fix: make TERM→KILL escalation poll for group death and document the zombie-probe invariant

[max-sixty]

The TERM→KILL escalation probed group liveness with one killpg(pgid, 0) after a fixed 200 ms sleep, and that probe counts an exited-but-unreaped member as alive (Linux answers Ok, macOS EPERM). On the timed-out-command path the caller deliberately holds the group leader unreaped, so the group read alive for the whole grace and the final group SIGKILL fired every time.

That SIGKILL is inert — a signal to a fully-exited group is discarded and cannot change its recorded exit status (verified empirically, and pinned by a new test) — so this was never a correctness bug: whenever the probe over-reports, the KILL hits nothing; whenever the KILL matters, the group genuinely is alive. The costs were latency and legibility: every escalation step slept its full 200 ms even when the tree was already dead (every Ctrl-C of an isolated streamed child, every wt step tether teardown), and the probe read as a broken correctness gate.

The change keeps the semantics and reframes the roles, matching coreutils timeout -k (which KILLs unconditionally after its grace, with no probe at all):

• The post-grace SIGKILL is the documented contract: whatever remains after the grace is swept. It is also the only signal that removes a SIGSTOP'd member, which runs no TERM handler.
• The probe becomes an early-exit optimization: a 20 ms poll with an immediate first probe replaces the fixed sleep. Callers whose children are reaped concurrently (the signal forwarder, tether's supervisor) return within one poll interval; the timed-out path still runs its full grace and sends the inert sweep, which its docstring now states.
• Signals sent to live groups are identical to before at all three call sites; only signals with provably no live target are skipped, and returns are never later than before.

The correctness argument lives in the docstrings on process_group_alive, forward_signal_with_escalation, and kill_timed_out_tree. Three new unit tests pin the invariants: immediate return for an empty group, full grace on a live group, and — replaying the timed-out sequence with the leader held unreaped — a preserved exit code through both the TERM and the post-grace sweep (barriered on the child's stdout EOF, so no scheduling assumptions).

Testing: the unit tests above plus the existing signal-forwarding and tether integration tests; full pre-merge gate green locally. The full-grace test pins the zombie-probe reading on both Linux and macOS CI (the test (linux)/test (macos) jobs run the lib unit tests).

This was written by Claude Code on behalf of max-sixty

[worktrunk-bot]

The equivalence argument holds: the next signal in the chain still only fires after the full grace, so signals to live groups land at exactly the same times as before, and the early return is reachable only via ESRCH — which requires every member reaped, and reaping is monotonic. The one place the two differ is pid recycling, where polling is strictly safer than the single end-of-grace probe: a group reaped at 100 ms whose pgid was recycled by 200 ms used to read alive and draw a killpg at a stranger.

One thing worth folding back into the PR body: test (macos) is green on this head, and wt hook pre-merge --yes runs the lib unit tests, so test_escalation_full_grace_and_inert_sweep_when_leader_unreaped executed there. That makes the macOS half of the process_group_alive docstring's zombie claim empirically pinned by CI, not just Linux — the description currently scopes the pinning to Linux.

One non-blocking test suggestion inline.