pi-roundtable 0.9.0 → 0.9.1

package/CHANGELOG.md

@@ -5,6 +5,19 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.9.1] - 2026-10-10
+
+### Fixed
+
+- A SIGTERM no longer lets the host keep taking work until it was idle: in 0.9.0 the shutdown drain only waited, so messages, error and webhook reports, schedules, and plugin turns that arrived meanwhile were served and waited for too, and a host that kept getting them never became idle until the one-hour limit (a deploy waited for systemd to kill it). The drain now starts by closing the channel queue: no new turn starts from any source. A message that arrives is not run and its channel gets one short restarting notice (not for a bot's or an integration's message, which is only logged), including a message that waited behind a running turn, and a message is no longer steered into a running turn; a background turn (a schedule's, a delegated task's report, an error report) is skipped; `context.turns.run`, a task for `context.queue.run` that has not started, and a group's next member's turn are refused (`HostStoppingError`, new in `pi-roundtable`), and so are new worker tasks; a remote MCP run fails instead of starting. The scheduler claims nothing during the drain, so a due schedule stays due and fires after the next start if it is less than twelve hours late. Turns already running finish.
+- The drain is bounded by three minutes by default instead of an hour: `drainSeconds` in the config, or `drain.limitMs` in `RoundtableOptions`. At the limit the host stops each running turn as the owner's stop does, gives it `drain.abortGraceMs` (ten seconds by default) to end, hands what is left to `aborted`, and goes on to stop the services and exit. Give the service manager a stop timeout a minute longer than the drain, such as systemd's `TimeoutStopSec=5min`.
+- A turn or worker task whose model ignores the abort (a claude-bridge subprocess that stays alive after "turn timed out; aborting") no longer holds its channel, and the drain, for ever: a run still going `turnAbortGraceMs` (15 seconds by default, `PiAgentRuntimeOptions`) after its abort has its session disposed of and ends as failed, and the conversation's next turn opens a new session from its files. An owner's stop of such a turn is guarded the same way.
+
+### Added
+
+- `QueuePort.closed` (`context.queue.closed`): whether the host is shutting down, for a plugin that starts work from its own timer or route.
+- The `drainSeconds` configuration key.
+
 ## [0.9.0] - 2026-10-09
 
 Principal and identity attribution replace implicit owner authority.

package/docs/plugins.md

@@ -898,7 +898,7 @@ test("the handlers record a turn, a team change, and the shutdown", async () =>
 
 A service has a name and optional `start`, `stop`, and `busy`.
 Services start once everything is set up and stop in reverse order.
-`busy` lists the work still running, one entry each; a shutdown waits until every service's list is empty, for at most an hour, so a deploy rarely cuts work short.
+`busy` lists the work still running, one entry each; a shutdown waits until every service's list is empty, for at most the drain limit (three minutes by default, `drainSeconds` in the config), so a deploy rarely cuts work short.
 The host adds its own channel queue to that wait, so a surface that queues its turns through `context.queue` needs no `busy` for them.
 
 A service may also have `startInBackground`.
@@ -2791,7 +2791,7 @@ The copied file begins with this warning.
 `release-notice` listens to two [events](#events-hear-what-the-core-does).
 When the agent server's team service reports `ready`, it reads the release file and posts if the release's `sha` differs from the one it last announced (`announced-release` in the data directory), or if the previous shutdown cut work short.
 It records the announced `sha` only after the post succeeds, so a failed post is tried again at the next start, and a `release.json` that is not valid (not JSON, an empty `sha`, or `commits` that is not a list of strings) fails the handler with its path in the log.
-At `shutdown(left)` it adds the channels in `left`, the work the drain gave up on after an hour, to `aborted-on-shutdown.json` in the data directory; the next start's announcement names them as cut short (a Discord channel key as a `<#id>` mention), and once it is posted they are removed from the file. A shutdown that arrives while a post is still in flight keeps its channels for the next announcement.
+At `shutdown(left)` it adds the channels in `left`, the work the drain gave up on at its limit, to `aborted-on-shutdown.json` in the data directory; the next start's announcement names them as cut short (a Discord channel key as a `<#id>` mention), and once it is posted they are removed from the file. A shutdown that arrives while a post is still in flight keeps its channels for the next announcement.
 A plain restart of the same release with nothing cut short posts nothing.
 
 The deploy writes `release.json` into the release directory, where the bot runs, before it starts the bot.
@@ -2999,16 +2999,19 @@ If a startup step fails, the host stops its listeners, stops services in reverse
 The process exits non-zero.
 The same host may call `run()` again after that.
 
-On `SIGTERM` or `SIGINT` the bot stops serving new work last:
+On `SIGTERM` or `SIGINT` the bot takes no new work at once, finishes what runs, and stops serving last:
 
-1. It keeps serving until the channel queue is empty and no service reports `busy()` work, for at most an hour; whatever is left is logged and given up on.
-2. Every plugin hears `shutdown(left)`, while every service is still running.
-3. The HTTP listener closes, so no request reaches a service that has stopped.
-4. Services stop in the reverse of the order they started.
-5. The database pool closes.
+1. It stops starting work: the channel queue closes (`context.queue.closed` turns true), and from then on no new turn starts, whoever asks. A message that arrives is not run; its channel gets one short "restarting, try again shortly" reply, except a bot's or an integration's message, which is only logged. A background turn (a schedule's, a delegated task's report, an error report) is skipped, and so is a turn a plugin asks of `context.turns.run`, which rejects with `HostStoppingError`; a task for the queue that has not started, whether queued before or after, is refused with the same error. The scheduler claims nothing, so a due schedule stays due and fires after the next start if it is less than twelve hours late. A turn that is already running finishes. A plugin that starts turns from a timer or a route of its own should check `context.queue.closed` first.
+2. It waits until the channel queue is empty and no service reports `busy()` work, for at most three minutes (`drainSeconds` in the config, `drain.limitMs` in `RoundtableOptions`). If work is left, it stops each running turn as the owner's stop does, gives them ten seconds (`drain.abortGraceMs`) to end, and goes on; whatever is left is logged and given up on.
+3. Every plugin hears `shutdown(left)`, while every service is still running.
+4. The HTTP listener closes, so no request reaches a service that has stopped.
+5. Services stop in the reverse of the order they started.
+6. The database pool closes.
 
 `shutdown()` returns exit code `0`, or `1` if a listener, service, or pool failed to stop.
 Every call shares the same shutdown.
+Give the service manager a stop timeout longer than the drain limit plus about a minute for the steps after it, such as systemd's `TimeoutStopSec=5min` with the default three-minute drain; a shorter one has the manager kill the process in the middle of the drain.
+A turn whose model ignores its abort (a subprocess that does not exit) is given up on too: a turn that outlives its timeout, or is stopped, gets `turnAbortGraceMs` (15 seconds by default) to end, and then its session is disposed of and the turn is reported failed, so it cannot hold the queue.
 `listen()`, called by the command line and a host's own entry point, exits the process with that code.
 
