Dispose exec children once on every TUI exit path - #846

independent critic found no blocking orphans on primary TUI/exec run_shell paths. Once-only dispose holds. Follow-ups already in: quit shuts down before hung tail, reap timeout fails teardown, shutdown errors logged. Remaining should-fix being addressed: subagent dispose currently swallows posixTools.dispose rejection.

re-critic of origin/main..HEAD including ed15287 found no blocking orphans on primary TUI/exec run_shell paths. Subagent posix dispose rejection is no longer swallowed on ephemeral teardown (disposeSubAgentSession awaits with no catch). Remaining file-for-later: persist close_agent still best-effort-catches dispose, so a persist worker leftover after reap can still look like success at the fleet layer.

Critic · Request changes

TUI/exec teardown is once-only and leftover posix dispose can fail the close path, but live children are still SIGKILLed only after agent.close(), so a wedged close or the 2s crash/signal race orphans detached shell-guard processes.

Findings

• src/subagent/dispose.ts:113 / src/subagent/run.ts:1074 — posixTools.dispose() (the process-group kill) runs only after await agent.close() and await streamPromise. closeOnAbort no longer disposes posix tools. boundedClose then times out as success (src/subagent/run.ts:1111, src/subagent/session-store.ts:30). Sequence: persist worker with a live run_shell child; agent.close() hangs (the documented close-ordering wedge); close_agent / cancelAll hits the deadline; session is shutdown; the detached child is still alive. src/subagent/session-store.test.ts:572 locks in hung-close → shutdown success.

• src/tui/runner/shutdown.ts:44 / src/exec/runner.ts:171 / src/index.ts:123 — crash/signal Promise.race waits 2s for the whole chain (cancelAll → closeAgent → disposeToolset). Reap is the last leg. Sequence: live parent run_shell; SIGTERM while agent.close() takes >2s; awaitActiveDisposeHost logs the deadline and process.exits; detached children survive. The integration fixture uses agent: null, so it never hits this.

• src/index.ts:129 — the 2s timer is never cleared when dispose wins. The loser rejects later as unhandledRejection (handler no-ops because terminating is already true).

• src/exec/runner.ts:891 — leftover dispose after a successful exec is logger.debug plus exitCode = 1. No stderr. Operator sees a silent 1; run.json is already done.

• src/tui/runner/exit.ts:544 — shutdown now precedes awaitTail, but the tail is still unbounded. A hung session-op still prevents run.json, telemetry, and the teardownFailed exit 1. src/tui/runner/exit.test.ts:56 documents the hang.

• src/tui/runner/shutdown.ts:18 — completion starts as Promise.resolve(). A signal that re-enters after started = true and before completion = (async () => …)() (window is disposeHost() + starting cancelWorkers) observes a finished dummy and can process.exit before reap.

Notes

• Once-only plugin dispose, leftover throw from reapLiveChildren, and TUI teardownFailed → exit 1 are fine when close actually returns in time.
• Permanent tests to keep: hung agent.close() with a live tracked child must kill or fail close, not report shutdown; signal path with slow closeAgent must still reap; successful exec + throwing toolset dispose must be exit 1 and visible.