@@ -0,0 +1,38 @@
+---
+"@objectstack/core": patch
+---
+
+The kernel's two `Promise.race` timeout guards — the startup guard around each
+plugin's `init`/`start`, and the shutdown guard around `performShutdown()` —
+now reclaim **both** halves of the guard when the race settles: the timer is
+cleared *and* the losing promise is settled (#10604).
+
+Neither site settled its loser, so the timeout promise and the reaction
+`Promise.race` held on it were retained for the life of the process — four
+leaking promises per showcase test run under `vitest --detectAsyncLeaks`, now
+zero. The two hand-rolled copies had also drifted into doing opposite halves of
+the same cleanup: the startup site cleared its timer and never `unref`'d, the
+shutdown site `unref`'d and never cleared. Both now go through one internal
+`TimeoutGuard`, so they cannot drift apart again. No exported API changes.
+
+**Behaviour change, at the shutdown guard:** the shutdown timer is no longer
+`unref()`d. Two consequences for an embedding host (CLI, auth-proxy, test
+runner):
+
+- After a **successful** shutdown, no timer is left armed. Previously the guard
+  survived its own race and stayed scheduled to fire against a kernel already
+  `'stopped'`. That late rejection was *handled* — `Promise.race` had attached a
+  rejection handler to it — so this was never an unhandled-rejection risk; it
+  was retained work and a wakeup after teardown.
+- When teardown **hangs**, the guard now actually fires. An unref'd timer does
+  not keep the event loop alive, so a process with nothing else to run could
+  exit silently — status 0, teardown incomplete — before `shutdownTimeout`
+  elapsed, leaving `Shutdown timed out — forcing exit` and its `exit(1)`
+  unreachable in exactly the case they exist for. Reclaiming on settle keeps the
+  guard ref'd exactly as long as the race is undecided, which is the guarantee
+  the startup guard already had (#4813).
+
+If your host relied on a hung `shutdown()` letting the process fall out of the
+event loop on its own, it will now wait up to `shutdownTimeout` (default 60s)
+and then hard-exit with status 1. Lower `shutdownTimeout` in the kernel config
+to shorten that window.
@@ -363,7 +363,12 @@ describe('ObjectKernel', () => {
         // unref'd and never cleared. Two hand-rolled copies of one race, each
         // doing the opposite half, and neither settling the promise the race
         // still held a reaction on — four leaking promises per showcase run.
-        // Both sites now go through `TimeoutGuard`, so these pin the wiring.
+        // Both sites now go through `TimeoutGuard`, so this pins the wiring.
+        //
+        // The companion assertion — that reclaiming the guard did not DISARM
+        // it — is 'still logs the timeout and still forces exit(1) when
+        // shutdown genuinely times out (#5274)' below, which hangs teardown
+        // past `shutdownTimeout` and is unchanged by this fix.
 
         it('leaves no timer armed once shutdown has settled', async () => {
             vi.useFakeTimers();
@@ -398,51 +403,9 @@ describe('ObjectKernel', () => {
             }
         });
 
-        it('still forces exit when teardown hangs past shutdownTimeout', async () => {
-            // The companion to the assertion above, and the one that makes it
-            // safe: reclaiming the guard must not disarm it. Dropping the
-            // `unref()` is what keeps this reachable at all — an unref'd guard
-            // lets an otherwise-idle process exit silently instead of reporting
-            // the timeout.
-            const exitSpy = vi
-                .spyOn(process, 'exit')
-                .mockImplementation((() => undefined) as never);
-
-            try {
-                const k = new ObjectKernel({
-                    logger: { level: 'error' },
-                    gracefulShutdown: false,
-                    skipSystemValidation: true,
-                    shutdownTimeout: 50,
-                });
-                const errorSpy = vi.spyOn(
-                    (k as unknown as { logger: Record<'error', (...a: unknown[]) => void> }).logger,
-                    'error',
-                );
-
-                await k.use({
-                    name: 'hanging-teardown',
-                    version: '1.0.0',
-                    init: async () => {},
-                    // Never settles: `performShutdown()` awaits every destroy().
-                    destroy: () => new Promise<void>(() => {}),
-                } as PluginMetadata);
-
-                await k.bootstrap();
-                await k.shutdown();
-
-                expect(errorSpy).toHaveBeenCalledWith(
-                    'Shutdown timed out — forcing exit',
-                    expect.objectContaining({ message: 'Shutdown timeout exceeded' }),
-                );
-                expect(exitSpy).toHaveBeenCalledWith(1);
-                expect(k.getState()).toBe('stopped');
-            } finally {
-                exitSpy.mockRestore();
-            }
-        }, 2000);
     });
 
+
     describe('Startup Failure Rollback', () => {
         it('should rollback started plugins on failure', async () => {
             let plugin1Destroyed = false;