@smartmemory/compose 0.4.1 → 0.5.0

package/lib/ideabox.js

@@ -16,6 +16,7 @@
 
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs'
 import { join, dirname } from 'node:path'
+import { assertIdeaboxReadable } from './fluid/ideabox-readable.js'
 import { resolvePathValue } from './paths-core.js'
 
 // ---------------------------------------------------------------------------
@@ -47,6 +48,36 @@ export const IDEABOX_TEMPLATE = `# Ideabox
 // Matches: #### IDEA-42 — Some Title   (or "- " variant)
 const IDEA_HEADING_RE = /^####\s+(IDEA-(\d+))\s+[—–-]+\s+(.+)$/
 
+// The LEGACY (pre-umbrella) dialect: ideas are H3 under arbitrary `## Topic`
+// headings, with no `## Ideas` wrapper and no cluster level. Published installs
+// upgrading from before COMP-PLAN-IDEA-UNIFY have this shape, so it is the
+// dialect the migration path actually meets — see COMP-IDEABOX-MIGRATE-DIALECT,
+// where failing to read it destroyed 18 ideas in one command.
+const LEGACY_IDEA_HEADING_RE = /^###\s+(IDEA-(\d+))\s+[—–-]+\s+(.+)$/
+
+// An idea heading at EITHER level. A third vintage in the wild is a hybrid: it
+// has the modern `## Ideas` wrapper (so it is not the flat dialect) but writes
+// both its ideas AND its umbrellas at H3. Those two are still unambiguous —
+// an H3 that starts with an `IDEA-N` id is an idea, and any other H3 is an
+// umbrella — so the level alone was never what distinguished them.
+// Measured 2026-09-06: three projects on this machine are in this dialect
+// (books 9 ideas, ScaleMate 2, trustflow 1). Before the guard landed they were
+// silently destroyed; with the guard but without this they are refused, which
+// is safe but leaves them unable to use the ideabox at all.
+const IDEA_HEADING_ANY_RE = /^#{3,4}\s+(IDEA-(\d+))\s+[—–-]+\s+(.+)$/
+
+/**
+ * A line SHAPED like an idea declaration, at any heading level.
+ *
+ * Used only to notice a heading the dialect's own idea pattern could not
+ * consume — the "I can see something here and cannot read it" case.
+ */
+const IDEA_DECL_SHAPE_RE = /^\s*#{1,6}\s+(IDEA-\d+)\b/
+
+/** The bullet form, for a document that uses no idea headings at all. */
+const IDEA_BULLET_SHAPE_RE = /^\s*[-*]\s+(IDEA-\d+)\s*[—–:-]/
+
+
 // Matches a field line: **FieldName:** value  (colon inside bold markers)
 const FIELD_RE = /^\*\*([^*:]+):\*\*\s*(.*)$/
 
@@ -80,6 +111,41 @@ const DISCUSSION_ENTRY_RE = /^-\s+\[(\d{4}-\d{2}-\d{2})\]\s+([^:\n]+?):\s+(.+)$/
 export function parseIdeabox(markdown) {
   const lines = markdown.split('\n')
 