 ## Errors and their fixes
@@ -3263,6 +3266,7 @@ Import from the entries listed below; source area files are internal.
 | `HoldRule` | `pi-roundtable` | type |
 | `HostEnv` | `pi-roundtable` | type |
 | `HostEnvironment` | `pi-roundtable` | type |
+| `HostStoppingError` | `pi-roundtable` | value |
 | `HttpRoute` | `pi-roundtable` | type |
 | `IDENTITY` | `pi-roundtable` | value |
 | `IdentityError` | `pi-roundtable` | value |

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-roundtable",
-	"version": "0.9.0",
+	"version": "0.9.1",
 	"description": "A plugin-driven Pi agent server for one owner, reached through Discord or the web",
 	"type": "module",
 	"license": "MIT",

package/src/core/builtin/modules.ts

@@ -331,7 +331,15 @@ export function modulesPlugin(options: ModulesOptions): RoundtablePlugin {
 export function schedulerPlugin(): RoundtablePlugin {
 	return {
 		name: "schedules",
-		setup: ({ conversations, services, env, logger, surfaces, sessions }) => {
+		setup: ({
+			conversations,
+			services,
+			env,
+			logger,
+			surfaces,
+			sessions,
+			queue,
+		}) => {
 			const schedules = services.get(SCHEDULES);
 			const prechecks = services.find(PRECHECKS);
 			const scheduler = new Scheduler({
@@ -339,6 +347,7 @@ export function schedulerPlugin(): RoundtablePlugin {
 				runner: services.get(BACKGROUND_TURNS),
 				...(prechecks ? { prechecks } : {}),
 				holds: () => sessions().holds,
+				draining: () => queue.closed,
 				// The bot's own message: the surface drops it, so it starts no turn.
 				notify: (schedule, note) =>
 					surfaces.sendReply(schedule.channel, {

package/src/core/config/config.ts

@@ -3,6 +3,7 @@ import { join } from "node:path";
 import type { AgentSeed } from "../agents/agent-rules.ts";
 import { ConfigError } from "../domain/errors.ts";
 import type { InterimTextMode } from "../domain/interim.ts";
+import { DRAIN_LIMIT_MS } from "../drain.ts";
 import { isLocale, type Locale } from "../i18n/index.ts";
 import type { AccessRules } from "../identity/access-policy.ts";
 import type { OwnerIdentity } from "../identity.ts";
@@ -164,6 +165,11 @@ export interface RoundtableConfig {
 	 * conversation or no plugin's claim owns it; the web chat takes no error reports.
 	 */
 	ops?: { agent: string } | { conversation: string };
+	/**
+	 * Seconds a shutdown waits for running turns before stopping them; default 180. Give the
+	 * service manager a stop timeout a minute longer, such as systemd's `TimeoutStopSec`.
+	 */
+	drainSeconds?: number;
 	/**
 	 * Whether a turn posts the text it writes before its final answer as it goes: long or
 	 * structured text as ordinary messages, short narration and the tools called in one small
@@ -261,6 +267,7 @@ const schema = shape({
 	),
 	memory: optional(bool),
 	ops: optional(shape({ agent: optional(text), conversation: optional(text) })),
+	drainSeconds: optional(integer(1, 3_600)),
 	interimText: optional(oneOf<InterimTextMode>("on", "off")),
 	interimPrimaryChars: optional(integer(1, 100_000)),
 	plugins: optional(
@@ -334,6 +341,7 @@ export interface ResolvedConfig {
 	skills: false | { builtinDir?: string; reposDir?: string };
 	memory: boolean;
 	ops?: { agent: string } | { conversation: ChannelKey };
+	drainMs: number;
 	interimText: InterimTextMode;
 	interimPrimaryChars: number;
 	plugins: RoundtablePlugin[];
@@ -483,6 +491,7 @@ export function resolveConfig(input: unknown): ResolvedConfig {
 		skills: config.skills ?? (discord ? {} : false),
 		memory: config.memory ?? true,
 		...(ops ? { ops } : {}),
+		drainMs: (config.drainSeconds ?? DRAIN_LIMIT_MS / 1_000) * 1_000,
 		interimText: config.interimText ?? "on",
 		interimPrimaryChars: config.interimPrimaryChars ?? PRIMARY_CHARS,
 		plugins: config.plugins ?? [],

package/src/core/contract/channels.ts

@@ -259,6 +259,11 @@ export interface QueuePort {
 	size(channel: ChannelKey): number;
 	/** Channels with a task running or waiting. */
 	busy(): ChannelKey[];
+	/**
+	 * Whether the host is shutting down: a task that has not started is then refused with
+	 * HostStoppingError, and a plugin that starts work on its own, such as a timer, starts none.
+	 */
+	readonly closed: boolean;
 	/** Called whenever a channel's count of running and waiting tasks changes. */
 	onChange(listener: (channel: ChannelKey) => void): void;
 }

package/src/core/define-roundtable.ts

@@ -283,6 +283,7 @@ export async function defineRoundtable(
 			],
 			judgeModel: judgeThrough(modelRuntime, config.judge.model),
 			apiKey: (provider) => registry.getApiKeyForProvider(provider),
+			drain: { limitMs: config.drainMs },
 			...(overrides.aborted ? { aborted: overrides.aborted } : {}),
 		},
 		plugins: [

package/src/core/drain.ts

@@ -1,19 +1,32 @@
-/** How long a shutdown waits for running work before aborting it (self-maintenance spec behavior 11). */
-export const DRAIN_LIMIT_MS = 60 * 60_000;
+import type { Logger } from "./log.ts";
+
+/**
+ * How long a shutdown waits for running work before aborting it: long enough for a usual turn to
+ * answer, short enough that a hung one never holds a restart for an hour.
+ */
+export const DRAIN_LIMIT_MS = 3 * 60_000;
+
+/** How long work that was told to stop gets to end before the shutdown goes on without it. */
+const ABORT_GRACE_MS = 10_000;
 
 export interface DrainOptions {
 	/** What still runs or waits, one entry per piece of work; empty when idle. */
 	busy: () => string[];
+	/** The most the drain waits for running work; DRAIN_LIMIT_MS by default. */
 	limitMs?: number;
+	/** How often it looks again; one second by default. */
 	intervalMs?: number;
+	/** The most work told to stop at the limit gets to end; ABORT_GRACE_MS by default. */
+	abortGraceMs?: number;
 	sleep?: (ms: number) => Promise<void>;
 	now?: () => number;
 }
 
