Skip to content

core: ObjectKernel.shutdown() never removes the SIGINT/SIGTERM/SIGQUIT listeners its constructor registers, so every kernel built in a process leaves three handlers that each run shutdown and process.exit on a later signal #22286

Closed
#22334
Closed
core: ObjectKernel.shutdown() never removes the SIGINT/SIGTERM/SIGQUIT listeners its constructor registers, so every kernel built in a process leaves three handlers that each run shutdown and process.exit on a later signal#22286
#22334
Assignees
os-litant
Labels
bugSomething isn't workingdomain:enginepriority:p2Medium: important, M3

Description

@objectstack-fleet
objectstack-fleet
bot
opened on Oct 8, 2026

Filing gate: ① a product defect, reach measured through a named producer. Found by the objectstack-ai/cloud#2712 dev (os-dev-report on cloud#2712; cloud PR #2715 opts cloud's environment kernels out). Filed by the repo:cloud seat (repo:cloud#1, R45, session session_011jobP72PwN3whNm55GetXQ). ⛔ Not a claim.

The defect (read at cloud's pin 56bf27af; the same code is at main c8bb3c8d, kernel.ts:926)

  • packages/core/src/kernel.ts:129: gracefulShutdown defaults to true.
  • :224–226: the constructor calls registerShutdownSignals.
  • :902–929: one process.on(signal, <anonymous closure>) per signal, with no handle kept.
  • shutdown() (:523–600) has no process.off or removeListener. A stopped kernel's handler still runs shutdown() (it warns and returns), then calls safeExit(0).

Measured reach

Cloud's hosted runtime builds a kernel per environment for its whole life: per environment, on every rebuild and after evictions.

Same family, read only (not measured)

shutdown() calls process.exit(1) on a genuine teardown timeout (kernel.ts:581, default shutdownTimeout 60000), whatever gracefulShutdown says. In a multi-kernel host, one kernel whose teardown hangs past the timeout would end the whole host. Fold it in, or record why not.

Fix direction

  • Keep the bound handlers, and remove them in shutdown() (or on the first signal).
  • A kernel that is not the process owner should not call process.exit.

Tests

  • Listener count: after building and shutting down N kernels with the default, process.listenerCount for each signal is back to the baseline.
  • Positive control: one live kernel still handles SIGTERM and exits once.
  • Ablation: dropping the removal turns the count red.

Dedupe

A semantic search for registerShutdownSignals listener never removed shutdown gracefulShutdown SIGTERM process.exit ObjectKernel finds 1 adjacent issue, #5274 (closed: a throwing shutdown handler skipped destroy). None covers this. Dedupe words: registerShutdownSignals, gracefulShutdown listener leak, process.on SIGTERM never removed, safeExit stopped kernel, MaxListenersExceededWarning ObjectKernel.

Reader: triage routes it. By its package (packages/core) it lands in the engine lane.

Generated by Claude Code

Activity

  1. objectstack-fleet
    added
    bugSomething isn't working
    on Oct 8, 2026

  2. objectstack-fleet commented on Oct 8, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 8, 2026
    ContributorAuthor

    Triage: first grade, priority:p2 · domain:engine · pm:queue. Direction: shutdown() removes the listeners its constructor added

    Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-08T13:01Z. ⛔ Not a claim, ⛔ not a dispatch.

    Triage: lands in packages/core/src/kernel.ts (registerShutdownSignals, shutdown()) ⇒ domain:engine; rationale: packages/core is that lane's (lanes/engine.md:7).

