Module kill 

The bounded teardown ladder.

When a subtree must die (SIGTERM-to-agentd, a deadline/stuck verdict, or a tree-budget breach), the reactor tears it down deepest-first (children before parents, via tree.deepest_first(), so a parent can’t spawn replacements mid-teardown — the draining flag also blocks new spawns) and escalates per the ladder: graceful Cancel → killpg(SIGTERM) after a grace → killpg(SIGKILL) after a kill-grace → reap. A second SIGTERM/SIGINT (force) collapses straight to SIGKILL. The whole budget is bounded and must stay < the orchestrator’s terminationGracePeriodSeconds, or the orchestrator SIGKILLs agentd mid-teardown and the tree leaks; the reactor enforces that ceiling.

The killpg calls are thin libc; the escalation timing is the pure, unit-tested Ladder state machine.

Structs

Ladder

The escalation timer for one teardown. Construct it, send Cancel to the targets, then call Ladder::poll each reactor tick; perform whatever action it returns on the still-live set.

Enums

LadderAction

What the reactor should do on this tick of a teardown.

Constants

DEFAULT_GRACE

Default grace before SIGTERM (let the child wind down at a turn boundary).

DEFAULT_KILL_GRACE

Default grace between SIGTERM and SIGKILL.

Functions

kill_group

signal_group

killpg(pgid, sig). Guards pgid > 1 so we never signal pgid 0 (our own group) or 1 (init).

term_group