[ndr-ds]

Problem

kill_process passes its pid straight to kill(1). kill 0 does not mean "no process" — it signals every process in the caller's process group, which for the TUI is claudectl and the terminal that launched it. It then escalates to kill -9 0.

Zero reaches it by an ordinary path, not a corrupt one:

• ClaudeSession::from_registry_entry maps an absent pid to 0 (entry.pid.unwrap_or(0)).
• A sandbox session's pid is absent by design. It lives in another VM's mount namespace, as the filename of ~/.claude/sessions/<pid>.json inside the namespace each sc creates with unshare --user --mount. The host cannot read it, and collector_says_gone deliberately treats a missing pid as "no evidence" so those rows keep rendering.
• handle_kill reads session.pid off the selected row with no zero guard, bound to d.

So every foreign sandbox row is two keystrokes from SIGTERM-then-SIGKILL on claudectl's own process group. pid_alive already guards pid != 0, but that is a different function on a different path.

Found while restoring 19 live sandbox sessions to the registry after their slices were lost: all 19 rendered with pid 0, and the kill path was reachable on all of them.

Change

A kill_target guard at the lowest level, so no present or future caller can reach kill 0. The error says why and points at the actual remedy for a foreign session — close its terminal, since the host has no pid to signal.

Tests

kill_target is split out as a pure function specifically so it can be tested. Calling kill_process(0) in a test would signal the test runner's own process group, so a conventional RED-first run against the real function was not safe to perform; the pure guard is tested instead.

• pid_zero_is_refused_because_it_signals_our_own_process_group
• a_real_pid_passes_through

cargo clippy --all-targets -- -D warnings clean. cargo test --lib 727 passed; the 3 failures are pre-existing environment-bound perf tests (perf_do_refresh_io_does_not_explode_with_repeated_calls, perf_eviction_stays_linear_with_many_rows, perf_summarize_cached_costs_far_less_than_parsing) which fail on a host whose ~/.claude is a fuse mount holding thousands of transcripts, and pass on CI.

Related

Companion to #62. Both are the same shape: a value that means "I could not measure this" being consumed as if it meant a real quantity — an empty reconcile read as "no sessions" there, a missing pid read as "process 0" here.