From 1e227a27e8736c63f8782968e69d742d20d6a68c Mon Sep 17 00:00:00 2001
From: choiyounggi <74581798+choiyounggi@users.noreply.github.com>
Date: Fri, 7 Aug 2026 16:44:21 +0900
Subject: [PATCH] knowledge: ingest 1 verified insight (SIGINT delivery to
 backgrounded processes under test)

---
 .dev-loop/INGEST_REPORT.md                    | 142 ++++++++++++------
 log.md                                        |   1 +
 .../non-interactive-cli-invocation.md         |   2 +-
 wiki/testing/index.md                         |   1 +
 ...signal-delivery-to-a-process-under-test.md |  66 ++++++++
 5 files changed, 167 insertions(+), 45 deletions(-)
 create mode 100644 wiki/testing/strategy/signal-delivery-to-a-process-under-test.md

diff --git a/.dev-loop/INGEST_REPORT.md b/.dev-loop/INGEST_REPORT.md
index 55ccfd1..a2f42e1 100644
--- a/.dev-loop/INGEST_REPORT.md
+++ b/.dev-loop/INGEST_REPORT.md
@@ -1,53 +1,107 @@
-# Knowledge consolidation — 15 open PRs (#17–#40) → one reconciled state
-
-The 15 open `knowledge/*` PRs (created 2026-08-04 → 2026-08-05, before the
-harvest processed-store dedupe fix in #41) contained 123 file-versions of ~75
-unique pages, with the same insight landing at up to 3 different paths across
-up to 8 PRs. Per-PR review would re-import those duplicates, so — as with the
-#6–#13 consolidation — this branch carries the reconciled end-state and the 15
-PRs are closed in its favor.
+# Knowledge flush — 3 insight(s): 1 ingested, 2 dropped as in-flight duplicates
 
 ## Verified best-practice
 
-Every adopted page's sources were carried from its originating PR's flush, where
-they were live-verified at flush time; no new URLs were introduced during
-consolidation (checked mechanically: every `http(s)` URL in every merged page
-appears in a source PR's diff; every added body line in amended pages traces to
-a source PR hunk — orphan-line verification). Confidence fields were kept as the
-originating flushes set them, except client-side-rate-limiting where the union
-of provider-doc citations (Okta, Auth0, GitHub, OpenAI, RFC 6585) supports
-`verified` for the load-bearing claims. One subagent's fabricated content (12
-files matching neither main nor any PR, with invented source URLs) was detected
-by the same verification and replaced with true PR content.
+**1. SIGINT delivery to `&`-backgrounded processes in non-interactive shells (INGESTED)**
+
+Claim: a test harness that starts a program with `cmd &` from a shell script and
+sends `kill -INT "$pid"` never delivers an effective SIGINT — POSIX requires
+job-control-disabled shells to start asynchronous-list commands with SIGINT and
+SIGQUIT set to SIG_IGN, so the kill succeeds and the child discards the signal;
+`wait` then hangs to the harness timeout and the failure reads like a product
+bug. Deliver the signal from a subprocess driver instead (e.g.
+`subprocess.Popen` + `send_signal(SIGINT)`), or `set -m` in the script, or use
+SIGTERM when the contract is generic shutdown.
+
+Sources checked:
+- https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html —
+  §2.11 Signals and Error Handling, verbatim: "If job control is disabled …
+  when the shell executes an asynchronous list, the commands in the list shall
+  inherit from the shell a signal action of ignored (SIG_IGN) for the SIGINT
+  and SIGQUIT signals." (fetched and grepped the spec text directly)
+- https://www.gnu.org/software/bash/manual/bash.html#Signals — §3.7.6, verbatim:
+  "When job control is not in effect, asynchronous commands ignore SIGINT and
+  SIGQUIT in addition to these inherited handlers."
+- https://docs.python.org/3/library/subprocess.html#subprocess.Popen.send_signal —
+  anchor existence verified by fetch.
+
+Local reproduction (2026-08-07, macOS): `sh|bash|zsh -c '<print SIGINT
+disposition> & wait'` all report SIG_IGN for the background child and the
+default handler in the foreground; with `set -m` the background child reports
+the default handler; SIGTERM reports SIG_DFL in both. Matches the harvested
+field case (server binary: rc 143 timeout under `kill -INT`+`wait`, immediate
+rc 0 under Popen+send_signal).
+
+Confidence: **verified**.
+
+**2. worktree_escape guardrail escalation budgeting (DROPPED — in-flight duplicate)**
+
+Claim: the worktree_escape guardrail escalates read-shaped cross-worktree
+access, so orchestration briefs referencing other worktrees must budget the
+escalation round trip. Not re-verified here — open PR #51 already carries this
+exact insight with a stronger local reproduction (see Open-PR check).
+
+**3. Orca terminal bind-failure stage branching (DROPPED — in-flight duplicate)**
+
+Claim: check for the idle prompt before binding the next unit to a worker's
+terminal; branch on the failure stage (runtime_unavailable → wait and rebind,
+agent_unconfigured → replace the agent; always pass --worktree with
+--terminal). Not re-verified here — open PR #51 already carries all four rows
+with the same field evidence.
 