 /**
- * Waits until nothing runs or waits, checking every interval, for at most the limit. Work that
- * arrives meanwhile is served as usual and waited for too. Returns what was still busy when the
- * limit ran out, or an empty list once idle.
+ * Waits until nothing runs or waits, checking every interval, for at most the limit. Returns what
+ * was still busy when the limit ran out, or an empty list once idle. It only waits: the host stops
+ * work from starting before it calls this, and a caller that does not must expect work that
+ * arrives meanwhile to be waited for too.
  */
 export async function waitUntilIdle(options: DrainOptions): Promise<string[]> {
 	const {
@@ -31,3 +44,41 @@ export async function waitUntilIdle(options: DrainOptions): Promise<string[]> {
 		await sleep(intervalMs);
 	}
 }
+
+/**
+ * Waits for running work up to the limit; if some is left, tells it to stop (`abort` says whether
+ * it told any) and gives it the abort grace to end. Returns what the limit ran out on, even when stopping it worked, so the
+ * caller can hand it over as cut short.
+ */
+export async function drainWork(
+	options: DrainOptions & { abort: (left: string[]) => boolean },
+): Promise<string[]> {
+	const { abort, abortGraceMs = ABORT_GRACE_MS, ...waiting } = options;
+	const left = await waitUntilIdle(waiting);
+	if (left.length === 0) return left;
+	// Work nothing could be told to stop would only be waited for in vain.
+	if (abort(left)) await waitUntilIdle({ ...waiting, limitMs: abortGraceMs });
+	return left;
+}
+
+/**
+ * Tells each channel's running turn to stop, as the owner's stop does; a failure is logged and the
+ * rest are still told. Whether any turn was running to be told.
+ */
+export function stopTurns(
+	channels: readonly string[],
+	stop: (channel: string) => boolean,
+	logger: Logger,
+): boolean {
+	let stopped = false;
+	for (const channel of new Set(channels)) {
+		try {
+			const told = stop(channel);
+			logger.warn({ channel, told }, "stopping the turn");
+			stopped ||= told;
+		} catch (error) {
+			logger.error({ channel, err: error }, "the turn could not be stopped");
+		}
+	}
+	return stopped;
+}

package/src/core/errors.ts

@@ -27,3 +27,16 @@ export class JudgeError extends Error {
 export class ProviderError extends Error {
 	override name = "ProviderError";
 }
+
+/**
+ * Work refused because the host is shutting down: once the drain starts, no turn, queue task, or
+ * background run starts any more, and what was waiting behind a running one is dropped.
+ */
+export class HostStoppingError extends Error {
+	override name = "HostStoppingError";
+	constructor() {
+		super(
+			"the host is shutting down and starts no new work; try again once it is back",
+		);
+	}
+}

package/src/core/host-background.ts

@@ -0,0 +1,56 @@
+import type { Logger } from "./log.ts";
+import type { ServiceStartedEvent } from "./plugin.ts";
+import type { Registry } from "./registry/contributions.ts";
+
+type Attempt = { ok: true } | { ok: false; error: unknown };
+
+/** Runs one step whose failure the caller reports and moves past. */
+export async function attempt(
+	step: () => Promise<void> | void,
+): Promise<Attempt> {
+	try {
+		await step();
+		return { ok: true };
+	} catch (error) {
+		return { ok: false, error };
+	}
+}
+
+/**
+ * Runs every service's background start at once and tells every plugin, as each ends, how it
+ * went; the rest of the process runs either way, and a failing start or handler never stops the
+ * others.
+ */
+export async function startInBackground(
+	registry: Registry,
+	logger: Logger,
+): Promise<void> {
+	const { services, servicePlugins, handlers } = registry;
+	await Promise.all(
+		// pi-lens-ignore: array-callback-return — an async callback returns its promise on every path; map only starts the tasks for Promise.all, and the early return skips a service with no background start
+		services.map(async (service) => {
+			if (!service.startInBackground) return;
+			const plugin = servicePlugins.get(service) ?? "unknown";
+			const started = await attempt(() => service.startInBackground?.());
+			if (started.ok) logger.info({ plugin, service: service.name }, "ready");
+			else
+				logger.error(
+					{ plugin, service: service.name, err: started.error },
+					"service did not start in the background",
+				);
+			const event: ServiceStartedEvent = {
+				plugin,
+				service: service.name,
+				outcome: started.ok ? "ready" : "failed",
+			};
+			for (const { plugin: heard, events } of handlers) {
+				const handled = await attempt(() => events.serviceStarted?.(event));
+				if (!handled.ok)
+					logger.error(
+						{ plugin: heard, err: handled.error },
+						"service started handler failed",
+					);
+			}
+		}),
+	);
+}

package/src/core/host.ts

@@ -2,9 +2,10 @@ import type { SQL } from "bun";
 import type { ConversationPort } from "./contract/channels.ts";
 import type { SurfacePort } from "./contract/surface.ts";
 import { openPool, runMigrations } from "./db/migrations.ts";
-import { type DrainOptions, waitUntilIdle } from "./drain.ts";
+import { type DrainOptions, drainWork, stopTurns } from "./drain.ts";
 import { MigrationError, NotLinkedError, PluginError } from "./errors.ts";
 import { EventBus } from "./events.ts";
+import { attempt, startInBackground } from "./host-background.ts";
 import { HttpListeners, type ListenerConfig } from "./http/listeners.ts";
 import { type Locale, setLocale } from "./i18n/index.ts";
 import { contactsOf } from "./identity/identity-view.ts";
@@ -15,7 +16,6 @@ import type {
 	LinkedSessions,
 	RoundtablePlugin,
 	Service,
-	ServiceStartedEvent,
 } from "./plugin.ts";
 import { refuseRemovedFields } from "./plugin.ts";
 import {
@@ -34,6 +34,7 @@ import {
 } from "./routing/conversation-turns.ts";
 import { surfacePort } from "./routing/surface-port.ts";
 import { CONVERSATIONS, IDENTITY, RUNTIME } from "./services.ts";
+import type { ChannelKey } from "./sessions.ts";
 import { setTimeZone } from "./time.ts";
 import { type ToolTierTable, toolTiers } from "./tool-tiers.ts";
 
@@ -78,7 +79,11 @@ export interface RoundtableOptions {
 	database?: { url: string };
 	/** Receives the work a shutdown drain gave up on, before any service stops. */
 	aborted?: (left: string[]) => Promise<void>;
-	/** The drain's limit and clock; tests shorten them. */
+	/**
+	 * The shutdown drain: it waits up to `limitMs` (3 minutes by default) for the turns already
+	 * running, then stops them, gives them `abortGraceMs` (10 seconds) to end, and goes on without
+	 * them. Nothing new starts once it begins. Tests shorten the limits and the clock.
+	 */
 	drain?: Omit<DrainOptions, "busy">;
 	/** What `listen()` calls with the shutdown's exit code; the process's own exit by default. */
 	exit?: (code: number) => void;
@@ -87,63 +92,13 @@ export interface RoundtableOptions {
 /** The host running in this process; the text catalog, time zone and environment are process-wide. */
 let running: Roundtable | undefined;
 
