@cortexkit/opencode-magic-context 0.44.0 → 0.44.2

package/src/shared/rpc-async-probes.test.ts

@@ -0,0 +1,230 @@
+import { afterEach, expect, test } from "bun:test";
+import type { execFileSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+    __resetSchemaFenceStateForTests,
+    getMigrationOnOpenRefusal,
+    openDatabaseAsync,
+} from "../features/magic-context/storage-db";
+import { createV2StorageGate, probeV2StorageAtBoot } from "../v2/hooks/storage-gate";
+import {
+    __resetRpcIdentityTestHooks,
+    __setAsyncProcessProbeForTests,
+    __setRpcIdentityTestHooks,
+    inspectProcessesAsync,
+} from "./rpc-utils";
+import { Database } from "./sqlite";
+
+afterEach(() => {
+    __resetSchemaFenceStateForTests();
+    __resetRpcIdentityTestHooks();
+    __setAsyncProcessProbeForTests();
+});
+
+test("async Windows inspection bypasses slow synchronous probes and shares a bounded snapshot", async () => {
+    let synchronousCalls = 0;
+    const slow = (() => {
+        synchronousCalls++;
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 5000);
+        return "";
+    }) as typeof execFileSync;
+    __setRpcIdentityTestHooks({
+        platform: "win32",
+        execFileSync: slow,
+        processListExecFileSync: slow,
+    });
+    let release!: (value: string) => void;
+    let calls = 0;
+    __setAsyncProcessProbeForTests(async (file, _args, timeout) => {
+        expect(file).toBe("powershell");
+        expect(timeout).toBe(5000);
+        calls++;
+        return new Promise<string>((resolve) => {
+            release = resolve;
+        });
+    });
+    const first = inspectProcessesAsync();
+    const second = inspectProcessesAsync();
+    expect(second).toBe(first);
+    const heartbeat = await Promise.race([
+        first.then(() => "probe"),
+        new Promise<string>((resolve) => setTimeout(() => resolve("heartbeat"), 10)),
+    ]);
+    expect(heartbeat).toBe("heartbeat");
+    release(
+        JSON.stringify([
+            {
+                ProcessId: 12345,
+                ParentProcessId: 1,
+                CommandLine: "opencode serve",
+                CreationDate: "2026-09-28T00:00:00Z",
+            },
+        ]),
+    );
+    const result = await first;
+    expect(result.liveness(12345)).toBe("alive");
+    expect(result.evidence(12345).commandLine).toBe("opencode serve");
+    expect(result.liveness(12346)).toBe("dead");
+    expect(await inspectProcessesAsync()).toBe(result);
+    expect(calls).toBe(1);
+    expect(synchronousCalls).toBe(0);
+});
+
+test("offline process inspection can bypass a cached snapshot", async () => {
+    __setRpcIdentityTestHooks({ platform: "win32" });
+    let calls = 0;
+    __setAsyncProcessProbeForTests(async () => {
+        calls++;
+        return JSON.stringify([
+            {
+                ProcessId: calls + 100,
+                ParentProcessId: 1,
+                Name: "opencode.exe",
+                CommandLine: null,
+                CreationDate: "2026-09-28T00:00:00Z",
+            },
+        ]);
+    });
+    const cached = await inspectProcessesAsync();
+    expect((await inspectProcessesAsync()).processSnapshot).toBe(cached.processSnapshot);
+    const fresh = await inspectProcessesAsync(true);
+    expect(fresh.processSnapshot?.source).toBe("cim");
+    expect(fresh.processSnapshot?.facts).toContainEqual(
+        expect.objectContaining({ pid: 102, imageName: "opencode.exe", commandLine: null }),
+    );
+    expect(calls).toBe(2);
+});
+
+test("async Windows inspection bounds CIM and tasklist fallback and caches failure", async () => {
+    __setRpcIdentityTestHooks({ platform: "win32" });
+    const calls: Array<[string, number]> = [];
+    __setAsyncProcessProbeForTests(async (file, _args, timeout) => {
+        calls.push([file, timeout]);
+        throw new Error("probe timed out");
+    });
+    const result = await inspectProcessesAsync();
+    expect(result.pi.state).toBe("unreadable");
+    expect(result.liveness(123)).toBe("inconclusive");
+    expect(result.evidence(123)).toEqual({ startTime: null, commandLine: null });
+    await inspectProcessesAsync();
+    expect(calls).toEqual([
