Make forced signal flush raw-clone safe

Makefile

@@ -221,6 +221,14 @@ test_c2php: $(SO_FILE) $(INIT_HOOK_TEST_FILES) $(BUILD_DIR)/run-tests.php
 test_with_init_hook: $(SO_FILE) $(INIT_HOOK_TEST_FILES) $(BUILD_DIR)/run-tests.php
 	$(if $(ASAN), USE_ZEND_ALLOC=0 USE_TRACKED_ALLOC=1) $(RUN_TESTS_CMD) -d extension=$(SO_FILE) $(TRACER_SOURCES_INI) $(INIT_HOOK_TEST_FILES);
 
+# Exercise the Linux-only raw-clone lifetime gate in the normal CI pass.
+ifeq ($(shell uname -s),Linux)
+test_extension_ci_normal: test_signal_flush
+endif
+
+test_signal_flush:
+	bash tests/signal_flush/run.sh
+
 # The .phpt suite runs twice: normally, and under valgrind for leak checking.
 # Separate targets so CI can parallelize them -- valgrind is far slower.
 # The PATH shim in tests/ext/valgrind adds the suppressions file.
@@ -1684,5 +1692,5 @@ test_internal_api_randomized: $(SO_FILE)
 composer.lock: composer.json
 	$(call run_composer_with_retry,,)
 
-.PHONY: dev dist_clean clean cores all clang_format_check clang_format_fix install sudo_install test_c test_c_mem test_extension_ci test_extension_ci_normal test_extension_ci_valgrind test_zai test_zai_asan test install_ini install_all \
+.PHONY: dev dist_clean clean cores all clang_format_check clang_format_fix install sudo_install test_c test_c_mem test_extension_ci test_extension_ci_normal test_extension_ci_valgrind test_signal_flush test_zai test_zai_asan test install_ini install_all \
 	.apk .rpm .deb .tar.gz sudo debug prod strict run-tests.php verify_pecl_file_definitions verify_package_xml cbindgen cbindgen_binary

components-rs/datadog.h

@@ -9,6 +9,14 @@ struct _zend_string;
 #include "telemetry.h"
 #include "sidecar.h"
 
+#if defined(__linux__)
+/**
+ * Prepared, independent, sessionless connection. Opaque to C; immutable after publication.
+ * Only normal initialized threads may construct or destroy this object.
+ */
+typedef struct ddog_SignalFlush ddog_SignalFlush;
+#endif
+
 extern void (*ddog_log_callback)(ddog_CharSlice);
 
 extern ddog_VecRemoteConfigProduct DATADOG_REMOTE_CONFIG_PRODUCTS;
@@ -273,6 +281,34 @@ void datadog_sidecar_set_reconnect_fn(struct ddog_SidecarTransport **transport,
 
 void datadog_sidecar_clear_reconnect_fn(struct ddog_SidecarTransport **transport);
 
+#if defined(__linux__)
+/**
+ * Connect independently to the template's exact listener and prepare one Flush request.
+ * The template is borrowed only during this call: neither it nor its fd is retained.
+ * The returned object must outlive the raw worker and may only be dropped normally.
+ */
+ddog_MaybeError datadog_sidecar_prepare_signal_flush(struct ddog_SidecarTransport *template_,
+                                                     struct ddog_SignalFlush **output);
+#endif
+
+#if defined(__linux__)
+/**
+ * Destroy an unpublished object, or one whose raw worker has exited. Normal context only.
+ */
+void datadog_sidecar_signal_flush_drop(struct ddog_SignalFlush *flush);
+#endif
+
+#if defined(__linux__)
+/**
+ * Execute one bounded exchange without calling libc, using TLS, allocating, or unwinding.
+ * If `terminate_process` is true, terminate the process after the flush completes, fails, or
+ * times out. Otherwise, return zero for the one-byte zero ACK or a negative Linux error number.
+ * The caller must keep the object alive and guarantee exclusive, one-shot use of its socket.
+ */
+int32_t datadog_sidecar_signal_flush_run(const struct ddog_SignalFlush *flush,
+                                         bool terminate_process);
+#endif
+
 bool ddog_shm_limiter_inc(const struct ddog_MaybeShmLimiter *limiter, uint32_t limit);
 
 bool ddog_exception_hash_limiter_inc(struct ddog_SidecarTransport *connection,

components-rs/lib.rs

@@ -45,6 +45,8 @@ pub mod log;
 pub mod remote_config;
 #[cfg(not(standalone_profiler))]
 pub mod sidecar;
+#[cfg(all(not(standalone_profiler), target_os = "linux"))]
+pub mod signal_flush;
 #[cfg(not(standalone_profiler))]
 pub mod stats;
 #[cfg(not(standalone_profiler))]