Daemon shutdown: session drain blocks on turns awaiting interactive tool approval

[Aaronontheweb]

Observed

On a production instance running 0.25.0-alpha.onnx.6, netclaw daemon stop failed to drain and the daemon was force-killed after 200s. The daemon was healthy and actively processing throughout the drain window — the blocker was a single session whose in-flight turn had stopped on a shell_execute call that required interactive approval (the command's cwd fell outside the session's grant directory, logged as approval_near_miss).

A turn parked on a pending human approval is human-latency-bound and cannot complete within any drain budget, so the drain waited until the coordinated-shutdown phase timeout fired:

01:41:39  Draining 3 active session(s) for daemon-stop.
01:43:57  Tool requires approval: shell_execute → approval_near_miss (cwd outside grant directory)
01:44:59  Coordinated shutdown phase [before-service-unbind] timed out after 00:03:20

Prior stops on the same instance drained in 11–22 seconds; this was the first escalation, and the difference was exactly the pending approval.

Expected

At shutdown, the drain should immediately park/persist any turn that is blocked waiting on interactive approval instead of waiting on it. Sessions are persistence-backed and resume after restart, so there is nothing to gain from holding the process open — the approval is not going to arrive faster than the drain deadline, and the pending state survives restart anyway.

Impact

Any daemon stop or upgrade that happens while any session has a pending tool approval will hang for the full drain budget and then be force-killed (see companion issue on the kill-budget race, which turns this hang into a guaranteed SIGKILL). For fleets that upgrade via systemctl stop, this makes non-graceful shutdown the default outcome whenever agents are mid-work with approvals pending.

Observed on 0.25.0-alpha.onnx.6; the session-drain logic involved is shared with dev.

[Aaronontheweb]

Companion issue for the kill-budget race that turns this hang into a guaranteed SIGKILL: #1665

[Aaronontheweb]

Root cause located in code. The SIGTERM/daemon-stop drain is the only unbounded caller of the drain helper:

• src/Netclaw.Daemon/Program.cs (~1140, drain-llm-sessions CoordinatedShutdown task) calls SessionDrainHelper.DrainAsync(sessionManager, "daemon-stop", drainLogger, CancellationToken.None).
• SessionDrainHelper.DrainAsync then does sessionManager.Ask<CommandAck>(new PrepareForDaemonRestart(...), timeout: Timeout.InfiniteTimeSpan, cancellationToken) — with CancellationToken.None, an unbounded await. A session parked on interactive approval never acks, so the only thing that ends the phase is Akka's 200s before-service-unbind phase timeout, and the abandoned drain task leaks.
• The config-reload path already does this correctly: DaemonRestartCoordinator.cs:70-76 wraps the same helper in a linked CTS with CancelAfter(_restartDrainTimeout).

Smallest safe fix: wire the existing bounded pattern from DaemonRestartCoordinator into the drain-llm-sessions call site (CTS sized safely under the 200s phase timeout, via TimeProvider). Note the drain-helper signature on dev was recently refactored to split operation vs caller cancellation tokens — the refactor updated the plumbing but not this call site, which still passes None for both, so the bug is live on dev too.