    • Why p2: any process that builds more than one kernel with the default accumulates signal handlers. One signal then runs several process.exit calls, racing the host's drain. Cloud opted out (objectstack-ai/cloud PR fix(mcp): SKILL.md documents the business-action tools (#2714 Phase 0) #2715); every other host still has it.
    • Direction: keep the handles, remove them in shutdown(), and a stopped kernel's handler never exits the process.
    • Pins: five kernels built and stopped leave the baseline listener count. One signal produces one exit. Control: a running kernel still shuts down on a signal.
  3. objectstack-fleet
    added
    domain:engine
    pm:queue
    priority:p2Medium: important, M3
    pm:dispatched
    and removed
    pm:queue
    on Oct 8, 2026
  4. objectstack-fleet
    assigned
    os-litant
    on Oct 8, 2026

  5. objectstack-fleet commented on Oct 8, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 8, 2026
    ContributorAuthor

    Claim: PM loop round 64 · 2026-10-08T16:42Z
    Session: session_01EUBvqtauTDmHi2ZgY759p2
    Account: os-litant (the seat's linked user, as GET /user answers it; always the card's assignee)
    Branch: claude/issue-22286-kernel-signal-listeners
    Worktree: objectstack-issue-22286
    Domain: domain:engine
    Seat: domain:engine#1
    Provenance:

  6. objectstack-fleet commented on Oct 8, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 8, 2026
    ContributorAuthor

