• fix(rivetkit-core): gate startup until runtime is ready #4736 : 2 dependent PRs (#4737 , #4739 )
• fix(rivetkit-sqlite): preserve text with embedded nul bytes #4735
• chore(rivetkit): add child spans for logging #4734 👈 (View in Graphite)
• fix(rivetkit-core): orphan engine process and detect crashes #4733
• fix(rivetkit-core): return None for empty inspector state to avoid frontend CBOR decode error #4732
• fix(rivetkit-core): don't install tokio::signal::ctrl_c() handler inside serve_with_config #4731
• refactor(rivetkit-core): use subtle::ConstantTimeEq for inspector token verify #4730
• fix(rivetkit): drop is_read_only_sql classifier, surface RETURNING rows #4728
• docs: require close-code rejection for websocket auth/policy failures #4727
• fix(rivetkit): inspector reports actual config state + real queue messages #4726
• fix(rivetkit-napi): plumb ctx through serializeState TSF and stop panicking on runtime_state Ref drop #4725
• chore(rivetkit): remove legacy metrics & prometheus auth #4724
• chore(rivetkit): remove legacy metrics #4723
• chore(rivetkit): impl inspector token #4722
• chore: disable auth on serverless #4721
• chore: fix cors for envoys #4720
• chore: fix serverless in rivetkit-core #4719
• chore(rivetkit): impl follow up review #4711
• chore: rivetkit core/napi/typescript follow up review #4702
• chore: fix remaining issues with rivetkit-core #4701
• chore: sqlite v1 to v2 data migration #4692 : 1 other dependent PR (#4640 )
• chore: move rivetkit to task model #4680
• chore: rivetkit to rust #4679
• feat(rivetkit): sqlite vfs v2 #4673
• chore: rename sandbox -> kitchen sink #4671 : 1 other dependent PR (#4672 )
• chore: configure TLS trust roots for rustls clients #4667
• fix(rivetkit): update config to match envoys & remove manager references #4663
• chore(publish): pin docker base image refs #4652
• chore(engine): publish engine bases in ci #4649 : 2 other dependent PRs (#4650 , #4666 )
• chore: lockfile lefthook #4647
• fix(rivetkit): surface native sqlite kv errors to callers #4645
• fix(rivetkit): prevent sleep races during disconnect and db work #4644
• fix(rivetkit): isolate engine envoys and propagate startup failures #4643
• test(rivetkit): remove wasm sqlite-only fixtures and coverage #4642
• chore(sqlite-vfs): remove wasm sqlite packages and workspace wiring #4641
• chore(rivetkit): remove wasm sqlite runtime #4614
• fix(sqlite-native): restore native startup kv preload #4639
• fix(sqlite-native): delete metadata before chunk range #4638
• fix(sqlite-native): keep truncate cache coherent #4637
• fix(sqlite-vfs): use delete range for truncate cleanup #4636
• fix(sqlite-native): restore kv error hook #4635
• perf(sqlite-native): avoid cloning cached read chunks #4634
• perf(sqlite-native): gate kv operation labels #4633
• perf(sqlite-native): reuse read cache for partial writes #4632
• perf(sqlite-native): remove delete file existence probe #4631
• fix(sqlite-native): gate native read cache behind env var #4630
• fix(pegboard): isolate runner config dc lookup failures #4625 : 1 other dependent PR (#4626 )
• docs(pegboard): note runner config upsert split write risk #4624
• fix(pegboard): unpack global runner config keys correctly #4623
• fix(pegboard-gateway): enforce tunnel message state #4622
• fix(pegboard-runner): clear terminal tunnel routes #4621
• fix(pegboard): skip protocol version keys in runner pool backfill #4620
• fix(pegboard): create missing normal runner configs #4619
• fix(epoxy): reuse cached optimistic value #4618
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

PR Review: chore(rivetkit): add child spans for logging

This PR bundles three concerns: tracing/span propagation, a new graceful shutdown system, and a switch to JSON log format. The core architecture is solid. The RegistryState machine and the watch-based stop latch are well-designed. A few issues worth addressing before merging.

Log Level Density

dispatch_action_through_task emits 5 info!-level lines per action call: three in registry/dispatch.rs (before send, after queue, after reply) plus two more in ActorTask::run action match arm. Under load these will dominate log volume. Downgrade to debug! or trace!. Same for inspector_ws.rs where each websocket message exchange emits several info! lines.

Duplicate Constant

SHUTDOWN_DRAIN_TIMEOUT: Duration = Duration::from_secs(20) is defined independently in both rivetkit-core/src/registry/mod.rs and rivetkit-core/src/serverless.rs. Extract to a shared location to prevent drift.

Redundant Structured Fields

dispatch_event is instrumented with actor_id = %ctx.inner().actor_id() via #[tracing::instrument], but inner tracing::info! / tracing::warn! calls in the ActorEvent::Action branch also log actor_id manually. The span already carries the field — the inline copies are redundant.

format_actor_key Re-export

format_actor_key is re-exported from the rivetkit_core crate root in lib.rs. This helper exists purely for formatting log fields and does not belong on the public crate surface. Keep it pub(crate) or mark it #[doc(hidden)].

Comment Style Violations

A few new comments use the dash/colon pattern CLAUDE.md discourages (e.g. // not_global: true to avoid caching...). Per CLAUDE.md: write complete sentences, avoid dash-separated clauses.

Missing Trailing Newline

rivetkit-rust/engine/artifacts/errors/registry.shut_down.json is missing a trailing newline. All other error artifacts in that directory have one.

spawn_task Allocates actor_id: String Unconditionally

The spawn_task helper in napi_actor_events.rs takes actor_id: String but only uses it in a single error log path. This allocates per call even on the happy path. Consider &str / Cow<str> or inlining the field at the call site.

Shutdown During Build Race

In registry.rs (NAPI), when shutdown() fires while state is BuildingServerless, the transition to ShutDown relies on the builder task completing normally. If the builder is cancelled mid-await the state could be stuck in ShuttingDown. A timeout guard or an explicit drop-to-ShutDown in the builder error path would make this more robust.

Test Coverage Gaps

The new RegistryState machine and shutdown_and_wait path have no unit tests. Tests covering concurrent ensure_serverless_runtime calls, shutdown() racing with an in-progress build, and wait_stopped under the drain timeout would significantly increase confidence. The TypeScript #runShutdown timeout path also has no coverage.

Minor: stopped_tx in Test Helpers

stopped_tx in test helpers is initialized with watch::channel(true).0 (pre-latch = already stopped). Fine for tests that do not call wait_stopped(), but could silently mask bugs in tests that use wait_stopped to verify an actual shutdown sequence.

Landed in main via stack-merge fast-forward push. Commits are in main; closing to match.