-type Attempt = { ok: true } | { ok: false; error: unknown };
-
-/** Runs one step whose failure the caller reports and moves past. */
-async function attempt(step: () => Promise<void> | void): Promise<Attempt> {
-	try {
-		await step();
-		return { ok: true };
-	} catch (error) {
-		return { ok: false, error };
-	}
-}
-
-/**
- * Runs every service's background start at once and tells every plugin, as each ends, how it
- * went; the rest of the process runs either way, and a failing start or handler never stops the
- * others.
- */
-async function startInBackground(
-	registry: Registry,
-	logger: Logger,
-): Promise<void> {
-	const { services, servicePlugins, handlers } = registry;
-	await Promise.all(
-		// pi-lens-ignore: array-callback-return — an async callback returns its promise on every path; map only starts the tasks for Promise.all, and the early return skips a service with no background start
-		services.map(async (service) => {
-			if (!service.startInBackground) return;
-			const plugin = servicePlugins.get(service) ?? "unknown";
-			const started = await attempt(() => service.startInBackground?.());
-			if (started.ok) logger.info({ plugin, service: service.name }, "ready");
-			else
-				logger.error(
-					{ plugin, service: service.name, err: started.error },
-					"service did not start in the background",
-				);
-			const event: ServiceStartedEvent = {
-				plugin,
-				service: service.name,
-				outcome: started.ok ? "ready" : "failed",
-			};
-			for (const { plugin: heard, events } of handlers) {
-				const handled = await attempt(() => events.serviceStarted?.(event));
-				if (!handled.ok)
-					logger.error(
-						{ plugin: heard, err: handled.error },
-						"service started handler failed",
-					);
-			}
-		}),
-	);
-}
-
 /**
  * The process around the plugins: it sets them all up, links what they add (session parts,
  * HTTP routes) and runs the preflight, then starts their services in order and the
  * HTTP listeners last, then runs the services' background starts. Nothing reaches Discord or a listener unless
- * every setup, link, and the preflight succeeded. On shutdown it waits until no work runs or
- * waits before closing the listeners and stopping the services in reverse.
+ * every setup, link, and the preflight succeeded. On shutdown it starts no new work, waits for
+ * what runs for at most the drain limit, then closes the listeners and stops the services in
+ * reverse.
  */
 // pi-lens-ignore: large-class
 export class Roundtable {
@@ -243,6 +198,7 @@ export class Roundtable {
 			registry: () => this.#services?.find(CONVERSATIONS),
 			surfaces: this.#surfaces(),
 			events: this.#events.sink,
+			stopping: () => this.#queue.closed,
 			selection: () => {
 				if (!this.#sessions)
 					throw new NotLinkedError("session parts are not linked yet.");
@@ -423,7 +379,8 @@ export class Roundtable {
 	}
 
 	/**
-	 * Stops the host once no work runs or waits and returns the exit code: 0, or 1 when the
+	 * Stops the host once no work runs or waits, or the drain limit has passed, and returns the
+	 * exit code: 0, or 1 when the
 	 * boot had failed or a listener, service or the pool did not stop. Every call shares the one
 	 * shutdown.
 	 */
@@ -437,19 +394,27 @@ export class Roundtable {
 		// A signal during the boot waits for it to settle; a failed boot has already stopped.
 		await this.#booting?.catch(() => undefined);
 		if (running !== this) return this.#bootFailed ? 1 : 0;
-		// Everything keeps serving until nothing runs or waits, so a deploy never cuts a turn short.
+		// Turns already running finish, but nothing new starts from here on, whoever asks.
 		logger.info({ signal }, "shutting down once idle");
-		const left = await waitUntilIdle({
+		this.#queue.close();
+		const left = await drainWork({
 			...drain,
 			busy: () => [
 				...this.#queue.busy(),
 				...this.#started.flatMap((service) => service.busy?.() ?? []),
 			],
+			// A turn the limit finds still running is stopped, as the owner's stop would.
+			abort: () =>
+				stopTurns(
+					this.#queue.busy(),
+					(channel) => this.#router?.stop(channel as ChannelKey) ?? false,
+					logger,
+				),
 		});
 		if (left.length > 0) {
 			logger.warn(
 				{ aborted: left },
-				"still busy after the drain limit; aborting",
+				"still busy after the drain limit; aborted",
 			);
 			const recorded = await attempt(() => aborted?.(left));
 			if (!recorded.ok)

package/src/core/i18n/conversation.ts

@@ -6,6 +6,7 @@ export function conversationEn(ctx: CatalogContext) {
 		failureNotice:
 			"Sorry, this reply did not go through. Please try again later.",
 		stoppedNotice: "-# Stopped.",
+		restartingNotice: `-# ${ctx.assistant} is restarting and takes no new messages right now; please send this again in a few minutes.`,
 		roundLimitNotice:
 			"-# This round already has 8 replies, so it stops here; call us again if you need more.",
 		restartNotice: `-# ${ctx.assistant} restarted before this job finished, so nothing more will be reported here.`,
@@ -30,6 +31,7 @@ export function conversationZhTW(
 	return {
 		failureNotice: "抱歉，這次沒能完成回覆，請稍後再試一次。",
 		stoppedNotice: "-# 已停止。",
+		restartingNotice: `-# ${ctx.assistant} 正在重新啟動，暫時不接新訊息；請過幾分鐘再傳一次。`,
 		roundLimitNotice:
 			"-# 這一輪已經有 8 則回覆，先停在這裡；需要的話請再叫我們。",
 		restartNotice: `-# ${ctx.assistant} 在這項工作結束前重新啟動了，這裡不會再有回報。`,

package/src/core/modules/schedules/scheduler.ts

@@ -49,6 +49,12 @@ export interface SchedulerOptions {
 	holds?: () => HoldCheck;
 	/** Posts a skipping precheck's note in the schedule's channel as the bot's own message, which starts no turn. */
 	notify?: (schedule: Schedule, note: string) => Promise<void>;
+	/**
+	 * Whether the host is shutting down. A due schedule is then left unclaimed, so it stays due and
+	 * fires after the next start, if it is not too late by then (LATE_LIMIT_MS), instead of being
+	 * moved on to its next run and its turn refused.
+	 */
+	draining?: () => boolean;
 	logger: Logger;
 	intervalMs?: number;
 	/** Replaceable in tests. */
@@ -119,15 +125,20 @@ export class Scheduler {
 		await this.#prechecks.drain(PRECHECK_STOP_MS);
 	}
 
+	#draining(): boolean {
+		return this.#options.draining?.() ?? false;
+	}
+
 	/** Claims every due schedule and starts its run; runs continue after tick resolves. */
 	async tick(): Promise<void> {
-		if (this.#ticking || this.#stopping.signal.aborted) return;
+		if (this.#ticking || this.#stopping.signal.aborted || this.#draining())
+			return;
 		this.#ticking = true;
 		const { store, logger } = this.#options;
 		try {
 			const now = this.#options.now?.() ?? new Date();
 			for (const schedule of await store.due(now)) {
-				if (this.#stopping.signal.aborted) break;
+				if (this.#stopping.signal.aborted || this.#draining()) break;
 				const claimed = await store.claim(
 					schedule,
 					nextRun(schedule.recurrence, now),

package/src/core/routing/channel-queue.ts

@@ -1,3 +1,4 @@
+import { HostStoppingError } from "../errors.ts";
 import type { ChannelKey } from "../sessions.ts";
 
 /** Runs tasks one at a time per channel, in arrival order; different channels run independently. */
@@ -5,6 +6,7 @@ export class ChannelQueue {
 	readonly #tails = new Map<ChannelKey, Promise<unknown>>();
 	readonly #sizes = new Map<ChannelKey, number>();
 	readonly #listeners: ((channel: ChannelKey) => void)[] = [];
+	#closed = false;
 
 	/** Called whenever a channel's count of running and waiting tasks changes. */
 	onChange(listener: (channel: ChannelKey) => void): void {
@@ -15,11 +17,26 @@ export class ChannelQueue {
 		for (const listener of this.#listeners) listener(channel);
 	}
 