+  // Legacy dialect detection, fenced as narrowly as possible: it activates ONLY
+  // when the document has no `## Ideas` section AND carries H3 idea headings.
+  // A new-dialect file always opens its ideas with `## Ideas`, so legacy mode
+  // can never engage on one. A file with BOTH shapes is deliberately left to
+  // the modern path — a half-converted document is not something to guess at,
+  // and the migration gate refuses it by declaration count instead.
+  // A COMPLETE heading, not a prefix: `/^##\s+Ideas/` also matched a legitimate
+  // legacy topic called `## Ideas for Later`, which switched legacy mode off and
+  // made that document's ideas unreadable. Fenced blocks are skipped for the
+  // same reason — an example containing `## Ideas` must not decide the dialect
+  // of the file quoting it.
+  const structural = []
+  let fenced = false
+  for (const l of lines) {
+    if (/^\s*```/.test(l)) { fenced = !fenced; continue }
+    if (!fenced) structural.push(l)
+  }
+  const hasIdeasSection = structural.some((l) => /^##\s+Ideas\s*$/.test(l))
+  const legacy = !hasIdeasSection && structural.some((l) => LEGACY_IDEA_HEADING_RE.test(l))
+
+  // The hybrid dialect only exists in a document the tools have NEVER written:
+  // every write emits ideas at H4, so a document containing any `#### IDEA-` is
+  // modern, and an H3 there is an umbrella no matter what it is called.
+  //
+  // That distinction is load-bearing rather than cosmetic. `compose ideabox`
+  // will happily create a cluster named `IDEA-9 — Cache research`, and reading
+  // that back as an idea made the next command fail: the guard saw a declared
+  // id with no record behind it and refused. Recognising H3 ideas everywhere
+  // broke round-tripping the tool's own output.
+  const hasModernIdeaHeadings = structural.some((l) => IDEA_HEADING_RE.test(l))
+  const hybrid = hasIdeasSection && !hasModernIdeaHeadings
+  const ideaHeadingRe = legacy
+    ? LEGACY_IDEA_HEADING_RE
+    : (hybrid ? IDEA_HEADING_ANY_RE : IDEA_HEADING_RE)
+
   const ideas = []
   const killed = []
   // Cluster-scoped data. An umbrella heading carries a hand-authored multi-
@@ -89,11 +155,25 @@ export function parseIdeabox(markdown) {
   // parse→serialize cycle (i.e. every `compose ideabox` mutation) deleted it.
   const clusters = []
   const clusterIndex = new Map()
+  // Idea-shaped headings that NO branch consumed. The migration gate compares
+  // these against the ideas actually produced, so that "the parser could not
+  // read this" can never be mistaken for "there was nothing here". Collected
+  // HERE, by the parser itself, rather than by a second scanner: the whole class
+  // of bug this module keeps producing is two readers disagreeing about what the
+  // document says, and a separate scanner is a second reader by construction.
+  const shapes = []
+  // Idea-shaped headings taken as UMBRELLA names. Legitimate on its own — the
+  // tools will create a cluster called `IDEA-9 — Cache research` — but an
+  // umbrella named after an id that is ALSO a real idea in the same document is
+  // the half-converted file, not a naming choice.
+  const clusterNamedIds = []
   // Everything before `## Ideas`. Regenerating this from IDEABOX_TEMPLATE
   // instead of preserving it drops hand-authored convention bullets.
   const preambleLines = []
 
-  let inIdeasSection = false
+  // In the legacy dialect there is no `## Ideas` wrapper — the ideas simply
+  // live under topic headings — so the whole document is the ideas section.
+  let inIdeasSection = legacy
   let inKilledSection = false
   let currentCluster = null
   let currentIdea = null
@@ -111,11 +191,43 @@ export function parseIdeabox(markdown) {
     currentIdea = null
   }
 
+  // Fenced blocks are documentation, not content. Detection and the declaration
+  // scan already skipped them; the parse loop did not, so an example in a
+  // ```markdown``` block was imported as a real idea — and, worse, satisfied the
+  // readability guard on behalf of a genuine entry with the same id that the
+  // parser could NOT read, letting the destructive write through. All three
+  // readers have to agree on what is content.
+  let inFence = false
+
   for (let i = 0; i < lines.length; i++) {
     const line = lines[i]
 
