#1155 [@adam/cfgmgmt] ssh-exec models uninterruptible: SIGINT/SIGTERM ignored, child ssh not aborted (only SIGKILL works)

Summary

Running an ssh-exec method becomes uninterruptible while the ssh subprocess is blocked (connecting, or running a remote command). Ctrl-C (SIGINT ×N), SIGTERM, and SIGHUP have no effect — only SIGKILL ends the run.

Environment

• swamp 20260711.232311.0-sha.6bda08e7 (Linux x86-64)
• @adam/cfgmgmt ssh-based model type (exec method), _lib/ssh.ts helper

Root cause

All ssh/scp invocations are spawned without cancellation and awaited to completion:

// _lib/ssh.ts
const cmd = new Deno.Command("ssh", { args, stdout: "piped", stderr: "piped" });
const output = await cmd.output();   // no `signal:` — child cannot be aborted

Three compounding problems:

1. No AbortSignal on the child. Deno.Command accepts { signal: AbortSignal } to tie the child's lifetime to cancellation; none of the ssh/scp spawns pass one, and the method's execute(_args, context) never references an abort signal. The child is uninterruptible from within the run.
2. Long uncancellable retry loop on connect. ControlMaster setup retries up to ~10 times, each await cmd.output() on ssh … ConnectTimeout=10, with 15–20 s sleeps between attempts (~135 s+ of blocking) with no way to break out. This is the "stuck trying to connect" hang.
3. Daemonized ControlMaster orphans. The master is opened with -M -N -f … ControlPersist=600, so it reparents off the swamp process. Even SIGKILL of swamp leaves ssh masters lingering for ControlPersist (10 min).

Reproduction (deterministic)

# unroutable host (RFC 5737 TEST-NET) => ssh blocks in connect()
create an ssh-exec model with nodeHost=[IP-1], command='sleep 300'
run the method in the background; note the swamp pid
kill -INT  <pid>   # ignored
kill -TERM <pid>   # ignored
kill -KILL <pid>   # only this works

Also reproduces on a reachable host when the remote command hangs. While blocked: swamp main thread in ep_poll, a worker thread parked in unix_stream_read on the ssh control channel; the run holds the datastore .lock the whole time.

Suggested fixes

1. Thread a cancellation AbortSignal (from the method context) into every new Deno.Command(...) via the signal option, so SIGINT tears the child down.
2. Make the connect retry loop honor the same signal (abort the sleep and the in-flight attempt).
3. Register a teardown that runs ssh -O exit on the ControlPath when the run ends (including abnormal exit) so masters never outlive the run — or don't daemonize with -f.

Note: swamp core also has a related hardening gap (repeated SIGINT does not force-exit / no cancellation signal exposed to execute) — filed separately.