Module signals 

Signal handling + the self-pipe wakeup. RFC 0003 §signals, RFC 0011 §signals.

Handlers are async-signal-safe — they only touch atomics and write() one byte to a self-pipe so a blocked reactor wakes promptly (SA_RESTART is deliberately off, so blocked syscalls also return EINTR). The reactor selects on wakeup_fd() alongside its channels; on wake it checks the flags and drains the pipe.

• SIGTERM/SIGINT → one-way DRAINING (a second sets FORCE).
• SIGCHLD → set the child-exit flag (the reactor runs reap::reap_pending).
• SIGPIPE → ignored, so the supervisor never dies writing to a dead child.

Functions

clear_reload

Clear the hot-reload latch once the reload routine has run (applied or rejected), or when a drain supersedes the request. Idempotent.

drain_wakeup

Drain pending wakeup bytes after a wake.

draining

Has a graceful drain been requested (first SIGTERM/SIGINT)?

force

Has a forced shutdown been requested (second SIGTERM/SIGINT)?

install

Install SIGTERM/SIGINT/SIGCHLD/SIGPIPE handlers + the self-pipe. Call once at supervisor startup.

intel_all_down

Is the intelligence channel all-endpoints-down (RFC 0018 §6)? The latched, EVENTUALLY-CONSISTENT last-child-experience truth a child reports up via AgentMsg::IntelHealth — read by /readyz (flips NotReady), the agentd_intel_all_down gauge, and the agentd://intelligence/capacity bodies. NOT a live supervisor-side probe (there is no model loop in the supervisor): it reflects whichever child last exercised the endpoints.

lame_duck

Is the lame-duck readiness override active (RFC 0015 §4.2)? When true, /readyz reports NotReady even though the supervisor keeps running.

paused

Is the instance-wide pause active (RFC 0015 §4.3)? When true, the agentic loops are suspended at their turn boundaries; the supervisor and readiness are unaffected.

reload_requested

Has a hot reload been requested (SIGHUP, RFC 0017 §5.2)? The reactive supervisor consults this each tick; a drain supersedes it (the caller checks draining() first). Always false on a build without the hot-reload feature (the handler that sets it is feature-gated).

reloading

Is a validated reload mid-apply (RFC 0017 §5.3 step 3)? The served subagent.spawn chokepoint reads this to transiently refuse NEW spawns while the reloadable diff is being applied. Always false off the hot-reload path (only the reactive apply step ever sets it).

request_drain

Request a graceful drain programmatically (the drain operator tool, RFC 0015 §4.1) — the same one-way DRAINING latch SIGTERM sets, plus a reactor wakeup. Idempotent/monotonic; never escalates to FORCE.

request_reload

Programmatically request a hot reload (the same RELOAD latch SIGHUP sets) + a reactor wakeup. Parity with request_drain; honoured only by a hot-reload build’s reactive loop.

request_reload_from_watch

Request a hot reload attributed to the file-watch trigger (RFC 0017 §5.2): the same RELOAD latch SIGHUP/request_reload set, plus the watch-attribution flag the apply step reads for the config.reload_requested{trigger:"watch"} event (§5.6). Called by the inotify watcher thread (config-watch).

set_intel_all_down

Latch the intelligence all-endpoints-down state from a child’s AgentMsg:: IntelHealth report (RFC 0018 §6). Returns true iff the value TRANSITIONED, so the supervisor can fire the agentd://intelligence notify exactly on a breaker enter/exit. Eventually-consistent / last-child-experience: a fresh spawn has fresh breakers, so this reflects the most recent child’s reachability and persists between reactions — the right “route work here?” signal, not a continuous probe.

set_lame_duck

Set or clear the lame-duck readiness override (the lame-duck operator tool, RFC 0015 §4.2). true overrides readiness toward NotReady; false clears it.

set_paused

Set or clear the instance-wide pause state (the pause/resume operator tools, RFC 0015 §4.3). Reporting truth for agentd://inventory + the agentd_paused gauge; the per-session pause channels do the suspension.

set_reloading

Set or clear the reload-in-progress guard. The reactive apply step brackets its reloadable-diff application with set_reloading(true) then (false).

take_child_exit

Take-and-clear the SIGCHLD flag — true if a child exited since last checked.

take_reload_was_watch

Take-and-clear the watch-attribution flag — true if the pending reload came from the file-watch trigger (RFC 0017 §5.2), false (the default) for SIGHUP or a programmatic request_reload. The reactive apply step calls this once per reload to label the config.reload_requested trigger (§5.6).

wakeup_fd

The read end of the self-pipe — the reactor waits on it for prompt wakeups. Returns -1 before install() (or on non-Unix).