ProtectedconstructorReadonlyShutdownIdentifier surfaced in graceful-shutdown logs.
StaticInstanceProcess-wide singleton accessor (Global Object Store backed via BaseSingleton).
Overrides default tuning. Safe to call before or after Start.
The Global Object Store is a place to store global objects that need to be shared across the application. Depending on the execution environment, this could be the window object in a browser, or the global object in a node environment, or something else in other contexts. The key here is that in some cases static variables are not truly shared because it is possible that a given class might have copies of its code in multiple paths in a deployed application. This approach ensures that no matter how many code copies might exist, there is only one instance of the object in question by using the Global Object Store.
Server-authoritative MAX-DURATION enforcement (public web-widget voice cap, public-web-widget.md
W4). Closes any Active/Idle session whose stored absolute deadline (Config_.maxSessionDeadlineIso)
has passed — a hard wall-clock ceiling that fires regardless of activity, so a public voice guest
cannot run a session indefinitely (cost-bombing) even if the client ignores its own abuse guard.
Only sessions that CARRY a deadline are loaded (a cheap Config_ LIKE pre-filter), then the exact
ISO deadline is parsed and compared in JS (Config_ is JSON, not a queryable column). Stamped
CloseReason = 'Janitor', idempotent + concurrency-safe like the other sweeps. Returns the count closed.
Close every Active/Idle session owned by this exact host instance (current boot),
stamping CloseReason = 'Shutdown'. Invoked from Shutdown during the graceful
shutdown drain; exposed publicly for tests and for hosts that want to drain explicitly.
Returns the number of sessions closed.
Force-close any Active/Idle session whose LastActiveAt is older than the configured
close threshold, regardless of host. Idempotent and concurrency-safe. Returns the count closed.
Force-close any Active/Idle session left behind by a previous boot of this host
(matching hostname prefix, differing bootId). Returns the number of sessions closed.
IShutdownable: clear the timer, then drain this host's own live sessions so a
graceful stop never strands Active/Idle rows for the next boot's janitor to mop up.
Drained sessions are stamped CloseReason = 'Shutdown' (vs. 'Janitor' for crash orphans),
so the dashboards can tell a clean redeploy from a reconciled crash. Never throws; the drain
is skipped when Start was never called (no captured provider/user).
Run own-host startup recovery once, then schedule the periodic staleness sweep. Idempotent: a second call does not stack a second timer. Captures the provider + system user so the timer callback can run without re-supplying them.
OptionalintervalMs: numberStops the periodic sweep timer. Idempotent. Part of IShutdownable.
Protected StaticgetReturns the singleton instance of the class. If the instance does not exist, it is created and stored in the Global Object Store. If className is provided it will be used as part of the key in the Global Object Store, otherwise the actual class name will be used. NOTE: the class name used by default is the lowest level of the object hierarchy, so if you have a class that extends another class, the lowest level class name will be used.
OptionalclassName: string
BaseSingletonbackground reconciler that keeps the durableAIAgentSessionstate from drifting away from volatile process reality. A crash/redeploy vaporizes a host's in-memory sockets but leaves its session rows readingActive/Idleforever; the janitor force-closes those orphans.Two sweeps, both writing through SessionManager.CloseSession so Record Changes captures each transition and channel rows are disconnected consistently:
Active/Idlesession whoseHostInstanceIDbelongs to a previous boot of this host (same hostname prefix, differentbootId). Primary defense against the "Active forever" leak after a restart.Active/Idlesession whoseLastActiveAtis older thancloseThresholdMinutes, regardless of host. Catches sessions whose owner died without a clean reboot (OOM, scaled-down pod).Both sweeps stamp
CloseReason = 'Janitor'. A third, shutdown-time path — RunShutdownDrain, invoked from Shutdown during the graceful ShutdownRegistry drain — closes this exact host instance's own live sessions withCloseReason = 'Shutdown'.Both sweeps are idempotent and safe to run concurrently on every instance: closing an already-
Closedsession is a no-op, and the close path is last-writer-wins. Both page with keyset (AfterKey) pagination per the deep-pagination guide so a large backlog can't blow up memory.