+        ["powershell", 5000],
+        ["tasklist", 1000],
+    ]);
+});
+
+test("boot storage wait stays responsive with a locked v90 store and slow Windows probes", async () => {
+    const root = mkdtempSync(join(tmpdir(), "async-storage-guard-"));
+    const dbPath = join(root, "context.db");
+    const seeded = new Database(dbPath);
+    seeded.exec(
+        "CREATE TABLE schema_migrations(version INTEGER PRIMARY KEY); INSERT INTO schema_migrations VALUES(90)",
+    );
+    seeded.exec("BEGIN IMMEDIATE");
+    mkdirSync(join(root, "rpc", "blocker"), { recursive: true });
+    writeFileSync(
+        join(root, "rpc", "blocker", "port-12345.json"),
+        JSON.stringify({
+            pid: 12345,
+            port: 43123,
+            started_at: Date.now(),
+            kind: "OpenCode server",
+        }),
+    );
+    let syncCalls = 0;
+    const slow = (() => {
+        syncCalls++;
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 5000);
+        return "";
+    }) as typeof execFileSync;
+    __setRpcIdentityTestHooks({
+        platform: "win32",
+        execFileSync: slow,
+        processListExecFileSync: slow,
+    });
+    let release!: (value: string) => void;
+    __setAsyncProcessProbeForTests(
+        () =>
+            new Promise<string>((resolve) => {
+                release = resolve;
+            }),
+    );
+    try {
+        const gate = createV2StorageGate({
+            open: () => openDatabaseAsync({ dbPath, busyTimeoutMs: 0 }),
+        });
+        const started = performance.now();
+        const boot = probeV2StorageAtBoot(gate);
+        const opening = gate.probe();
+        expect(
+            await Promise.race([
+                opening.then(() => "opened"),
+                new Promise<string>((resolve) => setTimeout(() => resolve("responsive"), 10)),
+            ]),
+        ).toBe("responsive");
+        expect(performance.now() - started).toBeLessThan(300);
+        expect(gate.current()).toBeUndefined();
+        release(
+            JSON.stringify([
+                {
+                    ProcessId: 12345,
+                    ParentProcessId: 1,
+                    CommandLine: "opencode serve",
+                    CreationDate: "2026-01-01T00:00:00Z",
+                },
+            ]),
+        );
+        expect(await opening).toBeUndefined();
+        expect(await boot).toBeUndefined();
+        expect(gate.reason()?.kind).toBe("migration_guard");
+        expect(getMigrationOnOpenRefusal()?.serverPids).toEqual([12345]);
+        expect(syncCalls).toBe(0);
+        const checked = new Database(dbPath);
+        expect(
+            checked.prepare("SELECT MAX(version) AS version FROM schema_migrations").get(),
+        ).toEqual({ version: 90 });
+        checked.close();
+    } finally {
+        seeded.close();
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+
+test("a timed-out refresh retains confirmed blockers until a successful process scan", async () => {
+    let now = 1000;
+    __setRpcIdentityTestHooks({ platform: "win32", nowMs: () => now });
+    let fail = false;
+    let calls = 0;
+    let pid = 12345;
+    __setAsyncProcessProbeForTests(async () => {
+        calls++;
+        if (fail) throw new Error("timeout");
+        return JSON.stringify([
+            {
+                ProcessId: pid,
+                ParentProcessId: 1,
+                CommandLine: "opencode serve",
+                CreationDate: "2026-01-01T00:00:00Z",
+            },
+        ]);
+    });
+    const first = await inspectProcessesAsync();
+    now += 1999;
+    expect(await inspectProcessesAsync()).toBe(first);
+    expect(calls).toBe(1);
+    now++;
+    fail = true;
+    const failed = await inspectProcessesAsync();
+    expect(calls).toBe(3);
+    expect(failed.liveness(12345)).toBe("alive");
+    expect(failed.liveness(54321)).toBe("inconclusive");
+    expect(failed.evidence(12345)).toEqual(first.evidence(12345));
+    now += 2000;
+    fail = false;
+    pid = 54321;
+    const refreshed = await inspectProcessesAsync();
+    expect(calls).toBe(4);
+    expect(refreshed.liveness(12345)).toBe("dead");
+});

