Function terminate_and_verify 

pub fn terminate_and_verify(pid: u32, wait: Duration, poll: Duration) -> bool

Terminate pid, escalating to SIGKILL if it has not exited within wait, and return a verified fact about whether it is dead — never an assumption.

Sequence: send one SIGTERM via terminate. If that fails to signal the process at all (already gone, or the pid is invalid), report whether it is already dead — “could not signal it” and “already dead” are the same outcome from the caller’s perspective. Otherwise poll agent_running at poll intervals until wait elapses, returning true the moment it reports dead. On expiry, escalate with SIGKILL and return the (inverted) liveness check one final time.

SIGKILL escalation is not optional here. 999.44’s 2026-07-27 measurement found 15 of 15 orphaned monitor wrappers surviving SIGTERM — the wrapper installs trap cleanup TERM INT, which evidently does not fire, most likely because the shell is blocked in wait on a child it can never reap. Per 25-RESEARCH.md Open Question 2 and 999.47’s own recorded lesson, this function deliberately does not depend on explaining that mechanism — the escalation works regardless of why SIGTERM alone fails. That is accepted unexplained behaviour this code defends against, not a root cause this function resolves.

A non-positive pid, or one that does not fit libc::pid_t, returns false immediately and signals nothing — the same wraparound/group- signal hazard agent_running and terminate already guard against.