SIGTERM runs the SIGINT drain

[blooop]

Question

Only SIGINT is handled (rust/dl/src/lib.rs:110-122), so kill <dl> leaks the staged plaintext GH_TOKEN file and orphans the devpod up child — the exact pair interrupt.rs exists to prevent. Install a SIGTERM handler running the same drain.

Settle inside this ticket: whether SIGHUP joins (README:233 — closing the terminal today skips both --autorm and the cleanup), and the exit-code convention. Test at the binary boundary in the style of dl/tests/interrupt.rs.

[blooop]

breadcrumb: entering building — wf-tdd stage subagent launched (manager: wf-mid run working map #299). The SIGHUP question and the exit-code convention are settled inside this ticket by the builder.

[blooop]

breadcrumb: building. What I will build: the shared signal disposition both binaries install stops being SIGINT-only and becomes a small set of signals that all run the same async-signal-safe drain (killpg the foreground child, unlink the staged token, _exit). Nothing about the drain itself changes — only which signals reach it and what code each leaves behind.

Seams, as the ticket directs — the binary boundary, in the style of the existing interrupt suite: spawn the real dl against the scratch world whose fake devpod up blocks forever, wait until the token is staged and the child is live, deliver one signal to dl alone, then assert on three observable facts — the exit code, the absence of the staged token file, and the death of the up child. One test per signal. No test touches the handler function directly; renaming or restructuring it must break nothing.

[blooop]

breadcrumb (sub-decision 1 of 2): SIGHUP joins the drain.

It is the same leak as SIGTERM through a door people walk through far more often, and the least watched of the three — the window any complaint would have appeared in is the one that just went away, so the staged credential and the orphaned build are left behind with nobody present to notice.

What nearly won was leaving SIGHUP out, on the grounds that a closed terminal is ambiguous in a way a kill is not: nohup and setsid exist precisely to say "keep going". Working that objection through turned it into an argument for a third slice rather than against joining. The ambiguity is carried entirely by the disposition the caller inherited: a signal already set to be ignored when the process started means the caller disarmed it deliberately, and honouring that is the classic POSIX idiom. Once it is honoured, a bare run in a closed terminal is unambiguous and a deliberately detached run is untouched — so both cases get what they asked for, where excluding SIGHUP served only one of them.

The maintainability argument decided the tie: excluding it would have left one member of the handled set needing a paragraph of exception explaining why the same leak is tolerated there, and a per-signal exception is exactly the thing that drifts. The rule is now uniform — every signal that means "this run is over" runs the drain, and every one of them respects an inherited ignore.

SIGQUIT stays out, and that is not the same call: it means "die now and dump core", so tidying up first is not what someone reaching for it asked for.

[blooop]

breadcrumb (sub-decision 2 of 2): a signal-terminated run exits 128 + the signal number. 130 for Ctrl-C, 143 for a kill, 129 for a closed terminal.

Checked before inventing anything, as directed, and there was nothing to invent: the interrupt code this binary already exits with was 128 + SIGINT, written out long-hand and inherited from the Python original. So this generalises what the codebase does rather than adding a convention, and conventional Unix practice agrees — it is what a shell reports and what kill -l lets anyone read off. The code is derived inside the handler from the signal the kernel passed in, so one handler serves every signal and none of them can be given the wrong code; there is no table to keep in step.

Two alternatives were genuinely live.

The stronger one was re-raising the signal with the default disposition so the process dies by it and a parent sees a signalled status rather than an exit code. That is the more correct Unix citizenship, and it is what a supervisor inspecting a child would rather see. It lost because the codebase had already weighed and rejected it for SIGINT, in writing and for a real reason: a caller reading a child status sees no exit code at all where it used to see one, which is observable to anyone scripting this tool. Reversing that here would have been a silent behavioural change to the existing interrupt path smuggled in under a ticket about a different signal — and if it is ever worth doing, it is worth doing deliberately and for all three at once.

The weaker one was keeping the single existing constant for every signal. Simpler by one function, but it throws away the only thing that distinguishes "somebody cancelled this" from "the terminal went away" — which is precisely what is worth knowing when the evidence is a CI log and the run is long gone.

[blooop]

breadcrumb: built — PR #348, open, not merged.

Three red→green slices, each proved at the binary boundary against the fake devpod whose up blocks with the token staged and the child live. Every test asserts one value holding all three facts at once — the exit code, whether the staged credential survived, whether the build survived — so a signal that half-cleans-up cannot pass, and the pre-existing Ctrl-C test now asserts the same three facts through the same harness.

1. A kill mid-build: red showed the process dying by the signal with the credential on disk and the build still running. Green: the disposition became a set of signals over one handler that derives its exit code from whichever signal it was handed.
2. A closed terminal: same three-way red, joined the set.
3. A run whose signal was already disarmed before it started: red, because slice 2 had just taken detached running away. Green: an inherited ignore now wins, for every handled signal rather than for that one.

The drain itself is untouched — the child-group teardown and the temp-file unlinking are called exactly as the interrupt path already called them, so nothing here moves process-group membership or the foreground-child bookkeeping. Noted explicitly on the PR, since a concurrent branch is revising that area.