 ## Existing-layer check
 
-- Merged-main near-dup scan before consolidation: pairwise Jaccard over
-  title + "When this applies" across all 141 merged pages → **0 flagged pairs**;
-  previously merged content carries no duplication.
-- Cross-PR dedup during consolidation: 10 duplicate clusters collapsed to one
-  canonical page each (rate limiting 8→1, call-site enumeration 7→folded into
-  the canonical merged in #20, stderr/exit-0 diagnostics 4→1, sysroot 2→1,
-  env-off-switch 2→1, completion predicates 2→1, robots.txt 2→1,
-  harness-mediated results 2→1, leaked artifacts 2→1, orchestration category
-  naming unified). Three near-pairs kept distinct after trigger comparison,
-  with mutual `related:` links (differential setup vs interpretation; expansion
-  semantics vs off-switch design; import-time tactics vs level choice).
-- 24 existing pages received union-merged amendments; additions already present
-  in main (from #16/#20) were skipped, and all non-canonical `related:` ids
-  were remapped to canonical page ids (post-merge broken-link scan: 0).
+Routed via INDEX.md → testing domain. Read the full testing domain index (all
+"load when" lines) — no existing page covers signal delivery or process
+lifecycle in tests; nearest neighbors (diagnosing-flaky-tests, async-testing,
+test-level-choice) have non-overlapping triggers. Checked platforms as the
+alternative home: background-services covers process persistence (nohup/launchd/
+systemd), non-interactive-cli-invocation covers prompt-capable CLIs hanging —
+neither covers signal dispositions of `&` jobs, so this is a new trigger →
+new page (merge-before-create satisfied: nothing to merge into). Repo-wide
+`grep -ril sigint wiki/` confirmed no page mentions the mechanism.
+
+Created: `wiki/testing/strategy/signal-delivery-to-a-process-under-test.md`
+(confidence verified, 3 sources + local repro). Updated `wiki/testing/index.md`
+(strategy table row) and `log.md`. Related-links added both ways with
+platforms-processes-non-interactive-cli-invocation (same interactive-vs-
+automation divergence family). No conflicts with existing directives.
+
+Pages read: platforms-processes-background-services, platforms-processes-non-interactive-cli-invocation, infrastructure-agent-orchestration-pane-delivery-confirmation, infrastructure-agent-orchestration-worktree-isolated-workers
+
+## Open-PR check
+
+Open `knowledge/*` heads listed via `gh pr list` and each diffed against main
+(`git diff origin/main origin/<head> -- wiki/`; fork heads #52/#49 fetched via
+`pull/<n>/head`):
+
+- #56 (choiyounggi-20260807-153857), #55 (choiyounggi-20260807-144058),
+  #50 (dch0202-20260806-172420), #47 (dch0202-20260806-130040),
+  #52 (dch0202-rsquare-20260807-100149), #49 (dch0202-rsquare-20260806-142309):
+  no overlap with any of the 3 candidates (testing-quality, ML, platforms
+  pages; nothing touches signals or the two orchestration insights).
+- #51 (dch0202-20260806-183029): **overlaps candidates 2 and 3 completely.**
+  Its worktree-isolated-workers.md diff contains the read-only escalation
+  budgeting row verbatim ("Budget the round trip … state in the worker's first
+  brief that reads are approved") plus a stronger reproduction showing pure
+  reads pass and ask fires only when a write verb/absolute redirect co-occurs
+  — a correction that supersedes candidate 2's broader claim. Its
+  pane-delivery-confirmation.md diff contains all of candidate 3: idle-prompt
+  check before binding, runtime-unavailable → wait, agent-unconfigured →
+  replace agent, pane/worktree mismatch → pass worktree, same i43/i45 field
+  evidence.
+
+Verdicts: candidate 1 → **new** (ingested here); candidate 2 → **drop**
+(pending duplicate of #51, nothing unique to fold); candidate 3 → **drop**
+(pending duplicate of #51, nothing unique to fold). No sibling duplicate PR
+opened.
 