    os-dev-report

    {
    "issue": 22286,
    "status": "done",
    "branch": "claude/issue-22286-kernel-signal-listeners",
    "pr": "#22334",
    "session": "session_01EUBvqtauTDmHi2ZgY759p2 (mode:subagent, the dispatching PM session; identity is the branch)",
    "premise_still_valid": true,
    "summary": "Premise confirmed on main f2626c7: registerShutdownSignals() added anonymous SIGINT/SIGTERM/SIGQUIT listeners with no handle and shutdown() never removed them (probe: 5 built-and-stopped kernels leave +5 per signal; one SIGTERM with 5 stopped + 1 live kernel gives 6 x exit(0); 11 kernels trip MaxListenersExceededWarning). ObjectKernel now keeps its listeners in a private signalListeners map and releases them at every transition into 'stopped' (shutdown complete, shutdown timeout, failed bootstrap); only the handler whose signal started the drain exits, once; a kernel already stopping/stopped when a signal arrives logs and does not exit. Listeners are removed at 'stopped' rather than at drain start (dispatch route deviation, measured reason: keeps the existing duplicate-signal absorption so a repeated Ctrl-C mid-drain does not hit Node's default action). Family item (teardown-timeout exit(1)) NOT folded: no rule in code ties gracefulShutdown:false to process ownership and kernel.test.ts pins exit(1) under gracefulShutdown:false; raised in open_questions with four-axis analysis. PR assignee NOT set: the label-write was refused by the local permission classifier (see deviations).",
    "tests": "New packages/core/src/kernel-signal-listeners.test.ts (9 tests: N=5 build-and-stop baseline count with positive control; one signal -> one exit with 5 stopped + 1 live; control per signal: running kernel drains then exits once; repeated signal during signal-driven drain absorbed with listener still installed; signal during host-driven shutdown does not exit; failed bootstrap releases listeners; gracefulShutdown:false installs none). Reverse verification + ablations at 74a027b (source-resolved: test imports ./kernel relatively, no dist, no alias; each leg restored with git checkout HEAD -- and proven by blob 2307a7b5 == HEAD and empty git diff HEAD): Leg A kernel.ts at base f2626c7 -> 8 failed / 1 passed, one-signal pin 'expected [ +0, +0, +0, +0, +0, +0 ] to deeply equal [ +0 ]'; Leg B removal dropped via scripts/ablation-replace.mjs (anchor 1 -> 0, blob 2307a7b5 -> efc9b4e6) -> 8 failed / 1 passed, 'expected { SIGINT: 6, SIGTERM: 6, SIGQUIT: 6 } to deeply equal { SIGINT: 1, SIGTERM: 1, SIGQUIT: 1 }'; Leg C stopping/stopped guard dropped (blob -> 923bb1da) -> exactly 1 failed (host-stopping pin, 'expected [ +0 ] to deeply equal []'). Union at final head 87a1313 (origin/main 28bff18 merged; kernel.ts/test blobs unchanged 2307a7b5/f7c6469d), closure rebuilt via turbo (30 tasks ok): @objectstack/core local 80 files / 2208 passed, repo 3 files / 48 passed; @objectstack/runtime local 340 files / 4773 passed 19 skipped, repo 3 files / 751 passed; pnpm --filter @objectstack/core typecheck exit 0 (check:test-typecheck OK, ledger unchanged at 4). Pre-merge at 74a027b the same suites were green (core 80/2208 + 3/48, runtime 338/4760+19 skipped + 3/751). CJS smoke of core dist: ObjectKernel loads, listeners 0/0/0 -> 1/1/1 live -> 0/0/0 after stop. Probe before/after table is in the PR body.",
    "mcp_calls": "0",
    "api_writes": "2 REST writes: (1) fleet-write relay POST /repos/objectstack-ai/objectstack/dispatches (HTTP 204) -> run 37823686010 -> pr_create POST /repos/objectstack-ai/objectstack/pulls (draft) = PR #22334, body read back byte-identical (9159 bytes); (2) this os-dev-report comment, POST /repos//issues/22286/comments via scripts/pm/post-stamped.mjs. 1 write attempted and refused before any request by the local permission classifier: node scripts/pm/label-write.mjs --issue 22334 --assign os-litant (0 requests). git push (not REST): 5 pushes to the feature branch.",
    "open_questions": [
    {
    "question": "Family item from the card: shutdown() calls process.exit(1) on a genuine teardown timeout (kernel.ts, the shutdownTimeoutError branch) whatever gracefulShutdown says. Measured reach (probe R7, stubbed exit): a host holding two gracefulShutdown:false kernels (cloud's per-environment shape) stops one; its teardown hangs past shutdownTimeout and exit(1) fires while the sibling kernel is still running. Should a kernel that does not own the process exit it on a teardown timeout, and if not, what says who owns the process?",
    "options": [
    "A. Keep the hard exit for every kernel; correct content/docs/protocol/kernel/lifecycle.mdx, which today says gracefulShutdown:false 'stays out of the process-management business'. Business need: none served; cloud's measured multi-kernel host keeps a path where one hung environment teardown ends the whole host after 60 s (default). Long-term: keeps a known hazard, docs become true. AI-error: removes the docs/code contradiction (today the docs mislead). Startup focus: zero surface, zero code.",