+	/** Whether the host is shutting down, so no task starts any more. */
+	get closed(): boolean {
+		return this.#closed;
+	}
+
+	/**
+	 * Starts the shutdown: from now on a task that has not started, whether queued before or after
+	 * this call, is refused with HostStoppingError. A running task finishes.
+	 */
+	close(): void {
+		this.#closed = true;
+	}
+
 	run<T>(channel: ChannelKey, task: () => Promise<T>): Promise<T> {
+		const start = () =>
+			this.#closed ? Promise.reject(new HostStoppingError()) : task();
 		this.#sizes.set(channel, this.size(channel) + 1);
 		this.#changed(channel);
 		const previous = this.#tails.get(channel) ?? Promise.resolve();
-		const result = previous.then(task, task);
+		const result = previous.then(start, start);
 		const tail = result.catch(() => undefined);
 		this.#tails.set(channel, tail);
 		void tail.then(() => {

package/src/core/routing/channel-router.ts

@@ -12,7 +12,8 @@ import {
 } from "../contract/channels.ts";
 import { parseChannelKey, type SurfacePort } from "../contract/surface.ts";
 import { IdentityError } from "../domain/errors.ts";
-import { PluginError } from "../errors.ts";
+import { HostStoppingError, PluginError } from "../errors.ts";
+import { messages } from "../i18n/index.ts";
 import type { ActorFacts } from "../identity/actor-facts.ts";
 import type { Contact, ContactAssessor } from "../identity/contact.ts";
 import {
@@ -37,8 +38,11 @@ export interface ChannelRouterOptions {
 	contacts?: ContactAssessor;
 	/** Whom a background turn runs as; without it, only the host's own turns run. */
 	principals?: Pick<IdentityService, "speakerFor">;
-	/** The surfaces, so a conversation started over is marked in a channel that shows one; without it, none is. */
-	surfaces?: Pick<SurfacePort, "of">;
+	/**
+	 * The surfaces, so a conversation started over is marked in a channel that shows one, and a
+	 * message that arrives while the host shuts down is told so; without it, neither is.
+	 */
+	surfaces?: Pick<SurfacePort, "of"> & Partial<Pick<SurfacePort, "sendReply">>;
 	/** How long a bare forward waits for the text sent with it; FORWARD_JOIN_MS by default. */
 	forwardJoinMs?: number;
 }
@@ -56,6 +60,12 @@ export function orderClaims(
 	return claims.toSorted((a, b) => b.priority - a.priority);
 }
 
+/** The outcome of a background turn the host did not start because it is shutting down. */
+const stopping = (): ScheduledOutcome => ({
+	status: "skipped",
+	reason: new HostStoppingError().message,
+});
+
 /**
  * Routes every conversation operation to the claim that owns its channel, each inside the
  * channel's queue: messages after joining a bare forward to its text, background turns,
@@ -69,6 +79,8 @@ export class ChannelRouter implements ConversationPort {
 	readonly #admitting = new Map<ChannelKey, Promise<unknown>>();
 	/** The surfaces already warned that their messages carry no actor. */
 	readonly #warned = new Set<string>();
+	/** The channels already told that the host is restarting, so a burst of messages gets one notice. */
+	readonly #told = new Set<ChannelKey>();
 
 	constructor(options: ChannelRouterOptions) {
 		this.#options = options;
@@ -100,7 +112,13 @@ export class ChannelRouter implements ConversationPort {
 		if (!claim) return;
 		const started = await this.#inOrder(message.channel, async () => {
 			const admission = await this.#admit(claim, message);
-			return admission && (await this.#start(message, admission));
+			if (!admission) return undefined;
+			// Once the host shuts down only the turns already running finish: this one starts nothing.
+			if (this.#options.queue.closed) {
+				await this.#refuse(message, admission);
+				return undefined;
+			}
+			return this.#start(message, admission);
 		});
 		await started?.done;
 	}
@@ -209,6 +227,33 @@ export class ChannelRouter implements ConversationPort {
 		};
 	}
 
+	/**
+	 * Drops a message the host no longer starts a turn for because it is shutting down, and tells
+	 * its channel once that it restarts; no one is told for a bot's or an integration's message, such
+	 * as a report, since a notice there would only start the next one.
+	 */
+	async #refuse(message: InboundMessage, admission: Admission): Promise<void> {
+		const { logger, surfaces } = this.#options;
+		const { channel } = message;
+		if (admission.kind === "turn") admission.dropped?.();
+		else
+			admission.unanswered({
+				status: "skipped",
+				reason: new HostStoppingError().message,
+			});
+		logger.info({ channel }, "message not run: the host is shutting down");
+		if (message.authorIsBot || message.integration || this.#told.has(channel))
+			return;
+		this.#told.add(channel);
+		try {
+			await surfaces?.sendReply?.(channel, {
+				chunks: [messages().restartingNotice],
+			});
+		} catch (error) {
+			logger.warn({ channel, err: error }, "restart notice not posted");
+		}
+	}
+
 	/**
 	 * Starts what the claim admitted, in the channel's queue, and returns while it runs: a message
 	 * during a turn is first offered to it, then marked as waiting.
@@ -238,12 +283,17 @@ export class ChannelRouter implements ConversationPort {
 				return admission.run();
 			})
 			// pi-lens-ignore: no-unknown-parameters
-			.catch((error: unknown) =>
+			.catch(async (error: unknown) => {
+				// The host began shutting down while this message waited behind a running turn.
+				if (error instanceof HostStoppingError) {
+					if (queued) void busy?.unreact(QUEUED_MARK);
+					return this.#refuse(message, admission);
+				}
 				logger.error(
 					{ channel: message.channel, err: error },
 					admission.failure,
-				),
-			);
+				);
+			});
 		return { done };
 	}
 
@@ -257,6 +307,7 @@ export class ChannelRouter implements ConversationPort {
 	 * handed to another target's claim, and so is one whose author may not run it now.
 	 */
 	async background(turn: BackgroundTurn): Promise<ScheduledOutcome> {
+		if (this.#options.queue.closed) return stopping();
 		if (!this.#options.targets(turn.target))
 			return {
 				status: "skipped",
@@ -277,6 +328,7 @@ export class ChannelRouter implements ConversationPort {
 				return claim.background({ ...turn, speaker: runs.speaker });
 			});
 		} catch (error) {
+			if (error instanceof HostStoppingError) return stopping();
 			return { status: "failed", error: String(error) };
 		}
 	}