+    if (/^\s*```/.test(line)) {
+      inFence = !inFence
+      if (!inIdeasSection && !inKilledSection && !seenAnySection) preambleLines.push(line)
+      // The DELIMITERS are content too. Keeping the enclosed lines while
+      // dropping the fence turned a fenced `#### IDEA-2 — example` inside an
+      // idea's body into a real heading on the next projection, and the render
+      // after that refused the file it had just written.
+      else if (currentIdea) currentIdea._extraLines.push(line)
+      continue
+    }
+    if (inFence) {
+      if (!inIdeasSection && !inKilledSection && !seenAnySection) preambleLines.push(line)
+      else if (currentIdea) currentIdea._extraLines.push(line)
+      continue
+    }
+
+    // Every idea-shaped heading in the document, recorded BEFORE any branch can
+    // swallow it. What is consumed as a real idea or as an umbrella is
+    // subtracted at the end; whatever is left is content the parser could see
+    // and could not read, which the migration gate must refuse rather than
+    // treat as absent.
+    const shapeHere = line.match(IDEA_DECL_SHAPE_RE)
+    if (shapeHere) shapes.push(shapeHere[1])
+
     // Detect section boundaries
-    if (/^##\s+Ideas/.test(line)) {
+    if (/^##\s+Ideas\s*$/.test(line)) {
       flushCurrentIdea()
       inIdeasSection = true
       inKilledSection = false
@@ -123,7 +235,7 @@ export function parseIdeabox(markdown) {
       currentCluster = null
       continue
     }
-    if (/^##\s+Killed\s+Ideas/.test(line)) {
+    if (/^##\s+Killed\s+Ideas\s*$/.test(line)) {
       flushCurrentIdea()
       inIdeasSection = false
       inKilledSection = true
@@ -132,8 +244,34 @@ export function parseIdeabox(markdown) {
       continue
     }
     // Other H2 sections end both
-    if (/^##\s/.test(line) && !(/^##\s+Ideas/.test(line)) && !(/^##\s+Killed\s+Ideas/.test(line))) {
+    if (/^##\s/.test(line) && !(/^##\s+Ideas\s*$/.test(line)) && !(/^##\s+Killed\s+Ideas\s*$/.test(line))) {
       flushCurrentIdea()
+      if (legacy) {
+        // A `## Topic` heading in the legacy dialect is not the end of the
+        // ideas — it is how that dialect GROUPED them, which is precisely what
+        // an umbrella is. Mapping it to a cluster instead of discarding it
+        // means the upgrade preserves the author's grouping rather than
+        // flattening ten topics into one undifferentiated list. Treating it as
+        // preamble (the previous behaviour) collected every topic heading at
+        // the top of the file, detached from its ideas.
+        const name = line.replace(/^##\s+/, '').trim()
+        seenAnySection = true
+        // Leaving the killed section matters: without this, every idea under a
+        // topic heading that happened to follow `## Killed Ideas` was imported
+        // as KILLED. A topic heading opens a group, it does not inherit the
+        // previous section's disposition — and it re-enters the ideas section,
+        // which `## Killed Ideas` had closed, or the ideas below it are read as
+        // neither live nor killed and vanish entirely.
+        inKilledSection = false
+        inIdeasSection = true
+        currentCluster = name
+        if (!clusterIndex.has(name)) {
+          const entry = { name, theme: '', order: clusters.length }
+          clusters.push(entry)
+          clusterIndex.set(name, entry)
+        }
+        continue
+      }
       inIdeasSection = false
       inKilledSection = false
       // Still part of the preamble when it precedes the first real section —
@@ -142,6 +280,15 @@ export function parseIdeabox(markdown) {
       continue
     }
 
+    // Legacy preamble: everything before the first topic heading or idea. The
+    // modern collector below is unreachable here because legacy mode is inside
+    // the ideas section from line one, so without this the document's title and
+    // introduction were dropped on the first render after migration.
+    if (legacy && !seenAnySection && !currentIdea) {
+      preambleLines.push(line)
+      continue
+    }
+
     if (!inIdeasSection && !inKilledSection) {
       // Preamble = everything before the first section heading.
       if (!seenAnySection) preambleLines.push(line)
@@ -156,9 +303,14 @@ export function parseIdeabox(markdown) {
       continue
     }
 
-    // H3 = cluster heading
-    if (/^###\s/.test(line)) {
+    // H3 = cluster heading (modern dialect only — in the legacy dialect H3 IS
+    // the idea heading, handled below, and there is no cluster level at all).
+    // An H3 carrying an idea id is an IDEA at this level too, not an umbrella
+    // named after one; the hybrid dialect writes both at H3.
+    if (!legacy && /^###\s/.test(line) && !(hybrid && IDEA_HEADING_ANY_RE.test(line))) {
       flushCurrentIdea()
+      const eaten = line.match(IDEA_DECL_SHAPE_RE)
+      if (eaten) clusterNamedIds.push(eaten[1])
       currentCluster = line.replace(/^###\s+/, '').trim()
       if (!clusterIndex.has(currentCluster)) {
         const entry = { name: currentCluster, theme: '', order: clusters.length }
@@ -179,7 +331,7 @@ export function parseIdeabox(markdown) {
     }
 
     // H4 = idea heading
-    const headingMatch = line.match(IDEA_HEADING_RE)
+    const headingMatch = line.match(ideaHeadingRe)
     if (headingMatch) {
       flushCurrentIdea()
       currentIdea = {
@@ -273,7 +425,47 @@ export function parseIdeabox(markdown) {
   // serializer re-adds the separator itself.
   while (preambleLines.length && preambleLines.at(-1).trim() === '') preambleLines.pop()
 
