Module signals 

Signal handling + the self-pipe wakeup.

Handlers are async-signal-safe — they only touch atomics and write() one byte to a self-pipe so a blocked reactor wakes promptly (SA_RESTART is deliberately off, so blocked syscalls also return EINTR). The reactor selects on wakeup_fd() alongside its channels; on wake it checks the flags and drains the pipe.

• SIGTERM/SIGINT → one-way DRAINING (a second sets FORCE).
• SIGCHLD → set the child-exit flag (the reactor runs reap::reap_pending).
• SIGPIPE → ignored, so the supervisor never dies writing to a dead child.

Functions

clear_reload

Clear the hot-reload latch once the reload routine has run (applied or rejected), or when a drain supersedes the request. Idempotent.

drain_wakeup

Drain pending wakeup bytes after a wake.

draining

Has a graceful drain been requested (first SIGTERM/SIGINT)?

force

Has a forced shutdown been requested (second SIGTERM/SIGINT)?

install

Install SIGTERM/SIGINT/SIGCHLD/SIGPIPE handlers + the self-pipe. Call once at supervisor startup.

intel_all_down

Is the intelligence channel all-endpoints-down? The latched, EVENTUALLY-CONSISTENT last-child-experience truth a child reports up via AgentMsg::IntelHealth — read by /readyz (flips NotReady), the agentd_intel_all_down gauge, and the agentd://intelligence/capacity bodies. NOT a live supervisor-side probe (there is no model loop in the supervisor): it reflects whichever child last exercised the endpoints.

lame_duck

Is the lame-duck readiness override active? When true, /readyz reports NotReady even though the supervisor keeps running.

paused

Is the instance-wide pause active? When true, the agentic loops are suspended at their turn boundaries; the supervisor and readiness are unaffected.

reload_requested

Has a hot reload been requested (SIGHUP)? The reactive supervisor consults this each tick; a drain supersedes it (the caller checks draining() first). Always false on a build without the hot-reload feature (the handler that sets it is feature-gated).

reloading

Is a validated reload mid-apply? True only while the reloadable diff is being written into the live runtime, so a reader can refuse work that would otherwise observe a half-applied config. Always false off the hot-reload path (only the reactive apply step ever sets it).

request_drain

Request a graceful drain programmatically — the same one-way DRAINING latch SIGTERM sets, plus a reactor wakeup. Idempotent and monotonic; never escalates to FORCE (only a second signal does), so a caller cannot cut an in-flight drain short.

request_reload

Programmatically request a hot reload (the same RELOAD latch SIGHUP sets) + a reactor wakeup. Parity with request_drain; honoured only by a hot-reload build’s reactive loop.

request_reload_from_watch

Request a hot reload attributed to the file-watch trigger: the same RELOAD latch SIGHUP/request_reload set, plus the watch-attribution flag the apply step reads to emit config.reload_requested{trigger:"watch"}. Called by the inotify watcher thread (config-watch).

set_intel_all_down

Latch the intelligence all-endpoints-down state from a child’s AgentMsg:: IntelHealth report. Returns true iff the value TRANSITIONED, so the supervisor can fire the agentd://intelligence notify exactly on a breaker enter/exit. Eventually-consistent / last-child-experience: a fresh spawn has fresh breakers, so this reflects the most recent child’s reachability and persists between reactions — the right “route work here?” signal, not a continuous probe.

set_lame_duck

Set or clear the lame-duck readiness override. true overrides readiness toward NotReady; false clears it. The reactor sets it when a drain begins, so traffic stops arriving while the tree winds down.

set_paused

Set or clear the instance-wide pause state. Reporting-only — the per-session pause channels perform the actual suspension.

set_reloading

Set or clear the reload-in-progress guard. The reactive apply step brackets its reloadable-diff application with set_reloading(true) then (false).

take_child_exit

Take-and-clear the SIGCHLD flag — true if a child exited since last checked.

take_reload_was_watch

Take-and-clear the watch-attribution flag — true if the pending reload came from the file-watch trigger, false (the default) for SIGHUP or a programmatic request_reload. The reactive apply step calls this once per reload to label the config.reload_requested trigger.

wakeup_fd

The read end of the self-pipe — the reactor waits on it for prompt wakeups. Returns -1 before install() (or on non-Unix).