 ## Routing decision
 
-- New categories: `infrastructure/agent-orchestration` (5 pages; unified the
-  competing `orchestration`/`agent-orchestration` names), `databases/data-survey`
-  (1), `qa/deliverables` (1). All other pages route into existing categories.
-- Canonical-path decisions: rate limiting → `backend/common/reliability/`
-  (sits beside timeouts-and-retries; 6 of 8 variants chose it); stderr
-  diagnostics → `platforms/processes/` (concern spans beyond shells); leaked
-  artifacts → `testing/data/artifact-leakage-from-a-suite`; call-site
-  enumeration → the existing `backend/common/change-impact/` page.
-- All 38 new pages listed in their domain indexes (nearest-index rule; backend
-  routes via its python sub-index for bytecode-cache-staleness); INDEX.md domain
-  summaries updated for infrastructure/qa/databases. Full-wiki lint: frontmatter,
-  ids, related-links, index coverage, size, qualifiers, staleness → 0 findings.
+- Candidate 1 → `testing/strategy/signal-delivery-to-a-process-under-test`.
+  Domain: the trigger is test-harness-shaped (harvester hint: testing) and the
+  testing INDEX line "writing or structuring automated tests" matches; category
+  `strategy` because the directive chooses the harness/driver structure, not an
+  assertion. No new category needed. The shell mechanism is cross-referenced to
+  platforms via the related-link rather than a second page (one case, one page).
+- Candidates 2–3 → no routing; retired as pending duplicates of open PR #51.
diff --git a/log.md b/log.md
index c930fc2..c4c9365 100644
--- a/log.md
+++ b/log.md
@@ -43,3 +43,4 @@ Append-only. Format: `## [YYYY-MM-DD] <ingest|revise|lint|gap|contradiction|drif
 ## [2026-08-06] revise | Union-merged amendments from the same 15 PRs into 24 existing pages (largest: tests-that-cannot-fail — 7 PRs: per-assertion mutation granularity, restore-mechanism-by-commit-state, suite-total-drop detection; portable-shell-scripts — 8 PRs: POSIX inline set-- reordering, ${VAR:-} vs ${VAR-} colon semantics, quote-by-what-the-text-is; test-data-and-isolation — 6 PRs: env-derived write paths, absent-variable cases, exec-bit fixtures, leak attribution; change-impact/call-site-enumeration — 8 unique additions from 7 path-variants: rename-in-place, same-type reorder, *args forwarding, two-searches-agree fallacy, codemod, coverage completion check). All non-canonical cross-page ids remapped to canonical pages; every added line traced to its source PR hunk (fabricated worker output was detected by orphan-line verification and replaced with true PR content).
 ## [2026-08-06] dedup | Cross-PR duplicate clusters collapsed: client-side rate limiting (8 PR versions at 3 paths → 1), call-site enumeration (7 versions at 7 paths → additions folded into the already-merged canonical page), stderr/exit-0 diagnostics (4 versions at 4 paths → 1), macOS sysroot (2→1), env-var off switch (2→1), completion predicates (2→1), robots.txt (2→1), harness-mediated results (2→1), leaked test artifacts (2→1), orchestration category naming (orchestration vs agent-orchestration → agent-orchestration). Kept distinct after trigger comparison: differential-testing vs differential-run-agreement (setup vs interpretation), unset-versus-empty-parameters vs env-var-off-switches (semantics vs design, cross-linked), import-time-side-effects vs test-level-choice edge (tactics vs level choice, cross-linked). Merged-main near-dup scan (Jaccard over title+trigger, 141 pages): 0 pairs — no duplication among previously merged content.
 ## [2026-08-06] ingest | Reconciled post-consolidation flush PRs #42–#43 (created against pre-#44 main). Folded unique content: platforms/filesystems/permissions-and-exec-bits (+`sh "$SCRIPT"` interpreter-invocation rows — stubs need no exec bit, avoids EDR chmod+x heuristics), platforms/shells/command-text-inspected-before-execution (+gate-AUTHOR step 8: parse all three POSIX quoting forms, expand only ~/$HOME/${HOME}; red-then-green bats evidence), testing/quality/checks-that-cannot-pass (+vacuously-green pre-implementation test row), platforms/processes/tool-diagnostics-without-a-failing-exit-code (+repeat-suppression edge, +clang reproduction source), infrastructure/ci-cd/secrets-handling (+independent credential channels row: gh token vs git SSH vs API token, git push --dry-run / author:@me probes), testing/mocking/what-to-mock (+ESM read-only-bindings DI rows, +PATH-emptied tripwire negative-proof). Dropped as duplicates of the #44 state: #42's rate-limit row (already in timeouts-and-retries + client-side-rate-limiting), #42's warning-only-diagnostics page (same trigger as tool-diagnostics-without-a-failing-exit-code), #42's leak-attribution row (already in test-data-and-isolation).
+## [2026-08-07] ingest | knowledge-flush: 1 new page testing/strategy/signal-delivery-to-a-process-under-test — POSIX §2.11 sets SIG_IGN for SIGINT/SIGQUIT on `&` jobs when job control is off, so `kill -INT` in a script harness is discarded and `wait` hangs; deliver via a subprocess driver (Popen.send_signal), `set -m`, or SIGTERM. Verified against POSIX + bash §3.7.6 + local sh/bash/zsh reproduction. Two sibling candidates (worktree_escape read-only escalation budgeting; orca bind-stage branching) dropped as pending duplicates of open PR #51.
diff --git a/wiki/platforms/processes/non-interactive-cli-invocation.md b/wiki/platforms/processes/non-interactive-cli-invocation.md
index 2315770..89714fd 100644
--- a/wiki/platforms/processes/non-interactive-cli-invocation.md
+++ b/wiki/platforms/processes/non-interactive-cli-invocation.md
@@ -12,7 +12,7 @@ sources:
   - https://man7.org/linux/man-pages/man1/timeout.1.html
   - https://en.wikipedia.org/wiki/Bracketed-paste
 last_verified: 2026-08-04
-related: [platforms-processes-background-services, platforms-tools-bsd-vs-gnu-cli, platforms-shells-portable-shell-scripts, debugging-methodology-hypothesis-testing, platforms-processes-parsing-cli-structured-output, platforms-shells-env-var-off-switches, infrastructure-agent-orchestration-pane-delivery-confirmation]
+related: [platforms-processes-background-services, platforms-tools-bsd-vs-gnu-cli, platforms-shells-portable-shell-scripts, debugging-methodology-hypothesis-testing, platforms-processes-parsing-cli-structured-output, platforms-shells-env-var-off-switches, infrastructure-agent-orchestration-pane-delivery-confirmation, testing-strategy-signal-delivery-to-a-process-under-test]
 ---
 
