Stop a leg's container on Ctrl-C with docker run --init

ci.sh

@@ -45,6 +45,26 @@ boundaries_fire() {
 
 leg "import boundaries fire ($node_image)" boundaries_fire
 
+# Without `docker run --init`, process 1 ignores the SIGINT docker forwards and the container runs to its end.
+interrupt_stops_container() {
+  local pid ready started waited=0
+  ready=$(mktemp) || return 1
+  in_image "$node_image" sh -c 'echo ready; sleep 60' > "$ready" &
+  pid=$!
+  until grep -q ready "$ready"; do
+    waited=$((waited + 1))
+    [ "$waited" -le 300 ] || return 1
+    sleep 0.2
+  done
+  kill -INT "$pid"
+  started=$SECONDS
+  wait "$pid" || true
+  rm -f "$ready"
+  [ $((SECONDS - started)) -lt 20 ]
+}
+
+leg "Ctrl-C stops a leg's container ($node_image)" interrupt_stops_container
+
 test_log=$(mktemp)
 node_tests() {
   in_image "$node_image" npm test 2>&1 | tee "$test_log"

docker-runner.sh

@@ -9,7 +9,7 @@ node_image=node:26.13.0-alpine3.24
 in_image() {
   local image=$1 entrypoint=$2
   shift 2
-  docker run --rm -u "$(id -u):$(id -g)" -e HOME=/tmp ${PROPERTY_RUNS+-e PROPERTY_RUNS} ${in_image_memory:+--memory "$in_image_memory" --memory-swap "$in_image_memory"} ${in_image_network:+--network "$in_image_network"} -v "$PWD:/app" -w /app --entrypoint "$entrypoint" "$image" "$@"
+  docker run --rm --init -u "$(id -u):$(id -g)" -e HOME=/tmp ${PROPERTY_RUNS+-e PROPERTY_RUNS} ${in_image_memory:+--memory "$in_image_memory" --memory-swap "$in_image_memory"} ${in_image_network:+--network "$in_image_network"} -v "$PWD:/app" -w /app --entrypoint "$entrypoint" "$image" "$@"
 }
 
 # Markers on stderr so a captured leg's value stays clean; leg_* because bash scopes local into the leg's own call.

docs/reading-cost.md

@@ -734,3 +734,13 @@ Read most (opens and searches):
 - `AGENTS.md` 1
 - `spec/flavour.md` 1
 - `spec/html.md` 1
+
+## Reading cost, chunk 1ab496a7fb35, finished 2026-11-08T21:57:34Z
+
+74016 new input tokens before the first commit.
+
+Read most (opens and searches):
+
+- `todo.md` 7
+- `docs/decisions.md` 2
+- `CHANGELOG.md` 1

todo.md

@@ -13,7 +13,6 @@
 | ID | Release | Blocked by | Exempt | Item | L | E | I | R | S | Moves | Score |
 |---|---|---|---|---|---|---|---|---|---|---|---|
 | 153 | 0.4.0 |  | question | **Decide whether `src/markdown/` root may import `emit/`, `parse/` or `portable/`, and hold the answer in `.oxlintrc.json` and §The source parts by ADF and format.** | 1 | 2 | 2 | 3 | 2 | code health by 3 | 26.2 |
-| 156 | 0.4.0 |  |  | **Stop a leg's container when its script is interrupted, so Ctrl-C ends `ci.sh` or `mutation-tests/run.sh` at once.** | 1 | 2 | 1 | 2 | 1 | code health by 2 | 20.9 |
 | 128 | 0.4.0 |  |  | **Pin the portable flavour's block reading and writing with tests: callout titles past one line, a link beside other marks in a title, the nesting limit of callouts and task lists, refusals inside tasks and their paths, and empty or non-paragraph tasks.** | 2 | 1 | 1 | 2 | 3 | code health by 3 | 19.6 |
 | 75 | 0.4.0 |  |  | **Make the generated-markdown property write block carries as `adf:` fences, canonical and hostile.** | 1 | 1 | 1 | 1 | 2 | code health by 2 | 17.4 |
 | 154 | 0.4.0 |  |  | **Pair highlights over the inline reader's pieces by their offsets before building nodes, so no placeholder text node stands in for a delimiter.** | 2 | 1 | 2 | 3 | 4 | code health by 4 | 17.4 |
@@ -76,12 +75,6 @@ a paragraph opening with a spellable `!adf:link` (§Nothing recurses unbounded).
 `src/markdown/**` bans only `html/`; banning `emit/`, `parse/` and `portable/` for the root's own
 files, with its `ci.sh` probe, extends the decision.
 
-### 156. Stop a leg's container when its script is interrupted, so Ctrl-C ends `ci.sh` or `mutation-tests/run.sh` at once.
-
-`in_image` runs `sh -c` as the container's process 1, which ignores the SIGINT `docker run`
-forwards, so the container runs to its end: a `sleep 30` outlived Ctrl-C by 30 s. `--init` would
-forward it. Found by the product-owner review of item 152, 2026-10-28.
-
 ### 128. Pin the portable flavour's block reading and writing with tests: callout titles past one line, a link beside other marks in a title, the nesting limit of callouts and task lists, refusals inside tasks and their paths, and empty or non-paragraph tasks.
 
 Mutation testing left about 40 mutants alive in code moved verbatim into `src/markdown/portable/`