMES[process.platform];
+  if (!names) return null;
+  try {
+    // bun:ffi is built into Bun (no native dependency).
+    const { dlopen, FFIType, ptr } =
+      require("bun:ffi") as typeof import("bun:ffi");
+    for (const name of names) {
+      try {
+        const libc = dlopen(name, {
+          sigaction: {
+            args: [FFIType.i32, FFIType.ptr, FFIType.ptr],
+            returns: FFIType.i32,
+          },
+        });
+        try {
+          const old = new BigUint64Array(SIGACTION_BYTES / 8);
+          if (libc.symbols.sigaction(SIGHUP, null, ptr(old)) !== 0) return null;
+          // The handler is the first member of struct sigaction on both.
+          return old[0] === SIG_IGN;
+        } finally {
+          libc.close();
+        }
+      } catch {
+        // Try the next library name.
+      }
+    }
+  } catch {
+    // No FFI in this runtime.
+  }
+  return null;
+}
+
+/**
+ * True when SIGHUP was not ignored at start and its disposition is known, so
+ * a resident can shut down gracefully on it. Read before any SIGHUP listener
+ * is installed; the answer is cached.
+ */
+export function sighupHandlerAllowed(): boolean {
+  if (cached === undefined) cached = readSighupIgnored() === false;
+  return cached;
+}

package/src/core/time-slice.ts

@@ -0,0 +1,34 @@
+/**
+ * Cooperative time slicing for long synchronous work on a resident's main
+ * thread.
+ *
+ * Bun runs SQLite synchronously, so a loop of store calls never lets the
+ * event loop serve a request until it ends, however many `await`s it
+ * contains (they resolve as microtasks). Call `maybeYield()` between units of
+ * work: once the current slice has run longer than its budget, it yields a
+ * macrotask turn so pending requests (status, search) are answered.
+ *
+ * @module src/core/time-slice
+ */
+
+/** Longest a slice runs before yielding; keeps status well under 100 ms. */
+export const DEFAULT_TIME_SLICE_MS = 20;
+
+export interface TimeSlicer {
+  /** Yield to the event loop if the current slice is over budget. */
+  maybeYield(): Promise<void>;
+}
+
+export function createTimeSlicer(
+  budgetMs = DEFAULT_TIME_SLICE_MS,
+  now: () => number = performance.now.bind(performance)
+): TimeSlicer {
+  let sliceStart = now();
+  return {
+    async maybeYield() {
+      if (now() - sliceStart < budgetMs) return;
+      await new Promise<void>((resolve) => setImmediate(resolve));
+      sliceStart = now();
+    },
+  };
+}

package/src/ingestion/graph-reconciliation.ts

@@ -19,6 +19,7 @@ import {
   normalizeWikiName,
   parseTargetParts,
 } from "../core/links";
+import { createTimeSlicer } from "../core/time-slice";
 import {
   createInMemoryWorkspaceResolver,
   membershipsFromCollectionRows,
@@ -137,6 +138,9 @@ function relationResolver(
   };
 }
 
+/** Changed identities per incoming-link lookup (one statement each). */
+const INCOMING_LINK_CHUNK = 8;
+
 export async function projectGraph(
   store: StorePort,
   options: SyncOptions,
@@ -144,6 +148,7 @@ export async function projectGraph(
   forceFull = false
 ): Promise<ProjectionError[]> {
   const errors: ProjectionError[] = [];
+  const slicer = createTimeSlicer();
   try {
     const graph = store.graphReferenceStore?.();
     let fingerprint = "";
@@ -221,10 +226,16 @@ export async function projectGraph(
       // No durable per-source link journal exists; conservatively rebuild in that case.
       if (changed.size === 0 && state.dirty) selected = undefined;
       else {
-        for (const id of graph.incomingLinkSources(
-          [...changed.values()].flat()
-        ))
-          selected.add(id);
+        // One statement over every changed identity scales with links x
+        // targets and cannot yield; chunk it so the event loop gets turns.
+        const identities = [...changed.values()].flat();
+        for (let i = 0; i < identities.length; i += INCOMING_LINK_CHUNK) {
+          await slicer.maybeYield();
+          for (const id of graph.incomingLinkSources(
+            identities.slice(i, i + INCOMING_LINK_CHUNK)
+          ))
+            selected.add(id);
+        }
         const resolveOld = relationResolver(
           previous.map((row) => row.document),
           memberships
@@ -264,7 +275,10 @@ export async function projectGraph(
       );
       if (!backfill.ok) throw new Error(backfill.error.message);
       for (const [index, doc] of targets.entries()) {
+        // Every 25 documents at least, and sooner when slow documents
+        // (large link resolution) would hold the event loop past its budget.
         if (index > 0 && index % 25 === 0) await Bun.sleep(0);
+        else await slicer.maybeYield();
         if (!doc.active) {
           const cleared = await store.setDocEdges(
             doc.id,

