fix: harden server lifecycle controls

Docs/Reference/Modules/Magnetar.Protocol.md

@@ -2,7 +2,7 @@
 
 *Module `Magnetar.Protocol` — 29 files.* See the [handbook TOC](../TOC.md) and the [file Index](../Index.md).
 
-Shared `netstandard2.0` contract library referenced by the Quasar supervisor, the in-DS [Quasar.Agent](Quasar.Agent.md), and [Quasar.Bootstrap](Quasar.Bootstrap.md). It defines the entire agent↔supervisor wire protocol: the tagged-union `AgentWireMessage` envelope with `WireMessageKind` discriminators, the server-command request/response triple (`ServerCommandEnvelope` / `ServerCommandResult` / `ServerCommandType`), the handshake (`AgentHello`) and periodic telemetry (`AgentSnapshot` carrying `ServerMetrics`, `PlayerSnapshot`, chat/death events and plugin info), the entity-browser and plugin-config DTOs, the `WebServiceDiscoveryManifest` used to locate a running supervisor, the `IQuasarConfigProvider` bridge, and runtime helpers (`MagnetarPaths`, `QuasarActiveReleasePointer`, `QuasarReleaseVersion`, `QuasarWebReleaseLayout`). It has zero external dependencies by design so it can also load inside the .NET-Framework game process.
+Shared `netstandard2.0` contract library referenced by the Quasar supervisor, the in-DS [Quasar.Agent](Quasar.Agent.md), and [Quasar.Bootstrap](Quasar.Bootstrap.md). It defines the entire agent↔supervisor wire protocol: the tagged-union `AgentWireMessage` envelope with `WireMessageKind` discriminators, the server-command request/response triple (`ServerCommandEnvelope` / `ServerCommandResult` / `ServerCommandType`), the handshake (`AgentHello`) and periodic telemetry (`AgentSnapshot` carrying `ServerMetrics`, `PlayerSnapshot`, chat/death events, PluginSdk command suggestions, and plugin info), the entity-browser and plugin-config DTOs, the `WebServiceDiscoveryManifest` used to locate a running supervisor, the `IQuasarConfigProvider` bridge, and runtime helpers (`MagnetarPaths`, `QuasarActiveReleasePointer`, `QuasarReleaseVersion`, `QuasarWebReleaseLayout`). It has zero external dependencies by design so it can also load inside the .NET-Framework game process.
 
