Development record

2026-10-31 — Checklist row 105, the CI headroom check: every check-job step that runs go test runs under a job-clock watchdog (cmd/ci-watchdog), which at the leg's cap less a 5-minute margin sends SIGQUIT to the test binaries, the processes in the step's own process group whose parent is go test, and 30 seconds later sends the whole group SIGKILL through the leader's handle, so a hang fails with goroutine dumps before the cap cancels the job with none. go test itself is never sent SIGQUIT: it takes the signal for an interrupt and drops the output it holds for each package of a multi-package run, which lost the dump in 8 of 9 trials when the whole group was signalled. Each target is read from ps by the group's id, never by name, and its group and parent are read again just before its signal. Limit: a target is signalled by pid, not through a handle, so a process that exits between that last read and its signal can have its pid reused; the read narrows this to a new process in the step's own group under the same parent, which only the step's own processes can be. go test's -timeout counts from each test binary's start, so it cannot bound the job clock: on a passing merge-group run the last package binary started 23.8 minutes into the ubuntu leg and 66.0 into the macOS leg, so a hang there would meet the 45- and 85-minute caps long before the 40m -timeout fired. The -timeout stays 40m, the per-package budget make preflight shares. The test steps now end by 40 minutes on the ubuntu leg and 80 on the macOS leg, the caps less the margin, so a passing leg whose tests would have finished inside the last 5 minutes of its cap now fails at the deadline instead. Rejected: a static headroom check with a lower -timeout, because on macOS a late package would need 19 minutes or less while internal/core/implement/loop alone ran 19.1 minutes there, so no single value fits, and lowering it on ubuntu alone would split the budget CI and preflight share; and raising the caps, which is the technical facilitator's call, cannot carry the macOS leg past the merge queue's 90-minute check response cap, and would leave the late-start gap in place. The coordinating session chose the watchdog on delegation; the caps stay as they are.