---
id: "bug-1954"
status: "open"
status_updated: "2026-10-10"
status_note: "newly logged"
component: "worker"
severity: "wrong-result"
timestamp: "2026-10-10T08:46:07Z"
last_seen: "2026-10-10T08:46:07Z"
occurrences: 1
files: ["src/worker/src/xcecd_worker.c"]
tags: ["worker", "job-control", "signal"]
related: ["bug-1940"]
---

# bug-1954: xcecd_worker sends SIGTERM for a KILL request without force and SIGSTOP for a TSTP request

## Description
**Observed:** (source reading, 2026-10-10; found while fixing bug-1940)
`worker_signal_callback()` (`src/worker/src/xcecd_worker.c:1115-1130`)
replaces the requested signal:
```c
case SIGTERM:
case SIGKILL:
    if (force) { success = signal_gid_except_self(SIGKILL); }
    else       { success = signal_gid_except_self(SIGTERM); }
...
case SIGSTOP:
case SIGTSTP:
    success = signal_gid_except_self(SIGSTOP);
```
Since bug-1940 the requested signal reaches the worker, but an explicit
`kill -s KILL` without force still sends SIGTERM, and an explicit TSTP is sent
as the uncatchable SIGSTOP.

**Expected:** the job receives the signal the user asked for; force kill
(SIGKILL) stays available for a default kill.
**Impact:** wrong result: a job that ignores SIGTERM survives an explicit
SIGKILL request; a job that handles SIGTSTP to checkpoint or clean up cannot
do so.
**Found by:** review of the bug-1940/1942 fixes, 2026-10-10.
## Environment
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
- Build: asan (xce.build)
- Code: scheduler-framework @ 8568c8ab-dirty
- Deployment: real `xcecd` worker (systemd/dbus); multi-host for the remote-task case

## Reproduction
1. Run a job that traps TERM (`trap '' TERM; sleep 600`).
2. `POST /xce/v1/jobs/<id>/control` with action kill, signal `SIGKILL`,
   force_kill false.
3. The job keeps running (it received SIGTERM).
- Frequency: deterministic by code reading (not yet run)
- Evidence: the code quoted in Description; no logs kept.
## Root cause
TODO: required for fixed/partial

## Fix
TODO: required for fixed/partial

## Verification
- Test: TODO: name + file; RED before the fix, GREEN after
- Suites: TODO: suite results and build profile
- Live: TODO: soak/deploy run, or n/a and why

## References
- Related: none