 ## Files
 
@@ -12,7 +12,7 @@ Shared `netstandard2.0` contract library referenced by the Quasar supervisor, th
 | [Magnetar.Protocol/Discovery/WebServiceDiscoveryManifest.cs](../files/Magnetar.Protocol/Discovery/WebServiceDiscoveryManifest.cs.md) | class | Plain DTO written by the Quasar supervisor to `service-manifest.json` (path resolved by `MagnetarPaths.GetWebServiceManifestPath()`) so that Quasar.Bootstrap and other local processes can discover the running Quasar web service without a pre-configured port. |
 | [Magnetar.Protocol/Magnetar.Protocol.csproj](../files/Magnetar.Protocol/Magnetar.Protocol.csproj.md) | project file | MSBuild project file for the `Magnetar.Protocol` shared contract library. Targets `netstandard2.0` so the assembly can be loaded by both the Quasar Blazor Server supervisor (net8+) and the in-DS `Quasar.Agent` plugin (which runs inside the Space Engineers process). |
 | [Magnetar.Protocol/Model/AgentHello.cs](../files/Magnetar.Protocol/Model/AgentHello.cs.md) | class | Handshake payload sent by `Quasar.Agent` to the Quasar supervisor immediately after the WebSocket connection is established. Carries all static identity information needed by the supervisor to register the agent connection. |
-| [Magnetar.Protocol/Model/AgentSnapshot.cs](../files/Magnetar.Protocol/Model/AgentSnapshot.cs.md) | class | Periodic snapshot pushed by `Quasar.Agent` to the Quasar supervisor containing the full observable state of one running SE dedicated server: identity fields, runtime status, scalar performance metrics, current profiler mode, optional profiler timing data, online human players, hidden NPC/bot player ids, kicked players (serving a kick cooldown), recent chat, recent deaths, and loaded plugin list. |
+| [Magnetar.Protocol/Model/AgentSnapshot.cs](../files/Magnetar.Protocol/Model/AgentSnapshot.cs.md) | class | Periodic snapshot pushed by `Quasar.Agent` to the Quasar supervisor containing the full observable state of one running SE dedicated server: identity fields, runtime status, scalar performance metrics, current profiler mode, optional profiler timing data, online human players, hidden NPC/bot player ids, kicked players (serving a kick cooldown), recent chat, registered PluginSdk chat commands, recent deaths, and loaded plugin list. |
 | [Magnetar.Protocol/Model/ChatMessageSnapshot.cs](../files/Magnetar.Protocol/Model/ChatMessageSnapshot.cs.md) | class | Immutable-style DTO representing a single in-game chat message captured for transmission in `AgentSnapshot.RecentChat`, including whether the message was emitted by the dedicated server/Good.bot rather than a player. |
 | [Magnetar.Protocol/Model/DeathEventSnapshot.cs](../files/Magnetar.Protocol/Model/DeathEventSnapshot.cs.md) | class | Sealed DTO representing a single player death event captured for transmission in `AgentSnapshot.RecentDeaths`. Carries victim, optional killer and weapon, death classification, and timestamp. |
 | [Magnetar.Protocol/Model/EntityDeleteRequest.cs](../files/Magnetar.Protocol/Model/EntityDeleteRequest.cs.md) | class | Minimal request DTO carrying the target entity ID for the `ServerCommandType.DeleteEntity` command. Serialized as JSON into `ServerCommandEnvelope.Payload`. |

