- tick: the lease is asked every WATCH_MS (250 ms); a loss SIGKILLs the worker group at once (the bound is about a second, not the 5 s service-document tick)
- mayWrite() = not stopping and held(); guard() and the worker-output sink both read it
- shutdown: stopping first, listener closed, then the worker tree is stopped, then exit 0
- canonicalPath(): args.stateRoot is realpath'd once; lock name, reclaim marker and the worker environment derive from it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>