@@ -0,0 +1,12 @@
+---
+'@objectstack/core': patch
+---
+
+fix(core): a stopped `ObjectKernel` removes its SIGINT/SIGTERM/SIGQUIT listeners and never exits the process
+
+Clause-②: no
+
+- **What was wrong.** With `gracefulShutdown: true` (the default) the constructor added one listener per signal and kept no handle, so `shutdown()` never removed them. Every kernel a process built left three listeners behind, and each one called `process.exit(0)` on the next signal. A process that had built and stopped five kernels and still ran a sixth exited six times on one SIGTERM, and the first exit landed before the live kernel had drained. Eleven built-and-stopped kernels also tripped Node's `MaxListenersExceededWarning`.
+- **What a kernel does now.** It holds its listeners from construction until it reaches `stopped`, and removes them at that point, whichever way it got there: `shutdown()` completing, the shutdown timeout, or a failed `bootstrap()`. A stopped kernel has no listener, so it cannot handle a signal. While a kernel is `stopping` its listener stays installed, so a repeated signal is absorbed and does not trigger Node's default action mid-drain.
+- **Who exits the process.** Only the handler whose signal started the drain, and only once. A signal that arrives while the host is already stopping the kernel through `shutdown()` is logged and left to the host. The kernel no longer exits the process in that case.
+- **Unchanged.** A running kernel still drains and exits with code 0 on SIGINT, SIGTERM or SIGQUIT (code 1 if `shutdown()` throws). `gracefulShutdown: false` still installs nothing. A genuine shutdown timeout still calls `process.exit(1)`.
@@ -0,0 +1,225 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The process signal listeners an `ObjectKernel` installs (`gracefulShutdown`,
+ * default `true`) belong to that kernel's LIFE, not to the process's.
+ *
+ * Before this file the constructor added one anonymous listener per signal
+ * (SIGINT, SIGTERM, SIGQUIT), kept no handle, and `shutdown()` never removed
+ * them. Every kernel a process built therefore left three handlers behind, and
+ * each of them ran `shutdown()` (a no-op on a stopped kernel) and then
+ * `process.exit(0)` on the next signal: five built-and-stopped kernels plus a
+ * live one turned ONE signal into six exits, the first of them landing before
+ * the live kernel had drained.
+ *
+ * How a signal is simulated here, and why not with `process.kill`: a real
+ * signal reaches EVERY listener in the worker, the test runner's own included,
+ * and its default action ends the worker. `deliver()` instead calls the
+ * listeners this test's kernels added — exactly the set a delivered signal
+ * would run on their behalf, in the same order — and `process.exit` is stubbed
+ * throughout, so nothing here can end the run.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { ObjectKernel } from './kernel';
+import type { ObjectKernelConfig } from './kernel';
+import type { Plugin } from './types';
+
+const SIGNALS = ['SIGINT', 'SIGTERM', 'SIGQUIT'] as const;
+type ShutdownSignal = (typeof SIGNALS)[number];
+type SignalListener = (signal: NodeJS.Signals) => void;
+
+const NONE = { SIGINT: 0, SIGTERM: 0, SIGQUIT: 0 };
+const ONE_EACH = { SIGINT: 1, SIGTERM: 1, SIGQUIT: 1 };
+
+describe('ObjectKernel process signal listeners', () => {
+    let baseline: Map<ShutdownSignal, SignalListener[]>;
+    let exits: Array<string | number | null | undefined>;
+    let exitSpy: { mockRestore: () => void };
+
+    beforeEach(() => {
+        baseline = new Map(SIGNALS.map((s) => [s, process.listeners(s) as SignalListener[]]));
+        exits = [];
+        exitSpy = vi.spyOn(process, 'exit').mockImplementation(((code?: string | number | null) => {
+            exits.push(code);
+        }) as never);
+    });
+
+    afterEach(() => {
+        // Leave the worker as it was found whatever the test did: on a tree
+        // without the fix, the defect under test IS a listener left behind.