    "B. Fold under the existing option: gracefulShutdown:false means 'not the process owner' for exits too; on timeout such a kernel logs at error, marks itself stopped and returns without exiting (the host decides). Business need: serves the one measured producer (cloud env kernels already set gracefulShutdown:false to stay out of the process) and matches how in-repo fixtures read the flag ('a fixture kernel must not hook the test process'). Long-term: one meaning, already the documented one; cost: the #5274 timeout pin's fixture moves to gracefulShutdown:true (its subject, timeout-vs-throw discrimination, is unchanged) and a new pin asserts no exit under false; hosts with false that relied on exit(1) after a hung teardown must exit themselves (they already own the signals). AI-error: docs, JSDoc and behaviour say the same thing; the flag's name under-describes it, so its JSDoc must state it. Startup focus: no new surface.",
    "C. A new explicit ownership option separating 'install signal listeners' from 'may exit the process'. Business need: no measured producer needs the two apart (cloud wants both off, the CLI both on). Long-term: most explicit. AI-error: one more flag to mis-set. Startup focus: widens the public surface (Clause-② yes, minor, contract-tier review) without pull - default no.",
    "D. Only the kernel's own signal handler exits on a timeout; a host-called shutdown() reports the timeout to its caller (a typed rejection) instead. Business need: precise. Long-term: principled (exit only from the owner's code path). Cost: breaks shutdown()'s documented 'never rejects' behaviour for every host, and the CLI migrate-and-exit path would exit 0 after a hang unless updated. Startup focus: contract churn."
    ],
    "recommendation": "B, because it serves the only measured producer, makes the documented contract true instead of adding surface, and costs one fixture flip on an existing pin; A if the maintainer prefers zero behaviour change, in which case the docs sentence must be corrected. Not built in this round (dispatch: no new public option without asking; folding reverses a landed pin)."
    }
    ],
    "out_of_scope_findings": [
    "carrier: open_questions[0] (the process-ownership decision) · noted, not filed — two LIVE gracefulShutdown:true kernels each drain and exit on one signal (probe R8: 2 x exit(0) before and after this PR); not a stopped-kernel case, so outside the ruling; same ownership family",
    "carrier: open_questions[0] · noted, not filed — content/docs/protocol/kernel/lifecycle.mdx says gracefulShutdown:false 'stays out of the process-management business' while the teardown-timeout exit(1) fires regardless (probe R7); option A makes it a docs fix, option B a code fix",
    "carrier: 承接者:无 · noted, not filed — a kernel constructed and never bootstrapped keeps its listeners (shutdown() on an idle kernel throws 'Kernel not running', unchanged); in PR Acceptance notes"
    ],
    "pr_body_full": {
    "body": "Fixes #22286\nClause-②: no\n\n## What was wrong\n\nWith gracefulShutdown: true (the default), the ObjectKernel constructor called registerShutdownSignals(). That added one anonymous process.on(signal, ...) listener each for SIGINT, SIGTERM and SIGQUIT and kept no handle, so shutdown() could never remove them. A stopped kernel's handler still ran shutdown(), which warned and returned, and then called safeExit(0). Every kernel a process built therefore left three handlers, and each one exited the process on the next signal.\n\n## What changes (packages/core/src/kernel.ts)\n\n- registerShutdownSignals() stores each listener in a private signalListeners map.\n- releaseShutdownSignals() removes exactly those listeners and is idempotent. It runs at every transition into stopped: shutdown() completing, the shutdown-timeout branch, and a failed bootstrap(). A stopped kernel holds no listener.\n- handleShutdownSignal() exits the process only from the handler whose signal started the drain, and only once. If the kernel is already stopping or stopped when a signal arrives, the handler logs a warning and does not exit, because whoever is stopping the kernel owns what follows.\n- The gracefulShutdown JSDoc states the listener lifetime. There is no new option, export or accept-set change.\n\nWhy the listeners are removed at stopped, not when the drain begins. The dispatch's suggested route removed them at the start of shutdown() and on the first signal. That would regress the existing duplicate-signal guard (Shutdown already in progress, ignoring SIGINT). While a kernel drains, its listener absorbs a repeated signal, for example a terminal Ctrl-C that reaches both the process group and a forwarding parent. With no listener left, that second signal gets Node's default action and kills the process mid-drain. So the listener stays installed through stopping and is removed at stopped. Pin 6 below covers this.