-  return { ideas, killed, nextId, clusters, preamble: preambleLines.join('\n') }
+  // The bullet form is a fallback, not a rule: it counts ONLY for a document
+  // with no idea headings whatsoever. Counting bullets unconditionally made
+  // `- IDEA-1 needs research`, written inside IDEA-1's own body, a second
+  // declaration of IDEA-1 — and the gate then refused a perfectly readable file.
+  // A reference is not a declaration, and the only document where a bullet
+  // plausibly IS one is a document that declares nothing any other way.
+  const parsedIds = [...ideas, ...killed].map((i) => i.id)
+
+  // By COUNT, not by membership. A half-converted document declares the same id
+  // twice — once in each dialect — and the parser consumes only one of them; a
+  // membership test sees the id in `parsedIds` and calls it accounted for, while
+  // the other copy (routinely the older, richer one) is invisible and would be
+  // deleted by the next render. Counting says two were written and one was read.
+  const count = (arr, id) => arr.filter((x) => x === id).length
+  const unconsumed = [...new Set(shapes)].filter(
+    (id) => count(shapes, id) > count(parsedIds, id) + count(clusterNamedIds, id),
+  )
+  // An umbrella named after an id that is also a real idea here.
+  const collisions = clusterNamedIds.filter((id) => parsedIds.includes(id))
+
+  if (!ideas.length && !killed.length && !unconsumed.length) {
+    let bulletFence = false
+    for (const line of lines) {
+      if (/^\s*```/.test(line)) { bulletFence = !bulletFence; continue }
+      if (bulletFence) continue
+      const m = line.match(IDEA_BULLET_SHAPE_RE)
+      if (m && !unconsumed.includes(m[1])) unconsumed.push(m[1])
+    }
+  }
+
+  return {
+    ideas,
+    killed,
+    nextId,
+    clusters,
+    preamble: preambleLines.join('\n'),
+    // Idea-shaped content this parse could NOT turn into an idea.
+    unconsumed,
+    // Umbrellas named after ids that are also real ideas in this document.
+    collisions,
+  }
 }
 
 function extractStatus(raw) {
@@ -647,7 +839,15 @@ export function readIdeabox(cwd, ideaboxPath) {
     return { ideas: [], killed: [], nextId: 1 }
   }
   const markdown = readFileSync(fullPath, 'utf-8')
-  return parseIdeabox(markdown)
+  // FU-2. Returning a partial parse from here made "I could not read this file"
+  // indistinguishable from "this file has nothing in it" for every caller —
+  // most visibly `compose new --from-idea`, which reported "idea not found" for
+  // an idea plainly present in the file and then built a feature without the
+  // content it had been asked for. The assertion lives in its own leaf module
+  // (`fluid/ideabox-readable.js`) precisely so the parser's module can call it:
+  // the migration gate imports `parseIdeabox` from here, so keeping it there
+  // would close an import cycle.
+  return assertIdeaboxReadable(parseIdeabox(markdown), fullPath)
 }
 
 /**

package/lib/maya-identity.js

@@ -136,12 +136,26 @@ export async function provisionIdentity({ smBaseUrl, fetchFn = fetch }) {
   };
 }
 
+/** The oldest NDA version this client knows; the server names a newer one. */
+const NDA_VERSION_FLOOR = 'v1';
+
 /** Accept the beta NDA for a provisioned identity (403 `nda_required` gates
  *  every memory route until this runs — FOH-4 ledger prereq 3). */
 export async function acceptNda({ smBaseUrl, token, fetchFn = fetch }) {
-  const res = await requestJson(`${smBaseUrl}/memory/beta/nda/accept`, {
-    body: { version: 'v1' }, token, fetchFn,
+  const attempt = (version) => requestJson(`${smBaseUrl}/memory/beta/nda/accept`, {
+    body: { version }, token, fetchFn,
   });
+  let res = await attempt(NDA_VERSION_FLOOR);
+  // The NDA version is upstream's to bump, not ours to track: a 409
+  // `version_mismatch` names the version currently in force, and accepting the
+  // one the server names is the only answer that survives the next bump.
+  // FOH-7 live-fire (2026-09-06) found v1 hardcoded after upstream moved to v2 —
+  // every provisioned colleague identity failed its first turn.
+  const named = res.status === 409 && res.body?.detail?.code === 'version_mismatch'
+    ? res.body.detail.current_version : null;
+  if (typeof named === 'string' && named && named !== NDA_VERSION_FLOOR) {
+    res = await attempt(named);
+  }
   if (res.status < 200 || res.status >= 300) {
     throw new MayaIdentityError(`maya: NDA accept failed (HTTP ${res.status})`);
   }