+        for (const s of SIGNALS) {
+            for (const l of added(s)) process.removeListener(s, l);
+        }
+        exitSpy.mockRestore();
+    });
+
+    /** The listeners kernels built in this test hold on `signal`, oldest first. */
+    const added = (signal: ShutdownSignal): SignalListener[] =>
+        (process.listeners(signal) as SignalListener[]).filter((l) => !baseline.get(signal)!.includes(l));
+
+    const growth = () => ({
+        SIGINT: added('SIGINT').length,
+        SIGTERM: added('SIGTERM').length,
+        SIGQUIT: added('SIGQUIT').length,
+    });
+
+    /** What a delivered `signal` does to those listeners: every one runs, in order. */
+    const deliver = (signal: ShutdownSignal) => {
+        for (const l of added(signal)) l(signal);
+    };
+
+    /** One macrotask: every handler that was going to reach `process.exit` has reached it. */
+    const quiesce = () => new Promise<void>((resolve) => setTimeout(resolve, 0));
+
+    const newKernel = (config: ObjectKernelConfig = {}) =>
+        new ObjectKernel({ logger: { level: 'silent' }, skipSystemValidation: true, ...config });
+
+    /** A plugin whose `kernel:shutdown` subscriber holds teardown open until released. */
+    const drainGate = (reached: string[] = []) => {
+        let release!: () => void;
+        const gate = new Promise<void>((resolve) => { release = resolve; });
+        const plugin: Plugin = {
+            name: 'drain-gate',
+            version: '1.0.0',
+            init: async (ctx) => {
+                ctx.hook('kernel:shutdown', async () => {
+                    await gate;
+                    reached.push('drained');
+                });
+            },
+            destroy: async () => { reached.push('destroy'); },
+        };
+        return { plugin, release: () => release() };
+    };
+
+    it('five kernels built and stopped leave the baseline listener count on SIGINT, SIGTERM and SIGQUIT', async () => {
+        for (let i = 0; i < 5; i++) {
+            const kernel = newKernel();
+            // Positive control: a live kernel DOES hold one listener per
+            // signal, so the zero below is a removal and not an absence.
+            expect(growth()).toEqual(ONE_EACH);
+            await kernel.bootstrap();
+            await kernel.shutdown();
+            expect(growth()).toEqual(NONE);
+        }
+        expect(exits).toEqual([]);
+    });
+
+    it('one signal produces one exit with five stopped kernels and one live kernel in the process', async () => {
+        for (let i = 0; i < 5; i++) {
+            const stopped = newKernel();
+            await stopped.bootstrap();
+            await stopped.shutdown();
+        }
+        const live = newKernel();
+        await live.bootstrap();
+        const listening = growth();
+
+        deliver('SIGTERM');
+        await vi.waitFor(() => expect(live.getState()).toBe('stopped'));
+        await quiesce();
+
+        expect(exits).toEqual([0]);
+        // Only the live kernel was listening, and it gave its listeners back too.
+        expect(listening).toEqual(ONE_EACH);
+        expect(growth()).toEqual(NONE);
+    });
+
+    // Control: the defect fix must not cost the one thing these listeners are
+    // for. `objectstack serve` installs no signal handler of its own and relies
+    // on exactly this path to drain and exit.
+    it.each(SIGNALS)('a running kernel still drains and exits once on %s', async (signal) => {
+        const reached: string[] = [];
+        exitSpy.mockRestore();
+        exitSpy = vi.spyOn(process, 'exit').mockImplementation(((code?: string | number | null) => {
+            exits.push(code);
+            reached.push(`exit:${String(code)}`);
+        }) as never);
+        const { plugin, release } = drainGate(reached);
+        const kernel = newKernel();
+        await kernel.use(plugin);
+        await kernel.bootstrap();
+
+        deliver(signal);
+        release();
+        await vi.waitFor(() => expect(kernel.getState()).toBe('stopped'));
+        await quiesce();
+
+        // Teardown ran to the end BEFORE the process was exited, and exactly once.