\n\n## Before / after\n\nMeasured with a probe that stubs process.exit and invokes the listeners the kernels added, as a delivered signal would. Before = packages/core/src/kernel.ts at f2626c71db (blob 57d2340c); after = this branch (blob 2307a7b5). Counts are listeners added per signal (SIGINT / SIGTERM / SIGQUIT, always equal).\n\n| Scenario | Before | After |\n|---|---|---|\n| 5 kernels built, booted and stopped: listeners left | +5 | +0 |\n| One SIGTERM with those 5 stopped kernels plus 1 live kernel: process.exit calls | 6 × exit(0) | 1 × exit(0) |\n| Listeners left after that SIGTERM | +6 | +0 |\n| SIGTERM while the host's own shutdown() is draining: exits during the drain | 1 × exit(0) | 0 |\n| SIGINT, then SIGINT and SIGTERM again during that signal's drain: exits | 1 × exit(0), after the drain | 1 × exit(0), after the drain |\n| Listeners installed during that drain / after it | +1 / +1 | +1 / +0 |\n| Failed bootstrap(): listeners left | +1 | +0 |\n| 11 kernels built and stopped: MaxListenersExceededWarning | 3 (one per signal) | 0 |\n| Two live default kernels, one SIGTERM: exits | 2 × exit(0) | 2 × exit(0) (unchanged, see Acceptance notes) |\n| Family item: the host stops one of two gracefulShutdown: false kernels and its teardown hangs past shutdownTimeout | exit(1), other kernel still running | unchanged |\n\n## The family item: the teardown-timeout process.exit(1) is not folded in\n\n- Reach, measured in process with a stubbed exit. A host holding two gracefulShutdown: false kernels (cloud's per-environment shape) stops one of them. That kernel's teardown hangs past shutdownTimeout, and shutdown() calls process.exit(1) while the other kernel is still running.\n- Why it is not folded. No rule in the code makes gracefulShutdown: false mean "this kernel does not own the process". The only place that says so is the docs page content/docs/protocol/kernel/lifecycle.mdx: "ObjectStack ships the listeners only when gracefulShutdown: true; otherwise it stays out of the process-management business". The code pins the opposite. In kernel.test.ts, the test "still logs the timeout and still forces exit(1) when shutdown genuinely times out" builds its kernel with gracefulShutdown: false and asserts exit(1). Folding the exit under gracefulShutdown would reverse that landed pin and give an existing option a second meaning. Any other fold needs a new option, which widens the public surface. So the question goes to the maintainer with a four-axis analysis (the os-dev report on the card), and this PR leaves the timeout exit unchanged.\n\n## Tests\n\nNew file packages/core/src/kernel-signal-listeners.test.ts, 9 tests. process.exit is stubbed throughout, and listeners added during a test are removed in afterEach.\n\n1. Five kernels built and stopped leave the baseline listener count on SIGINT, SIGTERM and SIGQUIT. Positive control: a live kernel holds exactly one listener per signal.\n2. One signal produces one exit with five stopped kernels and one live kernel in the process.\n3. to 5. Control, one test per signal: a running kernel still drains (kernel:shutdown, then destroy()) and then exits once with code 0.\n6. A repeated signal during a signal-driven drain is absorbed, and the listener is still installed while the kernel is stopping. It starts no second exit.\n7. A signal that arrives while the host is stopping the kernel does not exit the process.\n8. A kernel whose bootstrap failed releases its listeners.\n9. gracefulShutdown: false installs no listener.\n\nReverse verification and ablations (one-off, run at 74a027b369). The test imports ./kernel relatively, so it reads source: no dist/ and no vitest alias are involved. Each leg restores kernel.ts with git checkout HEAD -- and proves the restore by blob hash (2307a7b5 equals HEAD) and an empty git diff HEAD.\n\n- Leg A, kernel.ts restored to the base f2626c71db and the test at HEAD: 8 failed, 1 passed (the gracefulShutdown: false control). The one-signal pin reads expected [ +0, +0, +0, +0, +0, +0 ] to deeply equal [ +0 ].\n- Leg B, removal dropped: the anchor process.removeListener(signal, listener); is replaced with a no-op through scripts/ablation-replace.mjs (anchor 1 → 0, blob 2307a7b5 → efc9b4e6). 8 failed, 1 passed. The one-signal pin reads expected { SIGINT: 6, SIGTERM: 6, SIGQUIT: 6 } to deeply equal { SIGINT: 1, SIGTERM: 1, SIGQUIT: 1 }.\n- Leg C, the stopping/stopped guard in handleShutdownSignal() dropped (blob → 923bb1da): exactly 1 failed, the host-stopping pin, expected [ +0 ] to deeply equal []. This guard has its own pin, and removing listeners alone does not cover it.\n\nSuites, run at 87a131389e. That is this branch with origin/main 28bff18d0c merged in; the merge touches neither kernel.ts nor the new test, whose blobs stay 2307a7b5 and f7c6469d. The dependency closure was rebuilt first.\n\n- @objectstack/core local project: 80 files, 2208 tests passed. Repo project: 3 files, 48 tests passed.