macOS: x0xd ignores SIGTERM (no exit after 13s+, needs SIGKILL) — reproduced on v0.39.0 bare daemon

[dirvine]

Long-observed ("OPEN: macOS SIGTERM hang" in session notes since v0.32) but never filed. Reproduced today on two bare x0xd 0.39.0 official-binary instances on macOS 26.6 (M-series):

• x0xd --name leakctl --api-port 12798 --skip-update-check (prod bootstrap, ~3h uptime, 3.1 GB RSS)
• x0xd --name leakctl2 --api-port 12797 --no-hard-coded-bootstrap --skip-update-check (~1h uptime, 770 MB)

kill <pid> (SIGTERM) → both still running after 13 s with no log output indicating shutdown began; kill -9 required. Earlier today the tic-tac-toe sidecar on studio1 (0.37.4, 142 GB RSS) behaved the same (SIGTERM, 6 s, then -9).

Impact: the #261/#363 transactional upgrade handoff "cancels gracefully within a 5 s bound" and test harnesses' DaemonFixture teardown both assume SIGTERM works — on macOS they fall through to the hard path and lose the clean-shutdown guarantees (dhat dumps, WAL flush, GroupDeleted/withdraw fan-out). Possibly related to the large-RSS state (#368) if shutdown is blocked on a stalled task, but the 770 MB instance hung identically.

Repro: start a bare daemon, wait for peers > 0, kill -TERM, watch kill -0 for 30 s.

🤖 Generated with Claude Code

[dirvine]

Triage against f3080c39b444b7ce44216c1811c472f3b4e938cb (v0.41.3), 2026-09-05: P2 — Mitigated in source; retain runtime verification.

src/bin/x0xd.rs:349 installs SIGTERM handling and :374 starts a five-second cancellation watchdog. This addresses the old missing/unbounded shutdown path, but source presence does not prove a wedged runtime schedules the watchdog or flushes safely.

Acceptance / next step: Run bare-daemon TERM tests at idle and after sustained gossip load on macOS, observe process exit and persistence; keep graceful flush distinct from forced exit. Do not label it still wholly unimplemented.

This is a source-and-evidence triage; platform/soak tests are credited only where explicitly stated.

[dirvine]

Additional scoped macOS observation on main 0b6515f90f68909b28bc90fdd992000b936601dc: one fresh idle daemon received SIGTERM and exited 0 after 8.453 seconds, with no external KILL and no intrinsic watchdog marker. Cancellation and server shutdown-completion messages were present; owned PID and ports were clear after reaping.

This separates an observer problem from the original report: the earlier token-rotation fixture killed at exactly five seconds, racing the daemon watchdog’s five-second delay after cancellation is observed. Those earlier exit -9 receipts do not establish that SIGTERM was ignored. The new observation also does not establish the source comment’s five-second process-exit bound.

Limits: this was a debug/all-features binary (including heap profiling), with production source identical between its donor main e16ba97 and 0b6515f, and a restrictive fixture network fence. The fence denies ant-quic’s replacement ephemeral loopback UDP bind during teardown; the recorded branch logs that error and continues. Server shutdown completion preceded final process exit; the remaining time is not attributed by this test. Binary SHA256: c9e6e91359fe16352df7dd3673e2a868242bb92ea68e8303e76ce0a93d45d231.

Keeping this issue open. Official-build idle and sustained-load TERM-to-exit, persistence/flush validation, and a reviewed isolation-preserving fence comparison remain outstanding. No claim of graceful persistence or fleet acceptance.