package/lib/process-termination.js

@@ -11,8 +11,35 @@
  *   alive → await leader close and group disappearance (bounded at 2 seconds).
  *
  * Grace period: `COMPOSE_CANCEL_GRACE_MS` (default 5000ms).
+ *
+ * D-TERM-1 (2026-09-07): `-pid` IS still signalled after the leader is reaped.
+ * ------------------------------------------------------------------------
+ * The open question was whether signalling the group after `close` aims at a
+ * pgid the kernel may have recycled to a stranger. It does not, for the whole
+ * window that matters:
+ *
+ *   POSIX 4.13 — "if there exists a process group whose process group ID is
+ *   equal to that process ID, the process ID shall not be reused until the
+ *   process group lifetime ends" — and a group's lifetime ends only when its
+ *   LAST member leaves.
+ *
+ * So while our group has any living member, `-pid` provably names OUR group,
+ * and a living member is exactly the condition teardown is waiting on.
+ * Measured on Darwin 25.6.0 rather than taken on faith: with the leader reaped
+ * and one grandchild left, 400,000 fork/exit cycles never got the pgid handed
+ * back (the pid space is ~100k, so that is four wraps). Emptying the group
+ * first, the same pid came back at iteration 98,102 — one full wrap.
+ *
+ * That measurement RETIRES the fear rather than confirming it: the recycled
+ * pgid needs roughly 98,000 process creations between our group emptying and
+ * our probe, inside a 2s reap deadline. It is not a millisecond race, and it
+ * is the LEAST likely reading of a group-signal failure, not the diagnosis.
+ * Keep signalling the group after close — "the group outlives the leader" is
+ * correct and load-bearing.
  */
 
+import { execFileSync } from 'node:child_process';
+
 const DEFAULT_GRACE_MS = 5000;
 