\n- @objectstack/runtime local project: 340 files, 4773 passed, 19 skipped. Repo project: 3 files, 751 passed. Both ran against @objectstack/core built from this branch.\n- pnpm --filter @objectstack/core typecheck passed (tsc, examples, and check:test-typecheck: the test layer compiles and the ledger is unchanged at 4 entries).\n\nGates. node scripts/pm/dispatch-gates.mjs --commands at 87a131389e derives 63 commands. All 63 ran and exited 0, and --ran with the recorded exit codes reports 63 run, 0 NOT-MEASURED, 0 UNRUN. Locally, check-changeset-no-major reports its clause-② LEVEL axis as not applicable because there is no pull_request payload, so CI reads this body for it. The CI-owned jobs (Test Core shards, Dogfood, Temporal Conformance, Build Core, the workspace type-check lanes) were not run locally.\n\n## Acceptance notes\n\n- Two live kernels that both own the signals still exit twice. Each one drains and exits on the same signal, so in a real process the first exit ends the other kernel's drain. Neither kernel is stopped, so this falls outside the ruling. It is the same "who owns the process" question as the family item. Carrier: that decision.\n- A kernel that is constructed and never bootstrapped keeps its listeners. shutdown() on an idle kernel still throws Kernel not running, unchanged. Removing the listeners there would leave a kernel that is bootstrapped later with no signal handling. Carrier: none.\n- A signal during a host-driven shutdown() is now logged and left to the host, where before it exited the process at once. objectstack serve calls shutdown() itself only on the migrate-and-exit path, which then calls process.exit(0).\n- No other process-level listener. git grep over packages/core/src finds no process.on/once/addListener besides these three signals: no uncaughtException, unhandledRejection or beforeExit. Outside core, driver-sqlite-wasm's beforeExit listener already keeps its handle and removes it.\n\n---\n_Generated by Claude Code_\n"
    },
    "gates": "node scripts/pm/dispatch-gates.mjs --commands at 87a1313 (not stale vs origin/main 28bff18): 63 commands, all 63 run, all exit 0; dispatch-gates --ran with recorded exit codes: '63 run, 0 NOT-MEASURED (a DERIVED zero), 0 UNRUN'. Notable verdicts: check:nul-bytes OK (10289 files), check:doc-authoring clean, check:kernel-hook-pairs 4 pairs, check:test-source-alias OK, check:cross-package-test-inputs OK, check:dual-build-cjs-loads 106 entries / 66 packages load (at 74a027b it was PREREQUISITE NOT MET for lack of a whole-tree build; measured on the merged head), check:type-check-debt OK. check-changeset-no-major: clause-② LEVEL axis NOT APPLICABLE locally (no pull_request payload) - CI reads the PR body. CI-owned, NOT MEASURED locally: Test Core shards, Dogfood Regression Gate, Dogfood Verify CLI, Temporal Conformance, Build Core, workspace type-check lanes; CI status at report time: in_progress/not read.",
    "line_budget": "3 files, +321 / -25 (346 changed lines) vs the 5000 human-merge threshold: under. kernel.ts +84/-25, kernel-signal-listeners.test.ts +225, .changeset/22286-kernel-signal-listeners.md +12. No skills/** or governed surface touched (Tier: none).",
    "deviations": [
    "Route: listeners are removed at every transition into 'stopped', not at the start of shutdown() / on the first signal as the suggested route said. Measured reason: removing at drain start drops the existing duplicate-signal absorption, so a repeated SIGINT mid-drain would get Node's default action and end the process; pinned by test 6.",
    "label-write refused by the local permission classifier ([External System Writes]) before any request: node scripts/pm/label-write.mjs --repo objectstack-ai/objectstack --issue 22334 --assign os-litant. Not retried through any other route. Seat to perform: PR #22334 assignee os-litant. Labels due: none (the dispatch named none; skip-changeset does not apply - the PR ships a patch changeset for a published package).",
    "First full core run spelled pnpm --filter @objectstack/core test -- --maxWorkers=2: the bare -- made vitest drop --maxWorkers=2; the whole package ran as intended (80 files). The post-merge union reran without it.",
    "Merged origin/main 28bff18 into the branch (merge commit 87a1313, no conflicts, no lockfile change) because dispatch-gates flagged the 74a027b derivation STALE; suites and all 63 gates rerun on the merged head.",
    "The post-merge union (closure build + core + runtime suites + typecheck) held the verify lock 21m24s in one acquisition (runtime suite about 10 min).",
    "Before/after numbers come from a throwaway tsx probe in the scratchpad (stubbed process.exit, kernel-added listeners invoked directly); not committed."
    ],
    "files_changed": [
    ".changeset/22286-kernel-signal-listeners.md",
    "packages/core/src/kernel-signal-listeners.test.ts",
    "packages/core/src/kernel.ts"
    ]
    }

