Hard-exit ACQ on terminate to avoid device-finalizer SIGABRT (#710)

[lwhite1]

Draft — do not merge until the WER LocalDump confirms the line‑46 finalizer (see Merge gate).

What

On TerminateServerRequest, run_acq tore down devices via close_streams() and then returned, letting Python GC-finalize the device objects as the frame unwound. close_streams() has already freed their native handles, so the finalizers (LSL outlets, MetaWear/warble, camera SDKs) re-ran native teardown on freed handles and aborted the process with SIGABRT before it could exit.

This flushes logging and calls os._exit() directly from the terminate handler instead of returning, so no device finalizer runs. The terminate path keeps its clean log trail (Stopping ACQ → Closing app log db connection).

Why this is the fix

Production log_application correlation (extras/perf/_investigate_silent_exit.py --audit, Wang, 2026‑05‑28…06‑11):

• 18 of 22 ACQ_0 faulthandler dumps are this crash: Fatal Python error: Aborted, main thread parked at server_acq.py:46 (run_acq just returned), only the app‑log SSH‑tunnel threads alive (bystanders), no device threads.
• Each one's last DB log line is "Microphone: Exiting LSL Thread" — the final line of close_streams() — i.e. full device teardown completed, then abort. Not idle, not mid‑session.
• Clean exits log "Closing app log db connection" (line 55); these never reach it → the abort is at the line‑46 return/finalization boundary, before logging.shutdown(). The surviving tunnel threads belong to the app‑log handler (torn down later) — bystanders, not the crash site.

Mechanism detail and correction: #710. Full census + falsified alternatives: #824.

Merge gate (per "falsify before shipping")

• WER LocalDump (full minidump, DumpType=2, python.exe on ACQ_0) naming the aborting native module at the line‑46 finalization. The fix skips all finalizers so it is robust regardless, but the dump proves we are eliminating the fault, not masking a different one.
• Post‑deploy field check: ACQ_0 unclean‑exit rate falls toward the STM box's, and "Closing app log db connection" becomes the consistent last line in the shutdown audit.

Scope / follow‑ups

• Covers the TerminateServerRequest path (the 18 Family‑A crashes).
• Not covered: the exception path (run_acq raises → frame unwind → same finalizer abort, server_acq.py:213‑217) — separate follow‑up.
• The now‑unreachable logger.debug("Stopping ACQ") at main() line 47 is left in place to keep the diff minimal; can be removed.

Relates to #710, #824, #759.

[lwhite1]

Holding this draft — the merge gate isn't cleared, and #818 may be the actual root cause.

• Gate still open. The confirming native dump hasn't been captured. WER LocalDumps was set up correctly on ACQ_0 but produced nothing for a real 2026-06-18 abort — faulthandler short-circuits WER on these SIGABRTs (details on ACQ shutdown race: SIGABRT during SSH tunnel teardown in main() #710). ProcDump (debugger, bypasses faulthandler) is the pending capture path; target the child worker PID (see Booth .venv still anchored to Anaconda base interpreter — conda not fully removed (follow-up to #632) #818).
• Possible root cause upstream of this fix. Booth .venv still anchored to Anaconda base interpreter — conda not fully removed (follow-up to #632) #818 confirms ACQ_0 runs production on the Anaconda base interpreter (the venv-copy python re-launches anaconda3\python.exe as a child worker), so conda's native DLLs run alongside the venv wheels in one process — a candidate cause for the native finalizer abort() this PR works around. If rebuilding the env clean (uv-managed standalone Python, see Booth .venv still anchored to Anaconda base interpreter — conda not fully removed (follow-up to #632) #818) stops the aborts, this os._exit change becomes defense-in-depth rather than the fix.

Keeping it open as hardening (it skips device finalizers on terminate regardless), but it should not merge until (a) a ProcDump native stack confirms the finalizer, and (b) the #818 env rebuild has been tested.