package/src/shared/rpc-server.ts

@@ -19,7 +19,7 @@ import {
     registerNotificationSink,
 } from "./rpc-notifications";
 import {
-    isPidAlive,
+    inspectProcessesAsync,
     parseRpcPortFile,
     registerOwnRpcServerInstance,
     rpcPortDir,
@@ -176,7 +176,7 @@ export class MagicContextRpcServer {
         // supported: TUI discovery scans all live files and picks the most
         // recent instead of cross-wiring via one shared project file.
         try {
-            this.warnIfOtherLiveInstance();
+            void this.warnIfOtherLiveInstance();
             const dir = dirname(this.portFilePath);
             // The port file carries the RPC bearer token. The normal policy keeps
             // it owner-only; a trusted-group deployment explicitly delegates every
@@ -263,12 +263,14 @@ export class MagicContextRpcServer {
         this.unregisterOwnInstance = null;
     }
 
-    private warnIfOtherLiveInstance(): void {
+    private async warnIfOtherLiveInstance(): Promise<void> {
         try {
             for (const entry of readdirSync(this.portDir)) {
                 if (!entry.startsWith("port-") || !entry.endsWith(".json")) continue;
                 const record = parseRpcPortFile(readFileSync(`${this.portDir}/${entry}`, "utf-8"));
-                if (!record || record.pid === process.pid || !isPidAlive(record.pid)) continue;
+                if (!record || record.pid === process.pid) continue;
+                const processes = await inspectProcessesAsync();
+                if (processes.liveness(record.pid) !== "alive") continue;
                 log(
                     `[rpc] another Magic Context RPC server is active for this project (pid ${record.pid}, port ${record.port}); starting separate instance on a new port`,
                 );

package/src/shared/rpc-types.ts

@@ -280,7 +280,7 @@ export interface StatusDetail extends SidebarSnapshot {
     cacheExpired: boolean;
     /** Reports whether the displayed TTL came from config, persisted session metadata,
      *  or the default; cache scheduling still uses the TTL stored in session metadata. */
-    cacheTtlSource?: "config" | "session" | "default";
+    cacheTtlSource?: import("./cache-ttl-display").CacheTtlDisplaySource;
     cacheTtlModelKey?: string;
     configParseFailures?: ConfigParseFailure[];
     /** True when cacheTtl is "never" — the idle-TTL heuristic is disabled on

package/src/shared/rpc-utils.test.ts

@@ -183,6 +183,32 @@ describe("discoverLivePiProcessIds", () => {
 });
 
 describe("#411 Windows OMP/Pi live-process scan", () => {
+    test("reuses a Windows snapshot briefly, then refreshes process discovery", () => {
+        let now = PLUGIN_BUILD_MS;
+        const calls: string[] = [];
+        __setRpcIdentityTestHooks({
+            platform: "win32",
+            nowMs: () => now,
+            processListExecFileSync: windowsProcessListExec((file) => {
+                calls.push(file);
+                return cimOutput([
+                    {
+                        ProcessId: WINDOWS_FOREIGN_PID,
+                        ParentProcessId: 4,
+                        CommandLine: OMP_PI_ARC_COMMAND,
+                        CreationDate: wmiCreationDate(OLDER_THAN_PLUGIN_MS),
+                    },
+                ]);
+            }),
+        });
+        expect(inspectLivePiProcesses().processIds).toEqual([WINDOWS_FOREIGN_PID]);
+        now += 1_999;
+        expect(inspectLivePiProcesses().processIds).toEqual([WINDOWS_FOREIGN_PID]);
+        expect(calls).toEqual(["powershell"]);
+        now += 1;
+        inspectLivePiProcesses();
+        expect(calls).toEqual(["powershell", "powershell"]);
+    });
     test("(a) tasklist-only fallback skips a parent omp.exe as an ancestor", () => {
         const calls: string[] = [];
         __setRpcIdentityTestHooks({
@@ -607,7 +633,7 @@ describe("isPidIdentityPlausible", () => {
                 args: [
                     "-NoProfile",
                     "-Command",
-                    "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,CommandLine,CreationDate | ConvertTo-Json -Compress",
+                    "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine,CreationDate | ConvertTo-Json -Compress",
                 ],
             },
         ]);

