the binary had no signal handler, so every stop killed it mid write and the next start recovered like after a crash. now the first SIGTERM or SIGINT stops it through Hydrant::shutdown, the same path the ffi uses: the runtime is shut down, the persist thread saves the cursors one last time, and the database closes (its journal syncs on drop). it waits up to 30s and exits 0. a second signal exits right away. the signals get their own thread and runtime, because the main runtime is gone while the database closes and the second signal still has to land.