full-protocol-run.sh kills the runner but not its children, so the orphans it was hardened against survive one level down

[pseudoseed]

Found during the integration review of PR #282 (issue #242).

The gap

PR #282 adds trap stop_server EXIT INT TERM HUP so a run that is interrupted stops the server it started. stop_server does kill "$RUNNER_PID".

air-235-full-protocol.mjs spawns its own children: porch and t3 processes. kill on the runner reaches the runner only. Those grandchildren survive the trap, keep their ports and files open, and are exactly the orphan class the trap was added to prevent, one level down.

Why the existing test cannot catch it

The trap test drives a stub runner. The stub has no children, so the assertion passes whether or not descendants are reaped. It is a test that supplies the boundary itself: it cannot tell you the boundary exists.

What would close this

• Kill the process group rather than the pid, so descendants go with it. On this shell that means starting the runner in its own group and signalling the negative pid.
• A stub that forks a child which outlives its parent, so the test fails without the fix. Assert on the grandchild being gone, not on the runner exiting.

Related

#275 covers the wider problem of builder processes outliving their sessions. This is the same class inside one script, and it is narrow enough to fix on its own.

Source

.consult-runs/integration-242.md, integration review of PR #282.