package/src/shared/rpc-utils.ts

@@ -1,4 +1,4 @@
-import { execFileSync } from "node:child_process";
+import { execFile, execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
@@ -118,12 +118,13 @@ const RPC_IDENTITY_SKEW_TOLERANCE_MS = 120_000;
 const LINUX_CLOCK_TICKS_PER_SECOND = 100;
 const PS_PROBE_TIMEOUT_MS = 1_000;
 const WINDOWS_CIM_PROBE_TIMEOUT_MS = 5_000;
+const WINDOWS_PROCESS_SNAPSHOT_TTL_MS = 2_000;
 const MAX_ANCESTOR_WALK_DEPTH = 16;
 const OPEN_CODE_COMMAND_MARKERS = ["opencode", "node", "bun", "electron"];
 const TASKLIST_NO_TASKS_PATTERN =
     /^INFO:\s+No tasks are running which match the specified criteria\.?$/im;
 const WINDOWS_CIM_COMMAND =
-    "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,CommandLine,CreationDate | ConvertTo-Json -Compress";
+    "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine,CreationDate | ConvertTo-Json -Compress";
 const PI_HARNESS_ARC_MARKERS = [
     "pi-coding-agent",
     "oh-my-pi",
@@ -184,6 +185,7 @@ function readPsProcessStartTime(pid: number): number | null {
             encoding: "utf8",
             timeout: PS_PROBE_TIMEOUT_MS,
             stdio: ["ignore", "pipe", "pipe"],
+            windowsHide: true,
         });
         const processStartTime = Date.parse(String(output).trim());
         return Number.isFinite(processStartTime) ? processStartTime : null;
@@ -232,6 +234,7 @@ interface ProcessSnapshot {
 }
 
 let windowsProcessFactsCache: Map<number, ProcessFacts> | null = null;
+let windowsProcessSnapshotCache: { snapshot: ProcessSnapshot; at: number } | null = null;
 
 function rememberWindowsProcessFacts(facts: ProcessFacts[]): void {
     windowsProcessFactsCache = new Map(facts.map((fact) => [fact.pid, fact]));
@@ -239,6 +242,7 @@ function rememberWindowsProcessFacts(facts: ProcessFacts[]): void {
 
 function clearWindowsProcessFactsCache(): void {
     windowsProcessFactsCache = null;
+    windowsProcessSnapshotCache = null;
 }
 
 function parseCsvLine(line: string): string[] | null {
@@ -292,6 +296,7 @@ function readWindowsProcess(pid: number): { state: PidLiveness; command?: string
             encoding: "utf8",
             timeout: PS_PROBE_TIMEOUT_MS,
             stdio: ["ignore", "pipe", "pipe"],
+            windowsHide: true,
         });
         const entries = parseTasklistOutput(String(output));
         if (entries === null) return { state: "inconclusive" };
@@ -325,6 +330,7 @@ function readPsProcessCommand(pid: number): string | null {
             encoding: "utf8",
             timeout: PS_PROBE_TIMEOUT_MS,
             stdio: ["ignore", "pipe", "pipe"],
+            windowsHide: true,
         });
         return String(output);
     } catch {
@@ -521,6 +527,7 @@ function execProcessList(
             encoding: "utf8",
             timeout,
             stdio: ["ignore", "pipe", "pipe"],
+            windowsHide: true,
         }),
     );
 }
@@ -588,7 +595,12 @@ function parseWindowsCimOutput(output: string): ProcessFacts[] | null {
             pid,
             parentPid: Number.isInteger(parentPid) && parentPid > 0 ? parentPid : null,
             commandLine,
-            imageName: commandLine ? executableName(commandTokens(commandLine)[0]) : null,
+            imageName:
+                typeof record.Name === "string"
+                    ? record.Name
+                    : commandLine
+                      ? executableName(commandTokens(commandLine)[0])
+                      : null,
             startTime: parseWindowsCreationDate(record.CreationDate),
         });
     }
@@ -679,14 +691,18 @@ function readPosixParentPid(pid: number): number | null {
  * plugin runs. Bound the walk and stop on cycles so a broken parent map
  * cannot loop.
  */
-function collectAncestorPids(selfPid: number, parentByPid: Map<number, number>): Set<number> {
+function collectAncestorPids(
+    selfPid: number,
+    parentByPid: Map<number, number>,
+    probeParents = true,
+): Set<number> {
     const ancestors = new Set<number>();
     let current = selfPid;
     for (let depth = 0; depth < MAX_ANCESTOR_WALK_DEPTH; depth += 1) {
         let ppid: number | null = null;
         if (parentByPid.has(current)) {
             ppid = parentByPid.get(current) ?? null;
-        } else if (rpcIdentityPlatform !== "win32") {
+        } else if (rpcIdentityPlatform !== "win32" && probeParents) {
             ppid = readPosixParentPid(current);
             if (ppid == null && current === process.pid && process.ppid > 0) {
                 ppid = process.ppid;
@@ -703,8 +719,11 @@ function collectAncestorPids(selfPid: number, parentByPid: Map<number, number>):
     return ancestors;
 }
 
