Function signal_exit_status 

pub const fn signal_exit_status(signo: i32) -> i32

The status a signal-terminated run reports, 128 + signo.

⚠️ A SIGNAL DEATH IS NOT A POLICY REFUSAL, AND FOR ONE RELEASE IT WAS SPELLED AS ONE. sigint_instakill is one of four unrecoverable_shutdown callers. The other three are fail-closed policy decisions where HERMIT_POLICY_REFUSAL_EXIT is right: hermit examined the run and refused it. This one is an OPERATOR INTERRUPT — hermit refused nothing, somebody pressed Ctrl-C — so reporting it as a refusal tells the reader hermit made a decision it did not make. hermit#2659 moved all four off exit(1) together, which was an improvement for all four (they had been reported as 125, “hermit broke”) and correct for only three.

⚠️ IT ALSO PUT TWO MEANINGS ON 122, WHICH IS THE DEFECT THIS REMOVES. With the SIGINT path exiting HERMIT_POLICY_REFUSAL_EXIT, 122 meant both “a fail-closed policy stopped the run” and “the operator killed it” — a legible number with two conditions behind it, which is the exact family 125 was split up to end.

⚠️ WHY THIS IS NOT A GENUINE WIFSIGNALED STATUS. The faithful way to honour a signal is restore SIG_DFL, unblock, re-raise — and it is measurably unavailable here for the same reason it is unavailable to on_container_init_stop_signal: a self-sent signal does not come from an ancestor namespace, so a namespace init discards it exactly like the original and survives. 128 + signo is the closest honest approximation, and it is the spelling that function already uses — this shares its convention rather than inventing a second one.