refactor(app_controller): migrate 2 signal handler sites to Result (Phase 6 Group 6.1)

Replaces the silent-swallow logging.debug bodies in _on_sigint and
_install_sigint_exit_handler with proper Result[T] propagation:
- _shutdown_io_pool_result() -> Result[None]: wraps io_pool.shutdown
  with OSError/RuntimeError/ValueError -> ErrorInfo(original=e)
- _install_signal_handler_result(handler) -> Result[None]: wraps
  signal.signal() with ValueError/OSError -> ErrorInfo(original=e)
- _install_sigint_exit_handler stores result.errors[0] on
  self._signal_handler_error: Optional[ErrorInfo] for sub-track 4 GUI

The os._exit(0) inside the signal handler IS the drain (Pattern 3:
intentional termination per error_handling.md:419). The stderr write
before os._exit is part of the termination pattern (Heuristic D match).

TIER-2 READ conductor/code_styleguides/error_handling.md before Phase 6.
Audit: INTERNAL_SILENT_SWALLOW for src/app_controller.py: 30 -> 28.

tests/test_app_controller_result.py

@@ -20,7 +20,7 @@ The tests are pattern templates:
 """
 import pytest
 from unittest.mock import MagicMock, patch
-from src.app_controller import AppController
+from src.app_controller import AppController, _install_sigint_exit_handler
 from src.result_types import Result, ErrorInfo, ErrorKind
 
 
@@ -111,3 +111,98 @@ def test_offload_entry_payload_preserves_unchanged_payload():
   entry = {"kind": "request", "payload": {"message": "hi"}, "ts": "12:00:00"}
   out = ctrl._offload_entry_payload(entry)
  assert out == entry
+
+
+# --- Phase 6: Group 6.1 (signal handlers; Pattern 3 drain via os._exit) ---
+
+def test_shutdown_io_pool_result_returns_ok_when_pool_shuts_down_cleanly():
+ """
+ Pattern 3 drain: _shutdown_io_pool_result returns Result[None] with no errors
+ when the IO pool shuts down without raising.
+ """
+ from src.app_controller import AppController
+ ctrl = AppController()
+ ctrl._io_pool = MagicMock()
+ ctrl._io_pool.shutdown = MagicMock()
+ result = ctrl._shutdown_io_pool_result()
+ assert isinstance(result, Result)
+ assert result.ok is True
+ assert result.errors == []
+
+
+def test_shutdown_io_pool_result_returns_error_when_pool_raises():
+ """
+ Pattern 3 drain: _shutdown_io_pool_result converts OSError/RuntimeError/ValueError
+ to ErrorInfo(original=e) in Result.errors.
+ """
+ from src.app_controller import AppController
+ ctrl = AppController()
+ ctrl._io_pool = MagicMock()
+ ctrl._io_pool.shutdown = MagicMock(side_effect=RuntimeError("pool broken"))
+ result = ctrl._shutdown_io_pool_result()
+ assert isinstance(result, Result)
+ assert result.ok is False
+ assert len(result.errors) == 1
+ assert isinstance(result.errors[0], ErrorInfo)
+ assert "pool broken" in result.errors[0].message
+ assert result.errors[0].original is not None
+
+
+def test_install_signal_handler_result_returns_ok_when_signal_installs():
+ """
+ Pattern 3 drain: _install_signal_handler_result returns Result[None] on success
+ (no errors).
+ """
+ from src.app_controller import AppController
+ ctrl = AppController()
+ handler = lambda signum, frame: None
+ with patch("src.app_controller.signal.signal") as mock_signal:
+  result = ctrl._install_signal_handler_result(handler)
+ assert isinstance(result, Result)
+ assert result.ok is True
+ assert result.errors == []
+ assert mock_signal.called
+
+
+def test_install_signal_handler_result_returns_error_when_signal_raises():
+ """
+ Pattern 3 drain: _install_signal_handler_result converts ValueError/OSError
+ to ErrorInfo(original=e).
+ """
+ from src.app_controller import AppController
+ ctrl = AppController()
+ handler = lambda signum, frame: None
+ with patch("src.app_controller.signal.signal", side_effect=ValueError("not main thread")):
+  result = ctrl._install_signal_handler_result(handler)
+ assert isinstance(result, Result)
+ assert result.ok is False
+ assert len(result.errors) == 1
+ assert isinstance(result.errors[0], ErrorInfo)
+ assert "not main thread" in result.errors[0].message
+
+
+def test_install_sigint_exit_handler_stores_error_when_signal_install_fails():
+ """
+ Drains the Result to instance state: when the helper returns errors,
+ _install_sigint_exit_handler stores the first error on
+ ctrl._signal_handler_error for downstream consumers (e.g., sub-track 4 GUI).
+ """
+ from src.app_controller import AppController
+ ctrl = AppController()
+ with patch("src.app_controller.signal.signal", side_effect=ValueError("not main thread")):
+  _install_sigint_exit_handler(ctrl)
+ assert ctrl._signal_handler_error is not None
+ assert isinstance(ctrl._signal_handler_error, ErrorInfo)
+ assert "not main thread" in ctrl._signal_handler_error.message
+ assert ctrl._signal_handler_error.kind == ErrorKind.INTERNAL
+
+
+def test_install_sigint_exit_handler_no_error_when_signal_install_succeeds():
+ """
+ On success, _signal_handler_error stays as None.
+ """
+ from src.app_controller import AppController
+ ctrl = AppController()
+ with patch("src.app_controller.signal.signal"):
+  _install_sigint_exit_handler(ctrl)
+ assert ctrl._signal_handler_error is None