-function classifyLivePiSnapshot(snapshot: ProcessSnapshot): PiProcessDiscovery {
-    const ancestors = collectAncestorPids(process.pid, snapshot.parentByPid);
+function classifyLivePiSnapshot(
+    snapshot: ProcessSnapshot,
+    probeParents = true,
+): PiProcessDiscovery {
+    const ancestors = collectAncestorPids(process.pid, snapshot.parentByPid, probeParents);
     const processIds = new Set<number>();
     const inconclusivePids = new Set<number>();
     const skippedAncestorPids: number[] = [];
@@ -773,8 +792,14 @@ export function inspectLivePiProcesses(): PiProcessDiscovery {
             // Prefer one CIM query (pid, parent, command line, start time).
             // tasklist is image-name-only, so it is a fallback and never a
             // verified live-harness source.
-            const cim = tryReadWindowsCimSnapshot(rpcProcessListExecFileSync);
-            const snapshot = cim ?? tryReadWindowsTasklistSnapshot();
+            const now = rpcIdentityNowMs();
+            const cached = windowsProcessSnapshotCache;
+            // A brief reuse avoids spawning PowerShell on every blocker scan.
+            const snapshot =
+                cached && now >= cached.at && now - cached.at < WINDOWS_PROCESS_SNAPSHOT_TTL_MS
+                    ? cached.snapshot
+                    : (tryReadWindowsCimSnapshot(rpcProcessListExecFileSync) ??
+                      tryReadWindowsTasklistSnapshot());
             if (!snapshot) {
                 return {
                     state: "unreadable",
@@ -782,6 +807,7 @@ export function inspectLivePiProcesses(): PiProcessDiscovery {
                     error: "process list unavailable",
                 };
             }
+            if (snapshot !== cached?.snapshot) windowsProcessSnapshotCache = { snapshot, at: now };
             rememberWindowsProcessFacts(snapshot.facts);
             return classifyLivePiSnapshot(snapshot);
         }
@@ -834,3 +860,129 @@ export function parseRpcPortFile(content: string, fallbackPid = 0): RpcPortFileR
 function isValidPort(port: number): boolean {
     return Number.isInteger(port) && port > 0 && port <= 65535;
 }
+
+/** One bounded, shared process scan for asynchronous storage opens. */
+export interface AsyncProcessInspection {
+    pi: PiProcessDiscovery;
+    /** Includes process names and commands so offline maintenance can rule out live store users. */
+    processSnapshot?: {
+        source: ProcessSnapshotSource;
+        facts: Array<{ pid: number; imageName: string | null; commandLine: string | null }>;
+    };
+    evidence(pid: number): ProcessProbeEvidence;
+    liveness(pid: number): PidLiveness;
+}
+
+function execProcessListAsync(file: string, args: string[], timeout: number): Promise<string> {
+    return new Promise((resolve, reject) => {
+        execFile(
+            file,
+            args,
+            { encoding: "utf8", timeout, windowsHide: true, maxBuffer: 8 * 1024 * 1024 },
+            (error, stdout) => {
+                if (error) reject(error);
+                else resolve(stdout);
+            },
+        );
+    });
+}
+
+let asyncProcessExec = execProcessListAsync;
+let asyncInspection: Promise<AsyncProcessInspection> | undefined;
+let asyncInspectionExpires = 0;
+let lastAsyncSnapshot: ProcessSnapshot | null = null;
+
+/** Inject only the asynchronous transport; legacy synchronous probes stay isolated. */
+export function __setAsyncProcessProbeForTests(probe?: typeof execProcessListAsync): void {
+    asyncProcessExec = probe ?? execProcessListAsync;
+    asyncInspection = undefined;
+    asyncInspectionExpires = 0;
+    lastAsyncSnapshot = null;
+}
+
+export function inspectProcessesAsync(forceFresh = false): Promise<AsyncProcessInspection> {
+    if (!forceFresh && asyncInspection && rpcIdentityNowMs() < asyncInspectionExpires)
+        return asyncInspection;
+    asyncInspectionExpires = Number.POSITIVE_INFINITY;
