Module cancel 

A single, process-wide Ctrl+C listener shared by every await point in a tune, replacing the pre-safety-cancellation design of constructing tokio::signal::ctrl_c() fresh on every polling-loop iteration (see AGENTS.md’s safety-cancellation). Registering the signal exactly once, as early in the process as possible, closes the gap where a Ctrl+C delivered while no listener happens to be alive is silently swallowed – tokio installs a process-wide SIGINT handler the first time ctrl_c() is polled and never reverts to the OS default, so a lost signal isn’t merely unhandled, it’s gone.

Built on [tokio::sync::watch] rather than tokio_util::sync::CancellationToken (which would need a new dependency) specifically for its per-clone “have I observed this value yet” semantics: a fresh CtrlC::signalled call after a signal already fired resolves immediately (including one that arrived before this handle’s first signalled() call at all), and a second signal is a second, distinguishable resolution on the same handle – exactly the two states safety-cancellation needs to tell apart (first Ctrl+C aborting the run, versus a second one during the restore forcing it to give up).

Structs

CtrlC

A handle to the process’s Ctrl+C signal, threaded explicitly through every function that needs to react to it (execute, run_polling_loop, attempt_restore) rather than each calling tokio::signal::ctrl_c() itself.

CtrlCHandle

A trigger for a CtrlC handle created via CtrlC::manual – the HTTP-triggered equivalent of a real Ctrl+C keypress. Deliberately a thin wrapper around the same watch::Sender<u32> mechanism #[cfg(test)]’s test_pair() already uses internally, rather than a second, parallel cancellation mechanism: CtrlC::signalled can’t tell the two apart, so execute/run_polling_loop/attempt_restore need no changes at all to support HTTP-triggered cancellation.