package/src/core/routing/conversation-turns.ts

@@ -8,7 +8,7 @@ import type { TurnAttachments } from "../domain/attachment.ts";
 import type { TurnResult } from "../domain/conversation.ts";
 import type { TurnConversation } from "../domain/ports.ts";
 import type { TurnProgress } from "../domain/progress.ts";
-import { PluginError } from "../errors.ts";
+import { HostStoppingError, PluginError } from "../errors.ts";
 import { messages } from "../i18n/index.ts";
 import { SYSTEM_PRINCIPAL } from "../identity/principal-store.ts";
 import type { Logger } from "../log.ts";
@@ -61,7 +61,8 @@ export interface ConversationTurns {
 	 * task. It shows typing and the stop control on the channel's surface, emits `turnStarted` and
 	 * `turnEnded` with the turn's `kind`, settles a runtime that throws into a failed result, and
 	 * posts the reply, or a failure or stopped notice, through the surface unless `reply` is given.
-	 * It rejects during setup (NotLinkedError), when the host has no runtime to run the turn on,
+	 * It rejects during setup (NotLinkedError), once the host is shutting down (HostStoppingError),
+	 * when the host has no runtime to run the turn on,
 	 * when the conversation cannot be recorded in the host's registry (a database error, or a
 	 * `private` conversation without a speaker), and when the conversation is recorded private to a
 	 * principal other than the speaker's, unless the speaker is the host's own (`SYSTEM_PRINCIPAL`).
@@ -75,6 +76,8 @@ export interface ConversationTurns {
 export interface ConversationTurnsOptions {
 	/** Throws NotLinkedError until every plugin is set up and linked. */
 	linked: () => void;
+	/** Whether the host is shutting down, so no turn starts; undefined or false while it serves. */
+	stopping?: () => boolean;
 	/** The runtime that runs the turn; throws PluginError when the host has none yet. */
 	runtime: () => AgentRuntime;
 	/** Where each turn records its conversation; absent, or undefined, records none. */
@@ -143,6 +146,8 @@ export function conversationTurns(
 		async run(input) {
 			const { channel, kind, speaker } = input;
 			options.linked();
+			// Refused before anything is shown or recorded, like a turn the host cannot run.
+			if (options.stopping?.()) throw new HostStoppingError();
 			// A host without a runtime is a setup mistake, so it is refused before anything is shown.
 			const runtime = options.runtime();
 			// A conversation that cannot be recorded runs no turn: who it belongs to would be lost.

package/src/core/runtime/abort-guard.ts

@@ -0,0 +1,58 @@
+import type { AgentSession } from "@earendil-works/pi-coding-agent";
+import { AgentRunError } from "../domain/errors.ts";
+
+/** How long a run told to abort gets to end before its session is disposed of; default for the guard. */
+const ABORT_GRACE_MS = 15_000;
+
+/**
+ * Aborts a Pi session's run and does not trust the abort to work. A model behind a subprocess that
+ * ignores the abort would leave the run, and the queue behind it, waiting for ever, so a run still
+ * going once the grace is over has its session disposed of, which drops its model connection, and
+ * `gaveUp` rejects so the caller can end the turn as failed.
+ */
+export class AbortGuard {
+	/** Rejects when the abort did not end the run in time; never resolves. */
+	readonly gaveUp: Promise<never>;
+	readonly #session: Pick<AgentSession, "abort" | "dispose">;
+	readonly #graceMs: number;
+	readonly #onGiveUp: () => void;
+	#reject: (error: Error) => void = () => undefined;
+	#timer: ReturnType<typeof setTimeout> | undefined;
+
+	constructor(
+		session: Pick<AgentSession, "abort" | "dispose">,
+		options: { graceMs?: number; onGiveUp?: () => void } = {},
+	) {
+		this.#session = session;
+		this.#graceMs = options.graceMs ?? ABORT_GRACE_MS;
+		this.#onGiveUp = options.onGiveUp ?? (() => undefined);
+		this.gaveUp = new Promise<never>((_resolve, reject) => {
+			this.#reject = reject;
+		});
+		// Nobody waits on it unless the abort fails.
+		this.gaveUp.catch(() => undefined);
+	}
+
+	/** Aborts the run, and starts the grace the first time. */
+	abort(): void {
+		void this.#session.abort();
+		this.#timer ??= setTimeout(() => {
+			this.#onGiveUp();
+			try {
+				this.#session.dispose();
+			} catch {
+				// A session that cannot be disposed of is dropped all the same.
+			}
+			this.#reject(
+				new AgentRunError(
+					"the run did not stop after it was aborted, so its session was disposed of",
+				),
+			);
+		}, this.#graceMs);
+	}
+
+	/** The run ended: no session is disposed of any more. */
+	release(): void {
+		clearTimeout(this.#timer);
+	}
+}

package/src/core/runtime/conversation-sessions.ts

@@ -262,6 +262,21 @@ export class ConversationSessions {
 		);
 	}
 
+	/**
+	 * Forgets a session that was disposed of while its turn still ran, so the conversation's next
+	 * turn opens a new one from its files; a newer session of the conversation stays.
+	 */
+	drop(key: ChannelKey, disposed: ChannelSession): void {
+		const open = this.#sessions.get(key);
+		if (!open) return;
+		void open
+			.then((current) => {
+				if (current === disposed && this.#sessions.get(key) === open)
+					this.#sessions.delete(key);
+			})
+			.catch(() => undefined);
+	}
+
 	/** Drops the open session and everything held for the conversation, leaving its files. */
 	// pi-lens-ignore: mixed-async-styles — disposal failures of a dropped session are swallowed in a chain on purpose
 	async forget(channel: ChannelKey): Promise<void> {

package/src/core/runtime/pi-agent-runtime.ts

@@ -1,6 +1,5 @@
 import { rmSync } from "node:fs";
 import {
-	type AgentSession,
 	type ModelRuntime,
 	SessionManager,
 } from "@earendil-works/pi-coding-agent";
@@ -16,20 +15,16 @@ import type {
 } from "../domain/conversation.ts";
 import { AgentRunError } from "../domain/errors.ts";
 import type { TurnRequest } from "../domain/ports.ts";
+import { HostStoppingError } from "../errors.ts";
 import { assistantName } from "../i18n/index.ts";
 import { promptScopeOf } from "../interactions/prompts.ts";
-import { AUTO_THINKING, type ThinkingLevel } from "../models.ts";
 import { MEMORY_TOOLS } from "../modules/memory/owner-memory.ts";
 import { withoutReplyFiles } from "../reply-files.ts";
 import type { TransientTask } from "../sessions.ts";
 import type { Speaker, Tier } from "../speakers.ts";
 import { type ToolTiers, toolsForTier, toolTiers } from "../tool-tiers.ts";
-import {
-	type AgentModelSettings,
-	bridgeTurnRefusal,
-	chosenAgentModel,
-	useChosenAgentModel,
-} from "./bridge-guard.ts";
+import { AbortGuard } from "./abort-guard.ts";
+import { bridgeTurnRefusal, chosenAgentModel } from "./bridge-guard.ts";
 import { ConversationSessions } from "./conversation-sessions.ts";
 import { confirmedTurnText } from "./extensions/confirmation-gate.ts";
 import { loadsMemory } from "./extensions/private-memory.ts";
@@ -47,14 +42,11 @@ import {
 } from "./session-conversation.ts";
 import { SessionFactory } from "./session-factory.ts";
 import { promptImages, SteerableRun } from "./steerable-run.ts";
+import { thinkingLevel } from "./thinking-level.ts";
 import { runningCalls } from "./tool-call-scope.ts";
-import {
-	lastReply,
-	transcriptOf,
-	turnAnswer,
-	unspokenTurn,
-} from "./turn-answer.ts";
+import { transcriptOf, turnAnswer, unspokenTurn } from "./turn-answer.ts";
 import { progressReporter } from "./turn-progress.ts";
+import { wrapUpTurn } from "./turn-wrapup.ts";
 import { workerReport } from "./worker-task.ts";
 