package/src/ingestion/sync.ts

@@ -229,11 +229,73 @@ async function gitPull(path: string): Promise<void> {
 /**
  * Run collection update command (best effort).
  */
-async function runUpdateCmd(path: string, cmd: string): Promise<void> {
+/** Default cap on a collection's updateCmd; `updateCmdTimeoutMs` overrides it. */
+export const UPDATE_CMD_TIMEOUT_MS = 10 * 60_000;
+/**
+ * POSIX wrapper run as `sh -c WRAPPER sh <updateCmd>` in a new process group
+ * (detached spawn). It runs the command with stdin from /dev/null and blocks
+ * a subshell on gno's stdin pipe: when gno exits or is killed, by any signal
+ * including SIGKILL, the pipe closes and the subshell stops the whole group,
+ * so no part of the command (a hung `git` or `rsync`) outlives gno; anything
+ * still running 5 s after SIGTERM gets SIGKILL. The pipe goes through fd 3
+ * because an asynchronous list's stdin is /dev/null.
+ */
+const UPDATE_CMD_WRAPPER = [
+  "exec 3<&0",
+  '"$0" -c "$1" </dev/null 3<&- &',
+  "cmd=$!",
+  // The watcher ignores the TERM it sends, gives the command up to 5 s to
+  // exit, then SIGKILLs whatever is left of the group (itself included).
+  [
+    "( trap '' TERM; read -r _ <&3; kill -TERM 0",
+    'i=0; while kill -0 "$cmd" 2>/dev/null && [ "$i" -lt 10 ]; do sleep 0.5; i=$((i + 1)); done',
+    "kill -KILL 0 ) &",
+  ].join("; "),
+  "exec 3<&-",
+  'wait "$cmd"',
+].join("\n");
+
+async function runUpdateCmd(
+  path: string,
+  cmd: string,
+  timeoutMs = UPDATE_CMD_TIMEOUT_MS
+): Promise<void> {
+  const posix = process.platform !== "win32";
+  let child: Bun.Subprocess<"pipe", "ignore", "ignore">;
   try {
-    await Bun.$`sh -c ${cmd}`.cwd(path).quiet().nothrow();
+    child = Bun.spawn({
+      cmd: posix
+        ? ["sh", "-c", UPDATE_CMD_WRAPPER, "sh", cmd]
+        : ["sh", "-c", cmd],
+      cwd: path,
+      stdin: "pipe",
+      stdout: "ignore",
+      stderr: "ignore",
+      detached: posix,
+    });
   } catch {
-    // Ignore update command failures
+    // Ignore update command failures (no shell, bad cwd).
+    return;
+  }
+  const signalAll = (signal: NodeJS.Signals): void => {
+    try {
+      if (posix) process.kill(-child.pid, signal);
+      else child.kill(signal);
+    } catch {
+      // already gone
+    }
+  };
+  // On timeout, TERM the group. POSIX: that ends the wrapper, the finally
+  // below closes the lifeline, and the wrapper's watcher escalates whatever
+  // ignores TERM to SIGKILL. On Windows SIGTERM already terminates.
+  const timer = setTimeout(() => signalAll("SIGTERM"), timeoutMs);
+  try {
+    // Ignore update command failures (non-zero exit, timeout).
+    await child.exited;
+  } finally {
+    clearTimeout(timer);
+    // Closing the lifeline also reaps anything the command left running.
+    await Promise.resolve(child.stdin.end()).catch(() => undefined);
   }
 }
 
@@ -1605,7 +1667,11 @@ export class SyncService {
         caller: { authenticated: true, operationAuthorized: true },
         contentClass: "source",
       });
-      await runUpdateCmd(collection.path, collection.updateCmd);
+      await runUpdateCmd(
+        collection.path,
+        collection.updateCmd,
+        collection.updateCmdTimeoutMs
+      );
     }
 
