feat(container-runner): report actors as crashed on unexpected platform SIGTERM

[abcxff]

No description provided.

[abcxff]

Stack for rivet-dev/actors

• #5556 fix(container-runner): read cgroup v1 memory usage under gvi …
• #5548 feat(container-runner): log version and git sha at actor sta …
• #5549 feat(container-runner): setup instance memory and cpu usage …
• #5546 fix(rivetkit): keep actor event loop alive through shutdown …
• #5539 feat(container-runner): report actors as crashed on unexpect … 👈
• #5536 feat(container-runner): log unexpected platform SIGTERM as a …
• #5530 fix(rivetkit-core): cancel driver alarm before sqlite teardo …
• #5531 feat(container-runner): keep instance warm instead of self-e …
• #5533 chore(container-runner): default stop grace to 10s
• #5528 fix(rivetkit): log and surface actor startup failures
• #5558 fix(sdks): drop rivet-util metrics dep from protocol crates …
• main

Get stack: forklift get 5539
Push local edits: forklift submit
Merge when ready: forklift merge 5539

_{change lzuymmyk}

[claude]

Review: report actors as crashed on unexpected platform SIGTERM

Summary: when the container-runner receives a platform SIGTERM (PLATFORM_RECLAIM, tracked by pre-existing code), it now walks a new ACTOR_CTXS registry (scc::HashMap<String, Ctx<GameServer>>) and calls ctx.stop_with_error(...) on every live actor before draining, so the reclaim shows up on the engine as a crash instead of a silent reallocation.

Findings

1. Test coverage gap for the actual new behavior (medium).
   container-runner/examples/e2e-test/host/run-host-tests.sh Scenario 7 already SIGTERMs the runner and checks the child process is stopped ("sending SIGTERM to pid", no_orphan), but nothing asserts the thing this PR actually adds: that the actor is reported to the engine with an error/crash stop code rather than a normal stop. Given stop_with_error vs destroy differ specifically in StopCode, consider extending Scenario 7 (or adding a new scenario) to query the actor's status via the engine API after the SIGTERM and assert it reflects the crash/error path, not just that the child process died.

2. Worth confirming: every SIGTERM is treated as an unexpected reclaim (medium, design question).
   crash_all_actors is gated only on the pre-existing PLATFORM_RECLAIM flag, which is set for any SIGTERM (as opposed to SIGINT). The hardcoded message ("likely OOM or running longer than 60 minutes") and this PR's crash-reporting both assume a SIGTERM always means an unexpected reclaim. The module doc-comment at the top of main.rs states the platform may also SIGTERM an idle instance as a normal reap path, and container platforms generally also send SIGTERM for benign reasons (rolling deploys of the runner image, node draining, capacity rebalancing) that aren't OOM or the 60-minute cap. If any of those can happen while actors are still live on the instance, this change will now report every live actor as crashed to the engine (potentially triggering crash-policy restarts/alerts) for what may be a benign shutdown. Worth confirming with whoever owns the hosting platform contract that a SIGTERM with live actors is always actually an unexpected reclaim on this platform.

3. register_ctx's remove-then-insert isn't atomic (low).

async fn register_ctx(actor_id: &str, ctx: &Ctx<GameServer>) {
    ACTOR_CTXS.remove_async(actor_id).await;
    let _ = ACTOR_CTXS.insert_async(actor_id.to_string(), ctx.clone()).await;
}

Between the remove_async and insert_async there's a brief window where actor_id is absent from the map. If crash_all_actors runs in that exact window (a signal lands mid-registration), that actor is silently skipped and never reported as crashed. Given register_ctx is only called from on_start/duplicate-start handling, this window is narrow and probably fine in practice, but an atomic upsert (e.g. entry_async(...) + overwrite) would remove the race entirely rather than relying on timing.

4. Minor: crash message duplicated three times.
   The string "...likely OOM or running longer than 60 minutes" now appears in spawn_signal_handler's two tracing::error! calls (main.rs) and again as the message passed to crash_all_actors. Not introduced fully by this diff (the log lines predate it), but this PR adds a third copy. A shared const would keep them from drifting if the wording ever changes.

What looks solid

• ACTOR_CTXS uses scc::HashMap behind a LazyLock, consistent with the repo's "never Mutex<HashMap>" rule.
• Registering the context only after a successful start (not before) correctly avoids leaking an entry for a generation whose start failed, since a failed start never runs on_destroy/on_sleep.
• crash_all_actors runs before runtime.shutdown() while the envoy is still connected, which is necessary for the crash report to actually reach the engine, and this matters given the tight SIGTERM budget.
• stop_with_error errors (e.g. a concurrent destroy already in flight) are caught and logged at debug, not error, which is appropriate since "destroy already requested" is an expected race rather than a bug.
• Comment style matches CLAUDE.md conventions (complete sentences, no em dashes).