Docs corrected in the same change: the README section on how you exit had stated the terminal-close signal was not handled at all, and now says which cleanup each signal does run, which one it still cannot (the automatic removal, which no signal handler may perform), and what each exits with.

[blooop]

breadcrumb: CI green on the PR — every leg including the end-to-end one. Stopping here; not merged, and not self-reviewed.

[blooop]

breadcrumb: build → in review. PR #348 pushed; every check green including gate and e2e. Both sub-decisions this ticket delegated (SIGHUP joins; 128+signo exit codes) are settled and breadcrumbed above with what nearly won. Handing to a fresh wf-review context.

[blooop]

breadcrumb: in review → needs attention. wf-review verdict: Request changes — Standards pass (4 non-blocking doc/surface items), Spec fail. Report on #348 — blocking: the inherited-SIG_IGN rule applied to SIGINT silently changes the pre-existing interrupt path (a dl backgrounded from a non-interactive shell starts with SIGINT already SIG_IGN by POSIX job control, so it no longer drains — reproduced against the real disposition, the staged token and the up child now outlive the cancelled run), and that changed half is the untested half (reached_with_signal_ignored is parametrised but only called with "HUP"). The #343 process-group claim was verified and holds; the handler is genuinely async-signal-safe and re-entrant-safe, and the 130/143/129 codes are real exit codes.

[blooop]

breadcrumb: in review → changes requested (Spec: fail), routed back to building. One of the two blockers needs a call, and I am taking it.

agent-decided (simplicity, then long-term maintainability): the inherited-SIG_IGN rule applies to SIGTERM and SIGHUP only. SIGINT keeps exactly the behaviour it had.

Slice 3 extended the rule to all three signals. For the two signals this ticket adds, that is correct and is what keeps nohup working. For SIGINT it is a silent change to a pre-existing path: a dl backgrounded from a non-interactive shell starts with SIGINT already SIG_IGN under POSIX job control, so it stops draining — the staged plaintext GH_TOKEN and the devpod up child outlive the cancelled run, which is the exact leak this ticket exists to close, reintroduced through the door that was already shut. The reviewer proved it with a probe binary against the real handler, and it is the one changed half with no test.

This ticket's job is to make SIGTERM and SIGHUP run the drain SIGINT already ran. Redefining SIGINT is a different change, undeclared, and it made things worse rather than better — so the rule gets scoped to where it is load-bearing. What nearly won: uniformity, since "all three signals read their inherited disposition" is one sentence where the scoped version needs two. It loses because the second sentence is cheap and the regression is not, and because a rule that silently weakens the path it was modelled on is not the simpler thing — it only reads that way.

Escalation considered and declined: this is a cheap-to-reverse implementation call inside a ticket the map already delegated its sub-decisions to, and it restores prior behaviour rather than choosing new behaviour. Both halves must arrive with tests — the SIGINT-still-drains case is what was missing.

Standards passed with four non-blocking items; the second blocker and those items are stated in full in the review on PR #348.

[blooop]

breadcrumb: changes requested → addressed, back in review. Two commits pushed to the same branch, no force-push.

Reproduced the blocking finding before changing anything: a non-interactive shell that backgrounds a job hands its child an ignored interrupt and quit signal under POSIX job control, where the same probe in the foreground inherits nothing. So the regression is real and the manager call stands — the inherited-ignore rule now covers only the two signals this ticket adds, and Ctrl-C behaves exactly as it did before the branch.

Rather than a uniform rule with an exception bolted on, the signal set is now a table pairing each signal with what an inherited ignore means coming from it. The asymmetry is stated where the set is declared, so it reads as a judgement rather than an oversight, and the argument for each row sits beside the row.

The changed half being the untested half got fixed at the root: the test iterates that same table, so a signal cannot be left uncovered by omission — which is exactly how this slipped through. Proved red against the previous commit and green against the new one. The red is worth recording, because it is not the shape I expected: the interrupt was ignored outright, so the run was never cancelled at all and carried on to its natural end. In the real case, where whatever owned the run is already gone, that is the orphan still holding the launch lock and the staged credential.

One thing the parametrised test surfaced that I had not predicted, and it is not a defect: disarming the terminate signal disarms it for everything the run spawns, and the drain fells the build with a group-wide terminate — so disarming it also disarms the drain's own reach into the child. Inherent to tearing a group down with the signal the caller switched off, true of any program that does it that way, and pinned as the expected outcome for that one row with the reason beside it rather than papered over. The hang-up case is unaffected, which is what keeps the detached-run story working.

All four non-blocking items landed in the same pass. Two are worth naming because they are the drift class this map exists to close: the live divergence table now records this difference rather than describing the old single-signal world, and it carries the cross-reference the exit-code decision was missing — the repo genuinely holds two opposite conventions for signal-derived exit codes, one for this process and one for a child, each following its own precedent. My earlier breadcrumb overstated that as "generalises what the codebase does"; the accurate and narrower claim is now in the code and in the table. Checking the second premise the reviewer flagged also turned up that one half of it had been inaccurate before this branch touched anything, so it is restated on what actually bounds the window.