ATEM: restore file saved 2026-10-13 15:54 (camera 2 tint 15); shutdown budget capped at launchd's 60 s

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

status_panel.py

@@ -2501,9 +2501,13 @@ def check_host(cfg, host, where):
         raise ValueError("%s: host %s has no ssh address" % (where, host))
 
 
+LAUNCHD_EXIT_CAP = 60   # launchd on macOS 26 applies at most 60 s of ExitTimeOut, whatever the plist says
+
+
 def exit_timeout(cfg):
-    """How long launchd must let the watchdog finish a running fix before killing it: the longest
-    fix plus its verify time plus a margin, never under a minute (install.sh writes it into the plist)."""
+    """How long launchd should let the watchdog finish a running fix before killing it: the longest
+    fix plus its verify time plus a margin, never under a minute (install.sh writes it into the plist;
+    launchd caps what it honours at LAUNCHD_EXIT_CAP, so the shutdown budget is capped too)."""
     longest = 0
     for fix in cfg.get("fixes", {}).values():
         longest = max(longest, fix.get("timeout", 60) + (fix.get("verify_seconds", 20)
@@ -2767,8 +2771,9 @@ def run(cfg, data_dir, dry_run=False, stop=None, config_sha=None):
                              % (prefix, alert_after))
                 alerted = True
         stop.wait(0.25)
-    # A fix that is running finishes before the process goes (launchd waits exit_timeout for us).
-    budget = time.time() + max(5, exit_timeout(cfg) - 5)
+    # A fix that is running finishes before the process goes (launchd waits up to the exit timeout,
+    # capped at LAUNCHD_EXIT_CAP, for us).
+    budget = time.time() + max(5, min(exit_timeout(cfg), LAUNCHD_EXIT_CAP) - 5)
     for t in engine.fix_threads:
         t.join(timeout=max(0.1, budget - time.time()))
     if any(t.is_alive() for t in engine.fix_threads):