 /** Read the configured cancellation grace period. */
@@ -35,6 +62,89 @@ function graceMsFromEnv(env = process.env) {
  * @param {number} [graceMs]
  * @returns {{ close: Promise<void>, terminate: () => Promise<void>, finish: () => Promise<void> }}
  */
+/**
+ * Every process currently in `pgid`, so a group-signal failure can be
+ * attributed instead of argued about.
+ *
+ * `ps -g` is NOT portable — BSD reads it as a pgid list, procps as a
+ * session/group list — so the whole table is read and filtered here.
+ *
+ * @returns {Array<object> | {error: string}} never throws: this runs on an
+ *   error path, where a second failure would replace the first one.
+ */
+function groupMembers(pgid) {
+  try {
+    const table = execFileSync('ps', ['-eo', 'pid=,pgid=,ppid=,uid=,comm='], {
+      encoding: 'utf8', timeout: 2000, maxBuffer: 4 * 1024 * 1024,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    return table.split('\n')
+      .map((line) => line.trim().split(/\s+/))
+      .filter((f) => f.length >= 5 && Number(f[1]) === pgid)
+      // `comm` is last and may contain spaces (it is a path), so it takes the tail.
+      .map((f) => ({ pid: Number(f[0]), ppid: Number(f[2]), uid: Number(f[3]), comm: f.slice(4).join(' ') }));
+  } catch (e) {
+    return { error: e?.code ?? e?.message ?? 'unknown' };
+  }
+}
+
+/**
+ * Why a group signal failed, stamped on the error itself.
+ *
+ * A non-ESRCH failure here is rethrown, relabelled `CANCELLATION_UNCONFIRMED`
+ * by `terminate`, and reaches the caller carrying only Node's bare message —
+ * `kill EPERM` and nothing else, which is unattributable after the fact: two
+ * call sites send group signals.
+ *
+ * WHAT EPERM MEANS HERE. Measured on Darwin 25.6.0: `kill(-pgid, 0)` against a
+ * group of processes we may not signal answers EPERM, not ESRCH. So EPERM says
+ * exactly one thing — *a group with this pgid exists and every member refused
+ * our signal*. Three sub-causes, deliberately unranked except for the last:
+ *
+ *   1. a member runs as another uid (a tool child that escalated), or
+ *   2. a policy — MAC / sandbox — refused the signal for a member that shares
+ *      our uid, so "same uid" does NOT rule this out, or
+ *   3. our group is gone and a stranger holds a recycled pgid.
+ *
+ * (3) was the original hypothesis and is the LEAST likely of the three: per
+ * D-TERM-1 above it needs ~98,000 process creations inside a 2s deadline.
+ *
+ * `killGroupMembers` is what actually separates them, and it is why this
+ * function exists at all: uids other than ours point at (1) or (2), and
+ * processes plainly unrelated to the run point at (3).
+ *
+ * `killLeader` is kept but is NOT the discriminator it shipped as. After
+ * `close` the leader has been reaped, so it reads `gone` in every realistic
+ * recurrence; `ours` / `not-ours` need the same implausible wrap as (3). Do not
+ * read `not-ours` as "recycled pgid confirmed" — that inference was wrong.
+ *
+ * Diagnostic only: it changes no control flow and rethrows the same error.
+ */
+function describeGroupSignalFailure(error, { site, pid, signal }) {
+  error.killSite = site;
+  error.killTarget = -pid;
+  error.killSignal = signal;
+  error.killerPgid = typeof process.getpgrp === 'function' ? process.getpgrp() : null;
+  try {
+    // The LEADER as a plain pid, not the group. Probing must never throw out of
+    // an error path, so every outcome is recorded rather than raised.
+    process.kill(pid, 0);
+    error.killLeader = 'ours';
+  } catch (probe) {
+    error.killLeader = probe.code === 'EPERM' ? 'not-ours' : (probe.code === 'ESRCH' ? 'gone' : probe.code);
+  }
+  error.killGroupMembers = groupMembers(pid);
+  const members = Array.isArray(error.killGroupMembers)
+    ? (error.killGroupMembers.length
+      ? error.killGroupMembers.map((m) => `${m.pid}/uid ${m.uid} ${m.comm}`).join(', ')
+      : 'none')
+    : `unreadable (${error.killGroupMembers.error})`;
+  error.message = `${error.message} (${site} ${String(signal)} → pgid ${pid}; `
+    + `leader ${error.killLeader}; our pgid ${error.killerPgid}; our uid ${process.getuid?.() ?? '?'}; `
+    + `group members: ${members})`;
+  return error;
+}
+
 export function processTermination(child, group, graceMs = graceMsFromEnv(), reapTimeoutMs = 2000) {
   let closed = false;
   const close = new Promise((resolve) => child.once('close', () => { closed = true; resolve(); }));
@@ -45,7 +155,9 @@ export function processTermination(child, group, graceMs = graceMsFromEnv(), rea
       try {
         process.kill(-child.pid, signal);
       } catch (error) {
-        if (error.code !== 'ESRCH') throw error;
+        if (error.code !== 'ESRCH') {
+          throw describeGroupSignalFailure(error, { site: 'send', pid: child.pid, signal });
+        }
       }
     } else if (!closed) {
       child.kill(signal);
@@ -61,15 +173,21 @@ export function processTermination(child, group, graceMs = graceMsFromEnv(), rea
       return true;
     } catch (error) {
       if (error.code === 'ESRCH') return false;
-      throw error;
+      throw describeGroupSignalFailure(error, { site: 'alive', pid: child.pid, signal: 0 });
     }
   };
 
   const terminate = () => {
     teardown ??= (async () => {
-      send('SIGTERM');
       let timer;
       try {
+        // INSIDE the try. Outside it, a refused opening SIGTERM escaped with
+        // Node's bare `EPERM` as its code, so the one failure the caller is
+        // told to expect from a group signal — CANCELLATION_UNCONFIRMED, per
+        // `describeGroupSignalFailure` — was the one code it never got. Only
+        // the later `alive()` and SIGKILL sites were ever labelled. Found by
+        // the D-TERM-1 test below, which is the first test this path ever had.
+        send('SIGTERM');
         await Promise.race([
           new Promise((resolve) => { timer = setTimeout(resolve, graceMs); }),
           // A leader that closed while its group lives must still wait out the