    Generated by Claude Code

  7. objectstack-fleet commented on Oct 8, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 8, 2026
    ContributorAuthor

    ACCEPT (seat review) — PR #22334 at head 87a131389e

    domain:engine#1 · session_01EUBvqtauTDmHi2ZgY759p2 (os-litant) · read at 2026-10-08T18:59Z. The dev's report is os-dev-report 6066371231. Not reviewed at contract tier: Clause-②: no, and no accept set narrows. This is a process-handler lifecycle fix; the built entry declarations differ only in gracefulShutdown's JSDoc.

    Shape

    • Draft, base main. Line 1 Fixes #22286, line 2 Clause-②: no. One closing keyword.
    • The body is the dev's, byte-identical to the report's pr_body_full.

    The change, read on the diff (packages/core/src/kernel.ts)

    • registerShutdownSignals keeps each listener in a private signalListeners map.
    • releaseShutdownSignals removes exactly those listeners and is idempotent. It runs at every transition into stopped: shutdown() complete, the shutdown timeout, and a failed bootstrap().
    • handleShutdownSignal exits only from the handler that started the drain, and only once. A signal that finds the kernel already stopping or stopped logs and leaves the decision to whoever is stopping it.
    • Triage's direction (6060458435) holds. The handles are kept and removed by the kernel's own stop. A stopped kernel holds no listener, so it never exits the process.

    Deviation, accepted: the listeners are removed at stopped, not at the start of the drain. Removing them at drain start would drop the existing duplicate-signal absorption, and a second Ctrl-C mid-drain would get Node's default action. Pin 6 holds this.

    Measured (probe with stubbed exit; base f2626c71db → head):

    case base head
    5 kernels built and stopped, listeners left per signal +5 0
    one SIGTERM with 5 stopped kernels and 1 live 6 exits 1
    failed bootstrap, listeners left +1 0
    MaxListenersExceededWarning at 11 kernels gone at head
    • Reverse-verified in three legs: base 8 failed / 1; the removal ablated 8 / 1; the state guard ablated 1, which is its own pin. Each leg was restored by blob.

    Behaviour change, stated in the changeset: a signal that arrives while the host's own shutdown() is draining is logged, and the kernel no longer exits the process. objectstack serve calls shutdown() itself only on its migrate-and-exit path, which exits afterwards.

    CI on 87a131389e, by name

    • All success: Lint & Repo Gates, TypeScript Type Check, Test Core, Dogfood Regression Gate, Build Core, Temporal Conformance and Governed Surface Queue Guard.
    • check-expected-skips OK (3 in the roster). NOT governed, 346 changed lines, git merge-tree clean.

    Family item: carried, not folded. shutdown()'s teardown-timeout process.exit(1) fires whatever gracefulShutdown says. The docs say a false kernel stays out of process management, and the #5274 pin asserts the exit under false. Which one wins is a maintainer decision, so it moved to its own card, #22335 (gate ②, needs-user-decision, the dev's four-axis analysis). This PR does not wait for it.

    Out of scope, one line each (Acceptance notes)

    PR assignee: the dev's label-write for the PR assignee was refused by its permission layer. The seat does not route a refused write around on the dev's behalf; this is raised with the maintainer. No gate reads it.

    Next: ready, then auto-merge after the ready-flip checks settle.

  8. objectstack-fleet
    closed this as completedin #22334on Oct 8, 2026

  9. objectstack-fleet commented on Oct 8, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 8, 2026
    ContributorAuthor

    Landing record: PR #22334 merged · 2026-10-08T19:30Z

    domain:engine#1 · session_01EUBvqtauTDmHi2ZgY759p2 (os-litant), claim 6064644461.

  10. objectstack-fleet
    removed
    pm:dispatched
    on Oct 8, 2026
  11. akarma-synetal
    added 2 commits that reference this issue on Oct 9, 2026

    fix(core): a stopped ObjectKernel removes its signal listeners and ne…

    e9a1f5c

    fix(core)!: a gracefulShutdown: false kernel no longer exits the proc…

    3089848
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugSomething isn't workingdomain:enginepriority:p2Medium: important, M3

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions