- server.mjs tracks in-flight chats: browser disconnects abort the
queued turn (releasing its slot), and SIGTERM/SIGINT cancels every
in-flight turn so no Hermes subprocess is orphaned.
- vision-service forwards a per-request AbortSignal combined with the
provider deadline via AbortSignal.any.
- acceptance suites cover overload fallback, urgent bypass under
saturation, disconnect cleanup, recovery, and shutdown orphan checks.
- zero-call invariant tests prove urgent text never reaches Hermes or
the vision provider under load.
