[bong-water-water-bong]

tests/kvshare_fd_handoff.py — the driver behind tests/hybrid_kvshare_e2e.sh (#1408) — runs an HRX llama-server in its own session and reaps it in a finally. That covers a clean exit, Ctrl-C and SIGTERM, but not SIGKILL: an OOM kill, a CI timeout, or an operator's kill -9 leaves the decoder running with its HRX context mapped. On 2026-11-08 an orphaned llama-server held 51 GiB of GTT for 14 h and knocked out another service; a test that can leak a decoder is exactly the wrong kind of test to have, so the child is now spawned with PR_SET_PDEATHSIG (SIGTERM) and the kernel takes it down whenever the parent dies, for any reason.

Linux only, which is where the HRX route runs; elsewhere the flag is not set and the finally remains the reaper.

Pinned without a GPU or a model

tests/kvshare_orphan_test.sh (ctest kvshare_orphan, ~0.9 s) drives the mechanism directly:

check	result
the driver spawns a child in its own session	ok (pid printed, alive)
SIGKILL the driver → the child goes with it	ok (PR_SET_PDEATHSIG)
negative control: a child spawned without the flag survives the same kill	ok — this is the leak being prevented, so the test would fail if the flag were dropped

The third row is the one that matters: without it the test would pass just as happily if die_with_parent() were a no-op.

Device re-run of the test this changes (no regression)

gpu-hold -l zerocopy -t 15, ticket held 25 s, released clean, no server left behind:

share ok: share_id=1 regions=1
provider ASan reports=0   provider result: {"n_tokens":271,"import_ms":30.240,...}
adopt ok: {"n_adopted":271,"n_read":0,"timings":{"adopt_ms":0.103}}
decode after adopt: prompt_n=1  text=' The tide comes in twice a day,'
ok x5  →  PASS

Refs #698. tools/copyright.py --check clean (notice on the new test), bash -n and py_compile clean, and the change is 19 lines in the driver plus the test.

What this does not fix: a run that is SIGKILLed now leaves nothing, but a run whose provider is killed mid-write still leaves a region the decoder will adopt from — that is the "provider claims more than it wrote" case, which the route already refuses per request (engine#1203) and is not this PR's subject.

[bong-water-water-bong]

#1524 ready for review at d76d6b9110f6d4b804da2fbf936e25f042368c1b — MERGEABLE, 3 files, +86. The handoff driver (#1408) reaped its HRX server in a finally, which misses SIGKILL — the exact shape that left a 51 GiB-GTT llama-server orphaned for 14 h on 11-08. Now PR_SET_PDEATHSIG, and tests/kvshare_orphan_test.sh (ctest kvshare_orphan, 0.9 s, no GPU/model) pins it with a negative control: a child spawned without the flag must survive the same kill, so a no-op die_with_parent() cannot pass. Device re-run of the changed test: PASS (n_adopted 271, n_read 0, prompt_n 1, ASan 0, adopt 0.103 ms), gpu-hold ticket released clean with no server left behind.

[bong-water-water-bong]

VERDICT: READY at d76d6b9110f6d4b804da2fbf936e25f042368c1b

I reviewed d76d6b9 against #698 and the orphaned-server incident on 11-08.

What I ran at this head:

• bash tests/kvshare_orphan_test.sh passed four times in a row, with all three rows ok each time, including the negative control. The control is what makes the test meaningful: if the flag were dropped, row 2 would fail while row 3 still passed.
• Afterwards, no time.sleep(120) child is left on the box.
• py_compile passes and tools/copyright.py --check exits 0.
• shellcheck's one warning (SC2034, gone unused) is a false positive, because gone is read inside the eval in check.

Checked for correctness:

• preexec_fn is only safe when no other thread is running at fork time. The driver's only thread (do_share, :198-199) starts after the Popen (:149), so the fork happens single-threaded.
• PR_SET_PDEATHSIG fires on the death of the parent thread that forked the child. Here that's the main thread, so it lives exactly as long as the driver.
• The signal survives execve because llama-server isn't setuid.

Three small notes, not blocking:

1. A fork → prctl race. If the driver dies after fork but before prctl runs, the child is already reparented and no signal ever comes. The standard close is to save os.getpid() before Popen, then in die_with_parent, after the prctl, exit with os._exit(1) if os.getppid() no longer matches.
2. SIGTERM vs SIGKILL. SIGTERM starts llama-server's graceful shutdown. If that teardown ever stalls (HRX has had teardown and import stalls before), the decoder stays alive and keeps its GTT, which is the case this PR is closing. SIGKILL is the safer death signal for a test driver.
3. prctl's return value isn't checked. Through ctypes, a failure returns -1 rather than raising, so the except never sees it. Fine on Linux, but the comment "elsewhere the flag is simply not set" is accurate only by accident.

I didn't re-run the device row. The test this PR changes is driven without a GPU, and the author's 25 s gpu-hold run is reported above.