fix: harden DWH Nginx integration gates

scripts/test-dwh-auth-nginx-integration.sh

@@ -27,15 +27,9 @@ cleanup() {
   local pid
   set +e
   for pid in "${registered_pids[@]}"; do
-    if [[ "$pid" =~ ^[0-9]+$ ]] && kill -0 "$pid" 2>/dev/null; then
-      kill -TERM "$pid" 2>/dev/null
-    fi
-  done
-  for pid in "${registered_pids[@]}"; do
-    if [[ "$pid" =~ ^[0-9]+$ ]]; then
-      wait "$pid" 2>/dev/null
-    fi
+    stop_registered_pid "$pid" || true
   done
+  registered_pids=()
   if [[ "$temp_root" == /tmp/thothii-dwh-auth-nginx-integration.* && -d "$temp_root" ]]; then
     rm -rf -- "$temp_root"
   fi
@@ -119,13 +113,124 @@ expect_status() {
   [[ "$status" == "$expected" ]] || fail_case "$name"
 }
 
+unregister_pid() {
+  local target=$1
+  local candidate
+  local retained=()
+  for candidate in "${registered_pids[@]}"; do
+    [[ "$candidate" == "$target" ]] || retained+=("$candidate")
+  done
+  registered_pids=("${retained[@]}")
+}
+
+pid_exited_or_zombie() {
+  local pid=$1
+  local state
+  [[ "$pid" =~ ^[0-9]+$ ]] || return 1
+  [[ ! -d "/proc/$pid" ]] && return 0
+  state=$(awk "{print \$3}" "/proc/$pid/stat" 2>/dev/null) || return 0
+  [[ "$state" == Z* ]]
+}
+
+pid_is_direct_child() {
+  local pid=$1
+  local parent
+  [[ -r "/proc/$pid/stat" ]] || return 1
+  parent=$(awk "{print \$4}" "/proc/$pid/stat" 2>/dev/null) || return 1
+  [[ "$parent" == "$$" ]]
+}
+
+reap_if_direct_child() {
+  local pid=$1
+  if pid_is_direct_child "$pid"; then
+    wait "$pid" 2>/dev/null || true
+  fi
+}
+
+wait_for_exit_or_zombie() {
+  local pid=$1
+  local attempts=${2:-10}
+  local attempt
+  for ((attempt = 0; attempt < attempts; attempt++)); do
+    pid_exited_or_zombie "$pid" && return 0
+    sleep 0.05
+  done
+  pid_exited_or_zombie "$pid"
+}
+
+tcp_listener_for_pid() {
+  local pid=$1
+  [[ "$pid" =~ ^[0-9]+$ ]] || return 1
+  ss -ltnpH 2>/dev/null | grep -Eq "(^|[^0-9])pid=$pid([,)]|$)"
+}
+
+wait_for_tcp_listener_pid() {
+  local pid=$1
+  local attempt
+  for ((attempt = 0; attempt < 10; attempt++)); do
+    tcp_listener_for_pid "$pid" && return 0
+    sleep 0.05
+  done
+  tcp_listener_for_pid "$pid"
+}
+
 stop_registered_pid() {
   local pid=$1
   [[ "$pid" =~ ^[0-9]+$ ]] || return 1
-  if kill -0 "$pid" 2>/dev/null; then
-    kill -TERM "$pid"
-    wait "$pid"
+  if pid_exited_or_zombie "$pid"; then
+    reap_if_direct_child "$pid"
+    unregister_pid "$pid"
+    return 0
   fi
+  if ! kill -TERM "$pid" 2>/dev/null; then
+    wait_for_exit_or_zombie "$pid" 1 || return 1
+  fi
+  if ! wait_for_exit_or_zombie "$pid"; then
+    kill -KILL "$pid" 2>/dev/null || return 1
+    wait_for_exit_or_zombie "$pid" || return 1
+  fi
+  reap_if_direct_child "$pid"
+  unregister_pid "$pid"
+}
+
+run_term_ignored_regression() {
+  local child_pid started_seconds registered_pid
+  current_case=cleanup_term_ignored_bounded
+  python3 -c "import signal; signal.signal(signal.SIGTERM, signal.SIG_IGN); signal.pause()" >"$temp_root/term-ignored.log" 2>&1 &
+  child_pid=$!
+  register_pid "$child_pid"
+  started_seconds=$SECONDS
+  if ! stop_registered_pid "$child_pid"; then
+    fail_case cleanup_term_ignored_bounded
+  fi
+  if kill -0 "$child_pid" 2>/dev/null; then
+    fail_case cleanup_term_ignored_bounded
+  fi
+  for registered_pid in "${registered_pids[@]}"; do
+    [[ "$registered_pid" != "$child_pid" ]] || fail_case cleanup_term_ignored_bounded
+  done
+  ((SECONDS - started_seconds < 3)) || fail_case cleanup_term_ignored_bounded
+  report_pass cleanup_term_ignored_bounded
+}
+
+run_tcp_listener_detector_positive() {
+  local probe_pid
+  current_case=tcp_listener_detector_positive
+  python3 - >"$temp_root/tcp-listener.log" 2>&1 <<PY &
+import signal
+import socket
+
+listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+listener.bind(("127.0.0.1", 0))
+listener.listen()
+signal.pause()
+PY
+  probe_pid=$!
+  register_pid "$probe_pid"
+  wait_for_tcp_listener_pid "$probe_pid" || fail_case tcp_listener_detector_positive
+  report_pass tcp_listener_detector_positive
+  stop_registered_pid "$probe_pid" || fail_case tcp_listener_detector_positive
+  ! tcp_listener_for_pid "$probe_pid" || fail_case tcp_listener_detector_positive
 }
 
 for command in nginx curl python3 ss date; do
@@ -139,6 +244,8 @@ temp_root=$(mktemp -d /tmp/thothii-dwh-auth-nginx-integration.XXXXXXXX) || fail_
 chmod 0700 "$temp_root" || fail_case fixture_root
 umask 077
 
+run_term_ignored_regression
+
 dwh_auth="$temp_root/dwh-auth"
 current_case=build_dwh_auth
 build_dwh_auth "$dwh_auth" >"$temp_root/build.log" 2>&1 || fail_case build_dwh_auth
@@ -197,6 +304,8 @@ register_pid "$verifier_pid"
 wait_for_socket "$service_socket" || fail_case verifier_start
 report_pass verifier_start
 
+run_tcp_listener_detector_positive
+
 current_case=synthetic_upstreams
 AUTH_PROXY_SOCKET="$auth_proxy_socket" \
 VERIFIER_SOCKET="$service_socket" \
@@ -370,6 +479,7 @@ current_case=auth_socket_unix_only
 [[ -S "$service_socket" ]] || fail_case auth_socket_unix_only
 ss -xl >"$temp_root/ss-unix.log" 2>&1 || fail_case auth_socket_unix_only
 grep -Fq -- "$service_socket" "$temp_root/ss-unix.log" || fail_case auth_socket_unix_only
+! tcp_listener_for_pid "$verifier_pid" || fail_case auth_socket_unix_only
 report_pass auth_socket_unix_only
 
 probe_body="$temp_root/probe.body"