 export {
@@ -118,6 +110,12 @@ export class PiAgentRuntime implements AgentRuntime {
 	async runTurn(request: TurnRequest): Promise<TurnResult> {
 		const { logger, turnTimeoutMs = 10 * 60_000 } = this.#options;
 		if (!request.speaker) return unspokenTurn();
+		// A turn that is only asked for now, such as a group's next member, starts nothing.
+		if (this.#options.stopping?.())
+			return {
+				ok: false,
+				error: new AgentRunError(new HostStoppingError().message),
+			};
 		const key = request.agent?.session ?? request.channel;
 		// Resolve current scope; refuse a foreign private speaker before touching its session.
 		const conversation = await this.#sessions.conversation(key, request);
@@ -147,7 +145,17 @@ export class PiAgentRuntime implements AgentRuntime {
 				: undefined;
 		if (bridgeRefused)
 			return { ok: false, error: new AgentRunError(bridgeRefused) };
-		const level = await this.#thinkingLevel(key, session, request, agentModel);
+		const level = await thinkingLevel(
+			{
+				modelRuntime: this.#modelRuntime,
+				effort: this.#options.effort,
+				judged: this.#sessions.judged,
+			},
+			key,
+			session,
+			request,
+			agentModel,
+		);
 		if (session.thinkingLevel !== level) session.setThinkingLevel(level);
 		const gate = await this.#sessions.gate(key, request.agent !== undefined);
 		const pending = gate.pending();
@@ -240,17 +248,29 @@ export class PiAgentRuntime implements AgentRuntime {
 			request.agent?.name ?? assistantName(),
 			interim ? () => interim.flush() : undefined,
 		);
+		// A model that ignores the abort must not hold the turn: its session is disposed of instead.
+		const guard = new AbortGuard(session, {
+			graceMs: this.#options.turnAbortGraceMs,
+			onGiveUp: () => {
+				logger.error(
+					{ channel: request.channel },
+					"turn did not stop after its abort; disposing of its session",
+				);
+				this.#sessions.drop(key, channelSession);
+			},
+		});
 		// Time spent waiting on the owner's cards does not count towards the timeout.
 		const cancelTimeout = workTimeout(turnTimeoutMs, slot, () => {
 			logger.warn(
 				{ channel: request.channel, turnTimeoutMs },
 				"turn timed out; aborting",
 			);
-			void session.abort();
+			guard.abort();
 		});
 		const running = new SteerableRun(
 			session,
 			() => request.steerable === true && !gate.pending(),
+			() => guard.abort(),
 		);
 		this.#running.set(key, running);
 
@@ -260,7 +280,7 @@ export class PiAgentRuntime implements AgentRuntime {
 				request.confirmed && pending
 					? confirmedTurnText(pending, request.text, who)
 					: request.text;
-			await running.run(() =>
+			const prompted = running.run(() =>
 				session.prompt(
 					withAttachmentsBlock(text, attachments),
 					attachments.images.length > 0
@@ -268,6 +288,9 @@ export class PiAgentRuntime implements AgentRuntime {
 						: undefined,
 				),
 			);
+			// A run abandoned by the guard may still reject later; nobody waits for it then.
+			prompted.catch(() => undefined);
+			await Promise.race([prompted, guard.gaveUp]);
 		} catch (error) {
 			if (running.stopped)
 				return { ok: false, error: new AgentRunError(STOPPED), stopped: true };
@@ -280,42 +303,20 @@ export class PiAgentRuntime implements AgentRuntime {
 			this.#turns.delete(key);
 			this.#memoryTurns.delete(key);
 			cancelTimeout();
+			guard.release();
 			slot.unbind();
 			unsubscribe();
 			progress?.close();
 			await interim?.flush();
-			gate.endTurn();
-			const usage = session.getContextUsage();
-			if (usage)
-				this.#sessions.usage.set(key, {
-					tokens: usage.tokens,
-					contextWindow: usage.contextWindow,
-				});
-			const held = gate.pending();
-			await this.#options.confirmations
-				.save(key, held)
-				// pi-lens-ignore: no-unknown-parameters — a rejection reason is unknown; it only reaches the logger
-				.catch((error: unknown) =>
-					logger.error({ channel: key, err: error }, "held actions not saved"),
-				);
-			if (held)
-				logger.info(
-					{ channel: key, held: held.calls.map((call) => call.action) },
-					"actions held for confirmation",
-				);
-			logger.info(
-				{
-					channel: key,
-					selection: request.selection.id,
-					toolCalls,
-					thinking: session.thinkingLevel,
-					// pi-lens-ignore: no-conditional-empty-object-spread — owner turns keep their log line without a model key
-					...(request.agent
-						? { model: `${session.model?.provider}/${session.model?.id}` }
-						: {}),
-				},
-				"turn finished",
-			);
+			await wrapUpTurn({
+				key,
+				request,
+				session,
+				gate,
+				toolCalls,
+				options: this.#options,
+				recordUsage: (usage) => this.#sessions.usage.set(key, usage),
+			});
 		}
 
 		if (running.stopped)
@@ -368,6 +369,8 @@ export class PiAgentRuntime implements AgentRuntime {
 	): Promise<string> {
 		const { dataDir } = this.#options;
 		const { signal } = task;
+		if (this.#options.stopping?.())
+			throw new AgentRunError(new HostStoppingError().message);
 		// A task works at the tier of the turn that started it; without one there is no tier to take.
 		const turn = this.#turns.get(scope.turn);
 		if (!turn)
@@ -393,7 +396,11 @@ export class PiAgentRuntime implements AgentRuntime {
 		const unsubscribe = session.subscribe((event) => {
 			if (event.type === "tool_execution_start") toolCalls.push(event.toolName);
 		});
-		const abort = () => void session.abort();
+		// A worker whose model ignores the abort is given up on, like a turn's.
+		const guard = new AbortGuard(session, {
+			graceMs: this.#options.turnAbortGraceMs,
+		});
+		const abort = () => guard.abort();
 		signal?.addEventListener("abort", abort, { once: true });
 		const timer = setTimeout(abort, task.timeoutMs);
 		try {
@@ -411,13 +418,16 @@ export class PiAgentRuntime implements AgentRuntime {
 					(name) => registered.has(name) && this.#tiers.allows(tier, name),
 				);
 			session.setActiveToolsByName([...worker.tools]);
-			await withoutReplyFiles(() => session.prompt(task.text));
+			const prompted = withoutReplyFiles(() => session.prompt(task.text));
+			prompted.catch(() => undefined);
+			await Promise.race([prompted, guard.gaveUp]);
 			return workerReport(
 				session.messages,
 				"the worker stopped before it reported",
 			);
 		} finally {
 			clearTimeout(timer);
+			guard.release();
 			signal?.removeEventListener("abort", abort);
 			unsubscribe();
 			session.dispose();
@@ -467,33 +477,6 @@ export class PiAgentRuntime implements AgentRuntime {
 		return transcriptOf(await this.#sessions.messages(channel), limit);
 	}
 
