feat(container-runner): report actors as crashed on unexpected platform SIGTERM

[abcxff]

No description provided.

[abcxff]

Stack for rivet-dev/rivet

• #5557 docs(container-runner): sync deploy docs with runner source
• #5556 fix(container-runner): read cgroup v1 memory usage under gvi …
• #5548 feat(container-runner): log version and git sha at actor sta …
• #5549 feat(container-runner): setup instance memory and cpu usage …
• #5546 fix(rivetkit): keep actor event loop alive through shutdown …
• #5539 feat(container-runner): report actors as crashed on unexpect … 👈
• #5536 feat(container-runner): log unexpected platform SIGTERM as a …
• #5530 fix(rivetkit-core): cancel driver alarm before sqlite teardo …
• #5531 feat(container-runner): keep instance warm instead of self-e …
• #5533 chore(container-runner): default stop grace to 10s
• #5528 fix(rivetkit): log and surface actor startup failures
• #5529 fix(rivetkit): treat empty actor input bytes as absent
• #5558 fix(sdks): drop rivet-util metrics dep from protocol crates …
• main

Get stack: forklift get 5539
Push local edits: forklift submit
Merge when ready: forklift merge 5539

_{change lzuymmyk}

[claude]

Review

Straightforward, well-scoped change: report actors as crashed (via stop_with_error) when the platform reclaims the container with an unexpected SIGTERM, instead of letting the reclaim look like a silent reallocation to the engine.

Correctness

• The PLATFORM_RECLAIM / SIGNAL_SHUTDOWN ordering is correct: both are set before request_exit cancels EXIT, so by the time async_main wakes from EXIT.cancelled().await, effective_stop_grace() already observes the capped signal grace when crash_all_actors triggers on_destroy → stop_child.
• Registering ACTOR_CTXS only after a successful ChildProcess::spawn (not immediately in on_start) correctly avoids leaking an entry for a generation whose start failed, since a failed start never runs on_destroy/on_sleep.
• Using ctx.stop_with_error(...) (rather than ctx.destroy()) is the right primitive here — it reports StopCode::Error to the engine while still running the same local destroy-grace teardown.

Minor / nits

• register_ctx does remove_async then insert_async as two separate awaits rather than an atomic upsert. The project CLAUDE.md calls out entry_async for atomic read-then-write on scc maps. In practice this is safe today because Pegboard's single-writer invariant means on_start for a given actor_id can't run concurrently with itself, so it's not an exploitable race today — just flagging as a small inconsistency with the project's own scc guidance in case that invariant ever loosens.
• The "likely OOM or running longer than 60 minutes" explanation is now duplicated across three log/message sites (two pre-existing in spawn_signal_handler, one new in the crash_all_actors call) with slightly different wording each time. Worth pulling into a shared const so the phrasing (and the "60 minutes" figure, if the platform's actual budget ever changes) can't drift between the copies.
• No tests were added for register_ctx/crash_all_actors/ACTOR_CTXS. The crate already has a tests/inline pattern (boot_id.rs); a small unit test asserting that a failed start leaves no ACTOR_CTXS entry, or that crash_all_actors drains the map, would pin down the invariant the comments describe.

Not a blocker, just noting for awareness: if the platform sends SIGTERM while an actor is mid-on_start (child process still spawning, before register_ctx runs), that actor won't get a crash report — it'll just be silently swept later by stop_all_children. That's a narrow, pre-existing gap (not introduced by this PR) and probably fine given engine-side start timeouts, but worth confirming it's an accepted limitation.

Overall this looks solid and matches the codebase's scc/async-lock/error-handling conventions. Nothing here blocks merging.