Module lifeline 

Lifelines: pipes through which a process learns that another process it depends on has ended.

There are two, and each has one meaning:

Variable	Created by	EOF means
FORMATION_LIFELINE_ENV	the formation launcher, once per member	the formation has ended
SPAWNER_LIFELINE_ENV	a parent’s runtime, once per delegated child	the process that spawned this one has ended

The creator hands the started process the read end and holds the only write end. It never writes to it. When the creator closes the write end, or its process dies by any means — SIGKILL and the OOM killer included — the kernel closes it, and the holder’s read returns zero bytes. The two variables are never interchangeable: a delegated child is never handed its parent’s formation lifeline, because EOF on that would mean the launcher had died, not the parent.

• Bytes read are discarded and are not EOF; only a zero-byte read is. Nothing writes to a lifeline, so no writer can block on a full pipe or be sent SIGPIPE.
• Both ends are FD_CLOEXEC from creation. The one descriptor whose flag is cleared is the started process’s own read end, and only in that process’s forked child, by MemberLifeline::hand_to or ChildLifeline::hand_to, so no other process ever holds a write end that would keep a dead creator looking alive.
• A holder reads its variable once per process, through FormationLifeline::from_env or SpawnerLifeline::from_env, each with a once-flag of its own. The read validates the descriptor, sets FD_CLOEXEC on it so nothing the holder spawns inherits it, and takes sole ownership of it.
• A read error other than EINTR is reported and treated as EOF: a holder that can no longer hear its lifeline could not be wound down by anything else once its creator is gone.

Unlike the formation id, which belongs to the session, a lifeline belongs to the process: a descriptor is a property of the process holding it.

Where pipe2 is missing (darwin), FD_CLOEXEC is set after pipe returns, so a process another thread spawns in that instant can inherit a write end and delay that one holder’s EOF until it exits.

Structs

ChildLifeline

A parent runtime’s side of one delegated child’s spawner lifeline: the write end it holds for as long as the child is its to end, and the read end until the child has been spawned with it.

FormationLifeline

A member’s read end of its formation lifeline, owned by this process alone.

MemberLifeline

The launcher’s side of one member’s lifeline: the write end it holds for the formation’s life, and the read end until the member has been spawned with it.

SpawnerLifeline

A delegated child’s read end of its spawner lifeline, owned by this process alone. EOF on it means the process that spawned this one has ended.

Constants

FORMATION_LIFELINE_ENV

The variable a formation launcher sets in each member’s environment: the decimal number of the descriptor holding that member’s lifeline read end. Runtime-owned: never resolved from the host for a guest, a shell command or a hook, and never handed to a delegated child.

SPAWNER_LIFELINE_ENV

The variable a parent’s runtime sets in each delegated child’s environment, beside MURMUR_SPAWNER: the decimal number of the descriptor holding that child’s spawner lifeline read end. Runtime-owned on the same terms as FORMATION_LIFELINE_ENV, and never copied from a parent’s environment into its child’s: each child is handed a pipe of its own.