Three reproductions on 2026-08-30 on the operator profile (binaries 363ab0c, 4f920d6):
- 12:11:14
systemctl --user stop → event=daemon_shutdown logged 2 s later (socket closed) → process still alive at 12:12:44 → State 'stop-sigterm' timed out. Killing. → code=killed, status=9/KILL
- 17:20:51 stop → 67 s later unit state
failed via SIGKILL
- 17:46:47 stop →
daemon_shutdown logged immediately, process still deactivating 68 s later
In each case the daemon prints event=daemon_shutdown within seconds but the process does not exit; background work (code-index rebuild/reconcile, graph replay, recovery loops that were spinning on the unbound graph) keeps running until systemd escalates to SIGKILL.
Consequence: the SIGKILL at 12:12:47 landed mid-WAL-write on tracedecay.grafeo (last WAL segment 11:27, checkpoint meta 11:11) and produced the permanent GRAFEO-X002 block-18 CRC corruption in the companion issue — a "clean stop" journey that actually guarantees a torn store under load.
Expected: SIGTERM cancels or checkpoints background work within the stop timeout (or the unit declares a realistic TimeoutStopSec), so a clean stop never degrades to SIGKILL while WAL writers are active.
Three reproductions on 2026-08-30 on the operator profile (binaries 363ab0c, 4f920d6):
systemctl --user stop→event=daemon_shutdownlogged 2 s later (socket closed) → process still alive at 12:12:44 →State 'stop-sigterm' timed out. Killing.→code=killed, status=9/KILLfailedvia SIGKILLdaemon_shutdownlogged immediately, process stilldeactivating68 s laterIn each case the daemon prints
event=daemon_shutdownwithin seconds but the process does not exit; background work (code-index rebuild/reconcile, graph replay, recovery loops that were spinning on the unbound graph) keeps running until systemd escalates to SIGKILL.Consequence: the SIGKILL at 12:12:47 landed mid-WAL-write on
tracedecay.grafeo(last WAL segment 11:27, checkpoint meta 11:11) and produced the permanent GRAFEO-X002 block-18 CRC corruption in the companion issue — a "clean stop" journey that actually guarantees a torn store under load.Expected: SIGTERM cancels or checkpoints background work within the stop timeout (or the unit declares a realistic TimeoutStopSec), so a clean stop never degrades to SIGKILL while WAL writers are active.