+        expect(reached).toEqual(['drained', 'destroy', 'exit:0']);
+        expect(exits).toEqual([0]);
+        expect(growth()).toEqual(NONE);
+    });
+
+    it('a repeated signal during a signal-driven drain is absorbed by the kernel and starts no second exit', async () => {
+        const { plugin, release } = drainGate();
+        const kernel = newKernel();
+        await kernel.use(plugin);
+        await kernel.bootstrap();
+
+        deliver('SIGINT');
+        await vi.waitFor(() => expect(kernel.getState()).toBe('stopping'));
+        // Still installed while draining. A terminal's Ctrl-C can reach the
+        // process twice (the process group, and a parent that forwards it);
+        // with no listener left, Node's default action would end the process
+        // in the middle of the drain this signal started.
+        expect(growth()).toEqual(ONE_EACH);
+        deliver('SIGINT');
+        deliver('SIGTERM');
+        await quiesce();
+        expect(exits).toEqual([]);
+
+        release();
+        await vi.waitFor(() => expect(kernel.getState()).toBe('stopped'));
+        await quiesce();
+
+        expect(exits).toEqual([0]);
+        expect(growth()).toEqual(NONE);
+    });
+
+    it('a signal that arrives while the host is stopping the kernel does not exit the process', async () => {
+        const { plugin, release } = drainGate();
+        const kernel = newKernel();
+        await kernel.use(plugin);
+        await kernel.bootstrap();
+
+        const stopping = kernel.shutdown();
+        expect(kernel.getState()).toBe('stopping');
+        deliver('SIGTERM');
+        await quiesce();
+        // The host owns this shutdown and what follows it; the drain it
+        // started is still running and must not be cut short.
+        expect(exits).toEqual([]);
+
+        release();
+        await stopping;
+        await quiesce();
+
+        expect(kernel.getState()).toBe('stopped');
+        expect(exits).toEqual([]);
+        expect(growth()).toEqual(NONE);
+    });
+
+    it('a kernel whose bootstrap failed releases its listeners', async () => {
+        const kernel = newKernel();
+        await kernel.use({
+            name: 'init-thrower',
+            version: '1.0.0',
+            init: async () => { throw new Error('init boom'); },
+        });
+        await expect(kernel.bootstrap()).rejects.toThrow('init boom');
+
+        expect(kernel.getState()).toBe('stopped');
+        expect(growth()).toEqual(NONE);
+        expect(exits).toEqual([]);
+    });
+
+    it('gracefulShutdown: false installs no listener at all', async () => {
+        const kernel = newKernel({ gracefulShutdown: false });
+        expect(growth()).toEqual(NONE);
+        await kernel.bootstrap();
+        await kernel.shutdown();
+        expect(growth()).toEqual(NONE);
+    });
+});
@@ -69,7 +69,12 @@ export interface ObjectKernelConfig {
     /** Default plugin startup timeout in milliseconds */
     defaultStartupTimeout?: number;
 
-    /** Whether to enable graceful shutdown */
+    /**
+     * Whether to enable graceful shutdown. When true (the default) the kernel
+     * listens for SIGINT, SIGTERM and SIGQUIT from construction until it stops:
+     * a signal drains it and then exits the process. Its listeners are removed
+     * when it reaches `stopped`, so a stopped kernel never handles a signal.
+     */
     gracefulShutdown?: boolean;
 
     /** Graceful shutdown timeout in milliseconds */
@@ -116,6 +121,23 @@ export class ObjectKernel {
      */
     private pluginStartupDurations: Map<string, number> = new Map();
     private shutdownHandlers: Array<() => Promise<void>> = [];
+    /**
+     * The process signal listeners this kernel installed (`gracefulShutdown`),
+     * kept so the kernel can take them back (#22286). Filled by
+     * `registerShutdownSignals()` and emptied by `releaseShutdownSignals()` at
+     * every transition into `stopped`. Before this map the listeners were
+     * anonymous and never removed: every kernel a process built left three of
+     * them behind, and each ran `process.exit(0)` on the next signal, so one
+     * SIGTERM in a process that had built six kernels exited it six times —
+     * the first exit landing while the live kernels were still draining.
+     */
+    private signalListeners: Map<NodeJS.Signals, () => void> = new Map();
+    /**
+     * Set by this kernel's own signal handler when IT starts the shutdown. Only
+     * that handler exits the process, and only once (a repeated signal during
+     * its drain is absorbed, not acted on).