-	/** Uses the checked model snapshot; auto thinking keeps the last pick while the judge is unsure. */
-	async #thinkingLevel(
-		key: ChannelKey,
-		session: AgentSession,
-		request: TurnRequest,
-		agentModel?: AgentModelSettings,
-	): Promise<ThinkingLevel> {
-		const setting = request.agent
-			? await useChosenAgentModel(
-					session,
-					this.#modelRuntime,
-					request.agent.name,
-					agentModel,
-				)
-			: AUTO_THINKING;
-		if (setting !== AUTO_THINKING) {
-			this.#sessions.judged.delete(key);
-			return setting;
-		}
-		const level = await this.#options.effort.judge(request.text, {
-			reply: lastReply(session.messages),
-			level: this.#sessions.judged.get(key),
-		});
-		this.#sessions.judged.set(key, level);
-		return level;
-	}
-
 	dispose(): void {
 		this.#sessions.dispose();
 	}

package/src/core/runtime/runtime-plugin.ts

@@ -168,6 +168,7 @@ export function runtimePlugin(
 						}),
 						confirmations: heldActions,
 						toolTiers: context.toolTiers,
+						stopping: () => context.queue.closed,
 						get agents() {
 							return agents();
 						},

package/src/core/runtime/runtime-types.ts

@@ -80,6 +80,14 @@ export interface PiAgentRuntimeOptions {
 	toolTiers?: ToolTiers;
 	/** A run that takes longer, not counting time spent waiting on the owner's cards, is aborted and reported as failed. */
 	turnTimeoutMs?: number;
+	/**
+	 * How long a turn that was aborted, by its timeout or a stop, gets to end before its session is
+	 * disposed of and the turn is reported failed; default 15 seconds. A model that ignores the
+	 * abort would otherwise hold the turn, and the shutdown drain, for ever.
+	 */
+	turnAbortGraceMs?: number;
+	/** Whether the host is shutting down: a turn or a task is then refused before it starts. */
+	stopping?: () => boolean;
 	/**
 	 * Whether a turn given a place for interim posts shows the text it writes before its final
 	 * answer as it goes; default "on". "off" posts only the final reply.

package/src/core/runtime/steerable-run.ts

@@ -33,13 +33,22 @@ export class SteerableRun {
 	readonly #canSteer: () => boolean;
 	/** Steered prompts in arrival order, each with its images. */
 	readonly #steers: { text: string; images: PromptImages }[] = [];
+	readonly #abort: () => void;
 	#stopped = false;
 	#done = false;
 
-	/** `canSteer` is asked at each steer: the turn is the owner's and holds no actions. */
-	constructor(session: SteeringSession, canSteer: () => boolean) {
+	/**
+	 * `canSteer` is asked at each steer: the turn is the owner's and holds no actions. `abort`
+	 * ends the session's run when the turn is stopped; by default the session's own abort.
+	 */
+	constructor(
+		session: SteeringSession,
+		canSteer: () => boolean,
+		abort: () => void = () => void session.abort(),
+	) {
 		this.#session = session;
 		this.#canSteer = canSteer;
+		this.#abort = abort;
 	}
 
 	get stopped(): boolean {
@@ -106,7 +115,7 @@ export class SteerableRun {
 		if (this.#done) return false;
 		this.#stopped = true;
 		this.#session.clearQueue();
-		void this.#session.abort();
+		this.#abort();
 		return true;
 	}
 

package/src/core/runtime/thinking-level.ts

@@ -0,0 +1,47 @@
+import type {
+	AgentSession,
+	ModelRuntime,
+} from "@earendil-works/pi-coding-agent";
+import type { ChannelKey } from "../domain/conversation.ts";
+import type { TurnRequest } from "../domain/ports.ts";
+import { AUTO_THINKING, type ThinkingLevel } from "../models.ts";
+import {
+	type AgentModelSettings,
+	useChosenAgentModel,
+} from "./bridge-guard.ts";
+import type { PiAgentRuntimeOptions } from "./runtime-types.ts";
+import { lastReply } from "./turn-answer.ts";
+
+/** Uses the checked model snapshot; auto thinking keeps the last pick while the judge is unsure. */
+export async function thinkingLevel(
+	parts: {
+		modelRuntime: ModelRuntime;
+		effort: PiAgentRuntimeOptions["effort"];
+		/** The level last judged for each conversation. */
+		judged: Map<ChannelKey, ThinkingLevel>;
+	},
+	key: ChannelKey,
+	session: AgentSession,
+	request: TurnRequest,
+	agentModel?: AgentModelSettings,
+): Promise<ThinkingLevel> {
+	const { modelRuntime, effort, judged } = parts;
+	const setting = request.agent
+		? await useChosenAgentModel(
+				session,
+				modelRuntime,
+				request.agent.name,
+				agentModel,
+			)
+		: AUTO_THINKING;
+	if (setting !== AUTO_THINKING) {
+		judged.delete(key);
+		return setting;
+	}
+	const level = await effort.judge(request.text, {
+		reply: lastReply(session.messages),
+		level: judged.get(key),
+	});
+	judged.set(key, level);
+	return level;
+}

package/src/core/runtime/turn-wrapup.ts

@@ -0,0 +1,63 @@
+import type { AgentSession } from "@earendil-works/pi-coding-agent";
+import type { ChannelKey } from "../domain/conversation.ts";
+import type { TurnRequest } from "../domain/ports.ts";
+import type { ConfirmationGate } from "./extensions/confirmation-gate.ts";
+import type { PiAgentRuntimeOptions } from "./runtime-types.ts";
+
+/**
+ * What a turn leaves behind when it ends, whatever way it ended: the gate stops counting the turn,
+ * the conversation's context usage and held actions are recorded, and the turn is logged. A
+ * session disposed of under a turn that would not stop has no usage to read.
+ */
+export async function wrapUpTurn(parts: {
+	key: ChannelKey;
+	request: TurnRequest;
+	session: AgentSession;
+	gate: ConfirmationGate;
+	toolCalls: readonly string[];
+	options: Pick<PiAgentRuntimeOptions, "confirmations" | "logger">;
+	recordUsage: (usage: {
+		tokens: number | null;
+		contextWindow: number;
+	}) => void;
+}): Promise<void> {
+	const { key, request, session, gate, toolCalls, options, recordUsage } =
+		parts;
+	const { logger } = options;
+	gate.endTurn();
+	try {
+		const usage = session.getContextUsage();
+		if (usage)
+			recordUsage({
+				tokens: usage.tokens,
+				contextWindow: usage.contextWindow,
+			});
+	} catch (error) {
+		logger.warn({ channel: key, err: error }, "context usage not read");
+	}
+	const held = gate.pending();
+	await options.confirmations
+		.save(key, held)
+		// pi-lens-ignore: no-unknown-parameters — a rejection reason is unknown; it only reaches the logger
+		.catch((error: unknown) =>
+			logger.error({ channel: key, err: error }, "held actions not saved"),
+		);
+	if (held)
+		logger.info(
+			{ channel: key, held: held.calls.map((call) => call.action) },
+			"actions held for confirmation",
+		);
+	logger.info(
+		{
+			channel: key,
+			selection: request.selection.id,
+			toolCalls,
+			thinking: session.thinkingLevel,
+			// pi-lens-ignore: no-conditional-empty-object-spread — owner turns keep their log line without a model key
+			...(request.agent
+				? { model: `${session.model?.provider}/${session.model?.id}` }
+				: {}),
+		},
+		"turn finished",
+	);
+}

package/src/index.ts

@@ -113,6 +113,7 @@ export type { TurnConversation, TurnRequest } from "./core/domain/ports.ts";
 export type { TurnProgress } from "./core/domain/progress.ts";
 export type { DrainOptions } from "./core/drain.ts";
 export {
+	HostStoppingError,
 	JudgeError,
 	MigrationError,
 	NotLinkedError,