     if (options.gitPull && (await isGitRepo(collection.path))) {

package/src/serve/parent-lifeline.ts

@@ -0,0 +1,44 @@
+/**
+ * Parent lifeline for a resident started by another process (fn-207).
+ *
+ * A launcher that owns `gno serve` (the desktop shell) sets
+ * `GNO_PARENT_LIFELINE=stdin` and keeps a pipe on the child's stdin open.
+ * When the launcher exits or is killed, even with SIGKILL, the kernel closes
+ * that pipe; stdin reaches EOF and the resident shuts down as on SIGTERM.
+ * Event-driven on every platform, with no polling timer. Without the opt-in a
+ * resident keeps running when its parent goes away (e.g. `nohup gno serve`).
+ *
+ * @module src/serve/parent-lifeline
+ */
+
+export const PARENT_LIFELINE_ENV = "GNO_PARENT_LIFELINE";
+
+/**
+ * When the launcher opted in, call `onLost` once stdin reaches EOF. Returns a
+ * stop function that cancels the watch (normal shutdown). The opt-in is
+ * removed from the environment so this process's own children never inherit
+ * it.
+ */
+export function watchParentLifeline(onLost: () => void): () => void {
+  const mode = process.env[PARENT_LIFELINE_ENV];
+  delete process.env[PARENT_LIFELINE_ENV];
+  if (mode !== "stdin") return () => undefined;
+
+  let stopped = false;
+  const reader = Bun.stdin.stream().getReader();
+  void (async () => {
+    try {
+      // The launcher never writes; any bytes are drained and ignored.
+      while (!(await reader.read()).done) {
+        // keep reading until EOF
+      }
+    } catch {
+      // A read error means the pipe is gone, the same as EOF.
+    }
+    if (!stopped) onLost();
+  })();
+  return () => {
+    stopped = true;
+    void reader.cancel().catch(() => undefined);
+  };
+}

package/src/serve/resident-runtime.ts

@@ -209,6 +209,7 @@ export type ResidentRuntimeDeps = {
     callbacks?: CollectionWatchCallbacks;
     syncOptions?: Parameters<typeof withContentTypeRules>[0];
     acquireWriteLease?: () => Promise<(() => Promise<void>) | null>;
+    reconcileOnStart?: boolean;
   }) => CollectionWatchService;
   modelManagerFactory?: (config: Config) => ModelManager;
 };
@@ -392,6 +393,8 @@ export async function startResidentRuntime(
     },
     syncOptions: withContentTypeRules({}, initialConfig),
     acquireWriteLease: leaseFor(`gno ${mode} (watch sync)`),
+    // serve has no initial sync of its own; the daemon runs one unless told not to.
+    reconcileOnStart: mode === "serve",
   });
   watchService.start();
   // A backlog left by `--no-embed` or an earlier run gets a pass without
@@ -502,8 +505,24 @@ export async function startResidentRuntime(
     indexName: canonicalizeIndexName(options.index ?? DEFAULT_INDEX_NAME),
   };
   let configRefresh: Promise<void> | undefined;
+  // Every read request refreshes the config. Re-reading and re-parsing an
+  // unchanged file each time kept the main thread busy under load; skip it
+  // while the file's identity, size and times match the last good load. Any
+  // write, rename, chmod or delete changes the stamp, so a broken file is
+  // still reported, never served stale.
+  let loadedConfigStamp: string | undefined;
+  const configStamp = async (): Promise<string | undefined> => {
+    try {
+      const stat = await Bun.file(instance.configPath).stat();
+      return `${stat.ino}:${stat.size}:${stat.mtimeMs}:${stat.ctimeMs}`;
+    } catch {
+      return undefined;
+    }
+  };
   const refreshConfig = (): Promise<void> => {
     configRefresh ??= (async () => {
+      const stamp = await configStamp();
+      if (stamp !== undefined && stamp === loadedConfigStamp) return;
       const file = await readInstanceConfig(
         instance,
         deps.loadConfig ?? loadConfig
@@ -514,7 +533,10 @@ export async function startResidentRuntime(
         collections: file.collections,
         contexts: file.contexts,
       };
-      if (Bun.deepEquals(next, served)) return;
+      if (Bun.deepEquals(next, served)) {
+        loadedConfigStamp = stamp;
+        return;
+      }
       await adoptServedConfig(
         {
           ...instance,
@@ -529,6 +551,7 @@ export async function startResidentRuntime(
         },
         next
       );
+      loadedConfigStamp = stamp;
     })().finally(() => {
       configRefresh = undefined;
     });

package/src/serve/resident-shutdown.ts

@@ -16,6 +16,7 @@ import {
   SHUTDOWN_ABORT_MS,
   SHUTDOWN_EXIT_MS,
 } from "../core/shutdown-budget";
+import { killImportChildren } from "../sessions/import-child";
 
 interface ResidentShutdownResources {
   options: ResidentRuntimeOptions;
@@ -78,6 +79,9 @@ export async function disposeResidentResources(
         (error: unknown) => console.error("Resident cleanup failed:", error)
       );
   stopFindings();
+  // A session import runs in a child that would outlive this process and hold
+  // up the drain below; cutting it short is safe (one transaction per file).
+  killImportChildren();
   const schedulerDrain = observe(() =>
     scheduler.stop ? scheduler.stop() : scheduler.dispose()
   );