[jeremydmiller]

Fixes #5247.

Cause

DurabilityAgent built its command block with a one-argument async lambda (async batch => ...). That binds to Block(Action<T>), so every durability command ran as async void: the block considered the item done the moment the first await yielded. StopAsync() only called Complete(), but even awaiting the block couldn't have helped, and no cancellation token ever reached the command. A DeleteExpiredHandledEnvelopesCommand in flight at shutdown outlived the host and failed against the disposed NpgsqlDataSource, exactly as the issue's repro shows.

Change

• The block uses the (item, token) overload, so it owns the running command, and passes an agent-owned cancellation token into executor.InvokeAsync().
• StopAsync() disposes the timers first (no more producers), completes the block, cancels the token, then awaits the block, bounded by the caller's stop token. The CTS isn't linked or disposed, so StopAsync() is still safe to call twice (the first draft disposed it and broke 49 Postgres agent tests that stop agents more than once).
• AgentCommandHandler treats an OperationCanceledException raised after its token was cancelled as a stop, not a failure, the same way it already handles TimeoutException. That keeps the executor from logging Invocation of ... failed! for a cancelled shutdown. Genuine storage errors are still logged.

Tests

PersistenceTests/Durability/durability_agent_stops_in_flight_commands_5247.cs needs no database. The real five-second cleanup timer dispatches the real command, and a gated DbDataSource holds it at OpenConnectionAsync():

• agent removal, where the command honours cancellation: StopAsync returns with the command finished and nothing logged at Error
• agent removal, where the command is slow to cancel: StopAsync doesn't return until the command does
• host shutdown: the command is finished when host.StopAsync() returns, and nothing opens a connection afterwards

All 3 fail on main and pass with the fix.

Local verification (net9.0, Release):

• dotnet build wolverine.slnx -c Release -f net9.0: clean
• CoreTests FullyQualifiedName~Agent: 643 passed, 6 skipped
• PostgresqlTests ~urability|~Agent|~LeaderElection: 84/84

🤖 Generated with Claude Code

https://claude.ai/code/session_01DCggXgxnG3EBXoR9rrq37U