fix(runtime): retain the cache watchdog after flush failures

[loopx-agent]

Problem And Result

After a compile-cache flush threw, the drained runtime discarded its ready watchdog and sent self-SIGKILL from the main Node environment. Node runs that environment's native exit callbacks before the OS kill, which could retry the cache write the failure path intended to abandon.

Keep the cache-disabled watchdog armed after a thrown flush and retire under the existing locator fence and one-second allowance. Healthy persistence still completes; admitted effects drain before retirement, and replacement locators retain their lock/token/PID/fingerprint protection. The new actual-cache-file negative fails on baseline ec327628fa18df4b772350851ac7e26796624422 and passes with this repair. This identifies unsafe native-hook re-entry, without claiming the cause of every intermittent Windows failure.

Sources: the native Windows failure, Node24.21's self-kill hook, and the after-drain/cache-retirement contract in docs/development/testing-and-quality.md.

Source And Ownership

Author head b290547c9313f7b5ac5c2170a72c38b9dcb0bc36 integrates selected main a99cb07addfc163fda9435c6455cc9462b657855 with previous author head 736ba7d960a2b1d60576f466b9b12bf0b7d61302. The five repair-file blobs are unchanged; the current session-wide worker-isolation fixture is included.

Natural hosted checkout b17e3703563b90d7cb047f91168616fa9b3c960a has parents a99cb07 + b290547 and the same entire Git tree as the author head. The native results below come from this new cohort. Older checkout 9799d6042c9aaebf14e232c118f0a9db58ca3f3e remains historical evidence only.

Written by: model_agent, OpenAI Codex (GPT-6 family). Current repository instructions and CODEOWNERS apply. TypeScript remains the shutdown owner; no new launcher, configuration, capability or Python decision rule. The bounded companion refactor unifies failed/overdue waiting and corrects a misleading helper name. Diagnostic event names and boolean thread identity stay local to test observations.

Validation

Inputs: synthetic and public_fixture; failure injection uses disposable isolated runtime state. Local checks ran on the author integration; hosted logs and uploaded artifacts bind the exact checkout above.

Check kind	Result	Decisive evidence
integration / real_entrypoint / real_backend	passed locally	uv run --extra test python -m pytest -q tests/control_plane/test_effect_runtime_integration.py:97 passed,0 skipped/failed/errors on each of real Node22.22.3 and Node24.21.0, Python3.12/macOS. Real journals, sockets, cache files, locks and OS processes; blocked writes cross two idle windows before journal/PID readback.
unit / regression_parity	passed locally	Compile-cache17 plus runtime-IO15:32 passed per Node version. Healthy/off parity; actual cache-file negatives for thrown/blocked/late flush; occupied-fence and replacement cases.
static / manual / integration	passed locally	TS typecheck, Ruff, semantic advisory then full vocabulary check, maintainability and five-path public scan. Current exact-scope author receipt cqr_69cb90840f404bca5a0a verifies. Actual premerge execution:4 direct +11 selected passed,0 failures/advisories/timeouts/holds. An unexecuted preview mislabel is not an executed result or baseline waiver. This is author evidence, not independent review.
integration / real_entrypoint	passed on native Windows	Current Windows job:all23 steps succeeded. Node24.21 lifecycle217 passed/19 skipped, legacy27; Node22.22.3 SQLite CLI9 and scheduler/SQLite TS432. python.exe-only Chat rebuild and verification passed.
integration / regression_parity	passed on Linux,43 skipped	Current Node22.22.3 group1, group2, group3:4754 passed/43 skipped/0 failed. Group1 includes the actual persistence-fault and locator-fence/replacement assertions.
integration / real_backend	passed on real PostgreSQL	Isolated PostgreSQL16.15 job:live conformance349/0 skipped and service admission11/0 skipped. Uploaded report binds the clean checkout; its archive SHA256 matches GitHub's artifact digest.

Remaining Qualification

At readback the current Python workflow has30 materialized jobs:22 success,2 expected skips and six pending Python shards with no runners or steps. Complete Python results, JUnit/coverage union and full merge readiness are unqualified. No review was present at this readback; this completed proposal remains a normal PR.

Separately, CI Maintenance failed while waiting for cancellation of superseded 736ba7d run 38781049281. That older run subsequently reads completed/cancelled; this does not make the failed cleanup check or incomplete full qualification green.

Worker-startup failure retains the existing main-thread best-effort fallback, which cannot guarantee bypassing the native cache hook. Robust unavailable-worker handling, historical intermittent Windows root cause and sustained operation remain open in the existing runtime reliability work. One source-bound native composition does not establish a latency/SLO guarantee, cost savings or hard release priority. No local green suite was repeated or manual hosted run dispatched for this readback.

The ready-worker repair is independently reviewable and reversible. No timeout, cache default, effect admission/replay rule, permission or authority boundary is relaxed. Existing S4/S10/S12 acceptance remains open. Exact-head review, required validation and explicit maintainer merge authority remain separate gates; this update includes no merge, installation or resource change.

Delivery Boundary

UI impact:none. This internal shutdown repair adds no frontend, Lark or CLI operation, editor, first viewport or visual surface; screenshots and first-screen approval do not apply. The five authored paths remain one reproduced defect plus its documentation and regression coverage. All author/integration commits carry DCO sign-off. Public diff and description exclude private state, credentials, raw traces, internal links and local machine paths.