Module supervisor 

Daemon-side supervised-worker protocol: restart loop and child spawn. Daemon-side half of the supervised-worker protocol.

A server started under [supervise] does its real work in a child copy of the same executable. The child carries the [CHILD_ENV_MARKER] environment variable, so the worker-side stdin watcher inside the child knows it is supervised and can watch standard input to detect daemon death.

Protocol summary:

• Exit code [EXIT_RESTART] asks the loop to start a fresh child.
• Exit code [EXIT_QUIT] and every other terminal status end the loop.
• Exit code [EXIT_BOOT] reports a failed boot. The loop treats it like any normal terminal status and returns Ok; the caller mirrors the real child exit code to its own process exit, so the service manager still sees the non-zero failure.

[spawn_self_supervised] creates the child and hands back the write end of its standard input. Dropping that handle closes the pipe, the child’s standard input reaches end-of-file, and the worker-side watcher performs a graceful teardown.

Two safeguards keep the daemon responsive. Respawns after runs too short to prove health pace themselves exponentially (next_backoff: 100 ms doubling to a 5 s cap) instead of hammering at full speed, and a worker that has been asked to stop but ignores the request is force-killed once [WORKER_SHUTDOWN_GRACE] elapses ([wait_with_grace]).

Structs

SupervisedChild

A running child together with the write end of its standard input.

Constants

CHILD_ENV_MARKER

Environment variable that marks a supervised child process.

EXIT_BOOT

Child exit code: boot failed; do not restart.

EXIT_QUIT

Child exit code: shut down for good.

EXIT_RESTART

Child exit code: restart me with a fresh process.

WORKER_SHUTDOWN_GRACE

Grace window granted to a worker that has been asked to stop (its standard input reached end-of-file) before the daemon force-kills it. Bounds the goodbye, never the working lifetime.

Functions

is_supervised

Returns true when this process itself runs as a supervised child.

spawn_self_supervised

Re-execs the current executable as a supervised child.

supervise

Runs the restart loop around run_child.

wait_with_grace

Waits for child to exit, granting it WORKER_SHUTDOWN_GRACE once its standard input has been dropped (the stop request). A worker that exits within the window yields its real code; one that outstays the grace is force-killed and the resulting status supplies the code instead, so a hung child can never park the daemon forever.