 # Invoking a Prompt-Capable CLI from a Script or Agent Harness
diff --git a/wiki/testing/index.md b/wiki/testing/index.md
index 5f3ed78..9caa272 100644
--- a/wiki/testing/index.md
+++ b/wiki/testing/index.md
@@ -17,6 +17,7 @@ Match your situation to a "load when" line; load only matching pages.
 | [differential-testing](strategy/differential-testing.md) | Two code paths must satisfy one specification and you want each to act as the other's oracle — interpreter vs compiled backend, a rewrite beside the service it replaces, v1 vs v2, a fast path beside a reference path, a cache beside its source; deciding which observable classes must agree and which the contract permits to differ; needing migration evidence beyond "the new one's own tests pass" |
 | [import-time-side-effects](strategy/import-time-side-effects.md) | Unit-testing a pure function whose module runs real I/O at import (`init_db()`, client connect, app object at module scope); a test errors during collection instead of skipping; a module-level `skipif`/marker fails to prevent a DB connect; choosing between `importorskip`, module-level skip, and `collect_ignore` |
 | [test-level-choice](strategy/test-level-choice.md) | Deciding at which level (unit/integration/e2e) to test new or changed behavior; reviewing a test plan's level distribution; logic buried in a controller or framework wiring needs coverage; a "pure" function's module runs I/O at import so its "unit" test needs a DB (and a function-level skip can't prevent it) |
+| [signal-delivery-to-a-process-under-test](strategy/signal-delivery-to-a-process-under-test.md) | Testing a program's SIGINT/Ctrl-C shutdown path; a `kill -INT` on a `&`-backgrounded PID is silently ignored and `wait` hangs to the harness timeout; the signal test passes by hand in a terminal but hangs in CI; choosing between a shell script and a subprocess driver for delivering signals |
 