+     */
+    private signalShutdownStarted = false;
     /**
      * Name of the plugin whose init() is currently executing (Phase 1 is
      * sequential, so at most one). Lets a getService miss during init name
@@ -513,6 +535,9 @@ export class ObjectKernel {
             this.logger.info('✅ Bootstrap complete');
         } catch (error) {
             this.state = 'stopped';
+            // A kernel whose boot failed is stopped for good (`shutdown()` on it
+            // is a no-op), so this is the only place its listeners can go.
+            this.releaseShutdownSignals();
             throw error;
         }
     }
@@ -566,9 +591,11 @@ export class ObjectKernel {
             );
 
             this.state = 'stopped';
+            this.releaseShutdownSignals();
             this.logger.info('✅ Graceful shutdown complete');
         } catch (error) {
             this.state = 'stopped';
+            this.releaseShutdownSignals();
 
             if (error === shutdownTimeoutError) {
                 // GENUINE timeout: `performShutdown()` is still running and has
@@ -899,32 +926,64 @@ export class ObjectKernel {
         return resolvePluginOrder(this.plugins);
     }
 
+    /**
+     * Listen for the shutdown signals for as long as this kernel lives (#22286).
+     * Each listener is kept in `signalListeners`, so `releaseShutdownSignals()`
+     * can remove exactly the ones this kernel added and nobody else's.
+     */
     private registerShutdownSignals(): void {
+        if (!isNode) return;
         const signals: NodeJS.Signals[] = ['SIGINT', 'SIGTERM', 'SIGQUIT'];
-        let shutdownInProgress = false;
-        
-        const handleShutdown = async (signal: string) => {
-            if (shutdownInProgress) {
-                this.logger.warn(`Shutdown already in progress, ignoring ${signal}`);
-                return;
-            }
-            
-            shutdownInProgress = true;
-            this.logger.info(`Received ${signal} - initiating graceful shutdown`);
-            
-            try {
-                await this.shutdown();
-                safeExit(0);
-            } catch (error) {
-                this.logger.error('Shutdown failed', error as Error);
-                safeExit(1);
-            }
-        };
-        
-        if (isNode) {
-            for (const signal of signals) {
-                process.on(signal, () => handleShutdown(signal));
-            }
+        for (const signal of signals) {
+            const listener = () => { void this.handleShutdownSignal(signal); };
+            this.signalListeners.set(signal, listener);
+            process.on(signal, listener);
+        }
+    }
+
+    /**
+     * Give the process's signals back: remove every listener this kernel added.
+     * Idempotent. Called at each transition into `stopped` and deliberately NOT
+     * when the drain begins — while the kernel is `stopping` its listener is
+     * what absorbs a repeated signal (a terminal's Ctrl-C can arrive twice: once
+     * to the process group and once from a parent that forwards it). With no
+     * listener left, Node's default action would end the process mid-drain.
+     */
+    private releaseShutdownSignals(): void {
+        for (const [signal, listener] of this.signalListeners) {
+            process.removeListener(signal, listener);
+        }
+        this.signalListeners.clear();
+    }
+
+    /**
+     * One signal, at most one exit — and only from the handler that started
+     * the drain. A kernel that is already `stopping` or `stopped` when the
+     * signal arrives was stopped by someone else (the host calling
+     * `shutdown()`), who owns what happens next: exiting here would cut that
+     * drain short, which is how the first of six exits used to land.
+     */
+    private async handleShutdownSignal(signal: NodeJS.Signals): Promise<void> {
+        if (this.signalShutdownStarted) {
+            this.logger.warn(`Shutdown already in progress, ignoring ${signal}`);
+            return;
+        }
+        if (this.state === 'stopping' || this.state === 'stopped') {
+            this.logger.warn(
+                `Received ${signal} while the kernel is already ${this.state} — whoever is stopping it decides what follows; this kernel will not exit the process`,
+            );
+            return;
+        }
+
+        this.signalShutdownStarted = true;
+        this.logger.info(`Received ${signal} - initiating graceful shutdown`);
+
+        try {
+            await this.shutdown();
+            safeExit(0);
+        } catch (error) {
+            this.logger.error('Shutdown failed', error as Error);
+            safeExit(1);
         }
     }