+    asyncInspection = (async () => {
+        let snapshot: ProcessSnapshot | null = null;
+        try {
+            if (rpcIdentityPlatform === "win32") {
+                try {
+                    const output = await asyncProcessExec(
+                        "powershell",
+                        ["-NoProfile", "-Command", WINDOWS_CIM_COMMAND],
+                        WINDOWS_CIM_PROBE_TIMEOUT_MS,
+                    );
+                    const facts = parseWindowsCimOutput(output);
+                    if (facts) snapshot = snapshotFromFacts(facts, "cim");
+                } catch {
+                    /* tasklist is the bounded fallback when CIM is unavailable. */
+                }
+                if (!snapshot) {
+                    const entries = parseTasklistOutput(
+                        await asyncProcessExec("tasklist", ["/FO", "CSV"], PS_PROBE_TIMEOUT_MS),
+                    );
+                    if (entries)
+                        snapshot = snapshotFromFacts(
+                            entries.map(({ pid, command }) => ({
+                                pid,
+                                parentPid: null,
+                                commandLine: null,
+                                imageName: command,
+                                startTime: null,
+                            })),
+                            "tasklist",
+                        );
+                }
+            } else {
+                const output = await asyncProcessExec(
+                    "ps",
+                    ["-axo", "pid=,ppid=,lstart=,command="],
+                    PS_PROBE_TIMEOUT_MS,
+                );
+                const facts: ProcessFacts[] = [];
+                for (const line of output.split(/\r?\n/)) {
+                    const match =
+                        /^\s*(\d+)\s+(\d+)\s+(\S+\s+\S+\s+\d+\s+\d+:\d+:\d+\s+\d+)\s+(.+)$/.exec(
+                            line,
+                        );
+                    if (!match) continue;
+                    const startTime = Date.parse(match[3]);
+                    facts.push({
+                        pid: Number(match[1]),
+                        parentPid: Number(match[2]),
+                        commandLine: match[4],
+                        imageName: null,
+                        startTime: Number.isFinite(startTime) ? startTime : null,
+                    });
+                }
+                snapshot = facts.length > 0 ? snapshotFromFacts(facts, "ps") : null;
+            }
+        } catch {
+            /* Missing process evidence is inconclusive, never proof of death. */
+        }
+        // A timed-out refresh cannot prove that a process blocking migration has
+        // exited. Keep its evidence until a successful scan can establish death.
+        const fresh = snapshot !== null;
+        if (snapshot) lastAsyncSnapshot = snapshot;
+        else snapshot = lastAsyncSnapshot;
+        const byPid = new Map(snapshot?.facts.map((fact) => [fact.pid, fact]));
+        return {
+            pi: snapshot
+                ? classifyLivePiSnapshot(snapshot, false)
+                : { state: "unreadable", processIds: [] },
+            ...(fresh && snapshot
+                ? { processSnapshot: { source: snapshot.source, facts: snapshot.facts } }
+                : {}),
+            evidence: (pid: number) => ({
+                startTime: byPid.get(pid)?.startTime ?? null,
+                commandLine: byPid.get(pid)?.commandLine ?? byPid.get(pid)?.imageName ?? null,
+            }),
+            liveness: (pid: number) => (byPid.has(pid) ? "alive" : fresh ? "dead" : "inconclusive"),
+        } satisfies AsyncProcessInspection;
+    })().finally(() => {
+        asyncInspectionExpires = rpcIdentityNowMs() + WINDOWS_PROCESS_SNAPSHOT_TTL_MS;
+    });
+    return asyncInspection;
+}