 ## quality
 
diff --git a/wiki/testing/strategy/signal-delivery-to-a-process-under-test.md b/wiki/testing/strategy/signal-delivery-to-a-process-under-test.md
new file mode 100644
index 0000000..ac7ffbd
--- /dev/null
+++ b/wiki/testing/strategy/signal-delivery-to-a-process-under-test.md
@@ -0,0 +1,66 @@
+---
+id: testing-strategy-signal-delivery-to-a-process-under-test
+domain: testing
+category: strategy
+applies_to: [general]
+confidence: verified
+sources:
+  - https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html
+  - https://www.gnu.org/software/bash/manual/bash.html#Signals
+  - https://docs.python.org/3/library/subprocess.html#subprocess.Popen.send_signal
+last_verified: 2026-08-07
+related: [platforms-processes-non-interactive-cli-invocation]
+---
+
+# Signal Delivery to a Process Under Test
+
+## When this applies
+
+A test must exercise a program's SIGINT path (Ctrl-C shutdown, cleanup on
+interrupt, "exits 0 on SIGINT" contract) and the harness starts the program
+with `cmd &` from a shell script, then sends `kill -INT "$pid"`; the signal is
+silently discarded, `wait` hangs until the harness timeout, and the failure
+reads like a product bug.
+
+## Do this
+
+Spawn the process from a driver that controls signal dispositions instead of a
+shell background job. In Python: `proc = subprocess.Popen([...])`, then
+`proc.send_signal(signal.SIGINT)` and `proc.wait(timeout=...)`. `Popen`
+children inherit the test process's dispositions, so SIGINT arrives with its
+default action intact.
+
+The mechanism: POSIX (§2.11 Signals and Error Handling) requires that when job
+control is disabled — the state of every script, CI step, and hook shell — the
+commands of an asynchronous list "shall inherit from the shell a signal action
+of ignored (SIG_IGN) for the SIGINT and SIGQUIT signals". The kill succeeds,
+the child discards the signal. Bash documents the same rule (§3.7.6 Signals).
+
+| Case | Do |
+|------|----|
+| The harness language can spawn processes directly (Python, Node, Go) | Use its process API and send the signal to the child PID it returns |
+| The harness must stay a shell script | `set -m` before the `&` — with job control enabled the background job gets default SIGINT/SIGQUIT (verified sh/bash) |
+| The contract under test is generic graceful shutdown, not Ctrl-C specifically | Send SIGTERM — only SIGINT and SIGQUIT are special-cased; SIGTERM stays SIG_DFL in background jobs, so plain `kill "$pid"` from a script works |
+| You need to prove which case you are in | Run `python3 -c "import signal; print(signal.getsignal(signal.SIGINT))"` as the background job: `1` (SIG_IGN) confirms the shell nulled the path |
+
+## Edge cases
+
+| Case | Then |
+|------|------|
+| The program installs its own SIGINT handler unconditionally at startup | The shell-`&` harness can still work — but you are now testing the handler, not delivery; keep the driver approach so the test also covers default-disposition consumers |
+| The program is Python | CPython checks the inherited disposition at startup and does NOT install its KeyboardInterrupt handler over an inherited SIG_IGN — a Python child in a `&` job ignores Ctrl-C-class signals entirely |
+| The same test passes when run by hand in a terminal but hangs in CI | Interactive shells run with job control on, scripts run with it off — that divergence is this page's trigger, not flakiness |
+
+## Instead of
+
+| If you are about to | Do this instead | Why |
+|---------------------|-----------------|-----|
+| Raise the timeout or mark the SIGINT test flaky | Check the child's inherited disposition first (table above) | The wait never returns at any timeout — the signal was discarded, not delayed |
+| Debug the program's shutdown code because the test hangs | Reproduce with `send_signal` from a driver before touching the product | The same binary that "hangs" under `kill -INT` on a `&` job exits cleanly when the signal actually arrives |
+
+## Sources
+
+- https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html — §2.11: with job control disabled, asynchronous-list commands "shall inherit from the shell a signal action of ignored (SIG_IGN) for the SIGINT and SIGQUIT signals"
+- https://www.gnu.org/software/bash/manual/bash.html#Signals — §3.7.6: "When job control is not in effect, asynchronous commands ignore SIGINT and SIGQUIT in addition to these inherited handlers"
+- https://docs.python.org/3/library/subprocess.html#subprocess.Popen.send_signal — the driver-side delivery API
+- Local reproduction 2026-08-07 (macOS, sh/bash/zsh): `sh -c '<print-disposition> & wait'` reports SIG_IGN for SIGINT in the background child and the default handler in the foreground; with `set -m` the background child reports the default handler; SIGTERM reports SIG_DFL in both. Field case same day: a server binary timed out (rc 143) under `kill -INT $pid; wait` from a script, and exited 0 immediately under `subprocess.Popen` + `send_signal(SIGINT)`