Docs/Reference/Modules/Quasar.Agent.md

@@ -16,7 +16,7 @@ The plugin loaded inside each Space Engineers Dedicated Server (`netstandard2.0`
 | [Quasar.Agent/AgentProfilerPatches.cs](../files/Quasar.Agent/AgentProfilerPatches.cs.md) | class | Mode-aware Harmony patch registrar for Quasar's profiler telemetry. `SafeContinuous` patches only named high-level Space Engineers server methods for low-overhead continuous timing. `DeepContinuous` keeps those patches and adds detailed network-event method hooks plus IL call-site transpilers for session components, replication simulation, entity update dispatch, parallel waits/callbacks, and physics stepping internals. `Off` skips profiler patches. |
 | [Quasar.Agent/AgentProfilerTranspiler.cs](../files/Quasar.Agent/AgentProfilerTranspiler.cs.md) | class | Generic Harmony `CodeInstruction` transpiler used by deep profiler mode. It wraps selected `call` / `callvirt` instructions with `AgentProfiler.BeginCallSite` and `AgentProfiler.EndCallSite`, giving Quasar-native call-site attribution without external patch-manager MSIL helpers. |
 | [Quasar.Agent/EntityInspector.cs](../files/Quasar.Agent/EntityInspector.cs.md) | class | `EntityInspector` is an internal static helper that queries and manipulates live `MyEntity` instances on the game thread, mapping them to transport-friendly `EntitySummary` DTOs for the Quasar admin UI. It supports paginated, filtered entity listing and direct entity deletion. |
-| [Quasar.Agent/GameBridge.cs](../files/Quasar.Agent/GameBridge.cs.md) | class | `GameBridge` is the central game-thread façade for `AgentConnection`. It collects session telemetry (metrics, current profiler mode/snapshot, human players, hidden NPC/bot player ids, kicked players, chat, deaths, plugins), builds `AgentHello` / `AgentSnapshot` wire messages, and executes server commands (chat, blocking save, save-and-stop, profiler mode change, kick, ban, promote, clear-kick-cooldown, entity list/delete) by marshalling work onto the game thread via `MySandboxGame.Invoke`. Save/stop commands route through Magnetar PluginSdk `ServerControl` so Quasar observes completed disk saves before treating the command as successful. Metrics include process CPU derived from `Process.TotalProcessorTime`, simspeed/sim CPU from `Sync`, memory, human player count, PCU, active entities/grids, total blocks, floating objects, latest world-save time, and unsaved game-time progress since the last checkpoint. It enumerates loaded plugins from `MyPlugins.Plugins` (including Pulsar child plugins) for runtime inventory, dedupes configured fallback plugin paths against loaded plugins by path stem, parent dev-folder name, manifest `<Id>`, and manifest `<FriendlyName>`, and exposes plugin configuration through `IQuasarConfigProvider` or Magnetar PluginSdk `PluginConfig` reflection. Chat history normalizes dedicated-server/Good.bot messages to author `Server` and marks `ChatMessageSnapshot.IsServerMessage`. |
+| [Quasar.Agent/GameBridge.cs](../files/Quasar.Agent/GameBridge.cs.md) | class | `GameBridge` is the central game-thread façade for `AgentConnection`. It collects session telemetry (metrics, current profiler mode/snapshot, human players, hidden NPC/bot player ids, kicked players, chat, registered PluginSdk chat commands, deaths, plugins), builds `AgentHello` / `AgentSnapshot` wire messages, and executes server commands (chat, blocking save, save-and-stop, profiler mode change, kick, ban, promote, clear-kick-cooldown, entity list/delete) by marshalling work onto the game thread via `MySandboxGame.Invoke`. Save/stop commands route through Magnetar PluginSdk `ServerControl` so Quasar observes completed disk saves before treating the command as successful. Metrics include process CPU derived from `Process.TotalProcessorTime`, simspeed/sim CPU from `Sync`, memory, human player count, PCU, active entities/grids, total blocks, floating objects, latest world-save time, and unsaved game-time progress since the last checkpoint. It enumerates loaded plugins from `MyPlugins.Plugins` (including Pulsar child plugins) for runtime inventory, dedupes configured fallback plugin paths against loaded plugins by path stem, parent dev-folder name, manifest `<Id>`, and manifest `<FriendlyName>`, and exposes plugin configuration through `IQuasarConfigProvider` or Magnetar PluginSdk `PluginConfig` reflection. Chat history normalizes dedicated-server/Good.bot messages to author `Server` and marks `ChatMessageSnapshot.IsServerMessage`. |
 | [Quasar.Agent/PluginLogOutbox.cs](../files/Quasar.Agent/PluginLogOutbox.cs.md) | class | Bounded, thread-safe buffer that captures plugin log lines emitted in-process by the PluginSdk Quasar log sink and hands them to `AgentConnection` in batches for streaming to Quasar (as `PluginLogBatch` / `WireMessageKind.PluginLogs`). The buffer survives Quasar outages: lines accumulate while disconnected and are flushed on reconnect, so the supervisor's "Recent plugin logs" panel is backfilled rather than losing everything captured while Quasar was down. |
 | [Quasar.Agent/Quasar.Agent.csproj](../files/Quasar.Agent/Quasar.Agent.csproj.md) | project file | MSBuild project file for `Quasar.Agent`, a `netstandard2.0` class library (x64-only) that produces `Quasar.Agent.dll` — the Magnetar/Space Engineers plugin assembly. All game and PluginSdk references are `Private="False"` (provided by the host at runtime). Harmony is a package dependency because the agent applies profiler patches in-process. |
 | [Quasar.Agent/StopCommand.cs](../files/Quasar.Agent/StopCommand.cs.md) | class | `StopCommand` is a Quasar-owned PluginSdk command module for the root `!stop` in-game admin command. It overrides Magnetar's earlier `stop` root by being registered later from `AdminPlugin`, acknowledges the caller, reports an admin stop to Quasar through a static hook wired by `AdminPlugin`, then calls `ServerControl.SaveAndQuit()` on a worker task so the world is saved and the dedicated server process exits. |