mixdog 1.2.3 → 1.2.5

package/src/runtime/agent/orchestrator/tools/lib/shell-descendants.mjs

@@ -12,23 +12,235 @@
 //            Once the shell has exited and been reaped, ANY remaining member
 //            of that group is a descendant it left behind, and one signal to
 //            the negative pgid reaches all of them.
-//   win32  — there is no process group to signal, but the shell's stdout and
-//            stderr pipes are INHERITED by its descendants: if they are still
-//            held when the shell process itself has exited, something of this
-//            command is alive. That observation gates a single batched
-//            process-table read (shared with mcp/child-tree.mjs) which names
-//            the survivors that are still linked to the shell pid.
-import { collectDescendantProcesses, killProcessTrees } from '../../mcp/child-tree.mjs';
-import { isPidAlive } from '../../../../shared/pid-liveness.mjs';
+//   win32  — inspect the process table after every root exit. Closed pipes
+//            cannot prove termination: descendants may redirect their stdio.
+//            The strict snapshot names survivors still linked to the root.
+//
+// Every process is tracked by IDENTITY — pid plus creation token from the
+// same table read — never by pid alone: a recycled pid is a different process
+// and neither keeps a tracked survivor "alive" nor becomes a kill target.
+import { killProcessTrees, readProcessTable } from '../../mcp/child-tree.mjs';
 
 const isWin = process.platform === 'win32';
 
-// The spawn server waits up to 2 s for the shell's stdio pumps to drain after
-// the root process exits and then reports the exit regardless (main.rs
-// run_spawn). A close that lands at/after this threshold therefore means the
-// pipes were STILL held by another process at that deadline, not that draining
-// was slow — a normal command closes within milliseconds of its exit.
-export const STDIO_HELD_AFTER_EXIT_MS = 1_500;
+// Cadence of every termination re-check (unconfirmed kill, background job,
+// survivors a finished command left behind).
+export const TERMINATION_RECHECK_MS = 5_000;
+
+// Upper bound on how long a kill waits for its pre-kill snapshot (one process-
+// table read, ~1 s on Windows). The kill is sent at the bound regardless; the
+// read is not abandoned — a snapshot that lands later is still absorbed.
+export const PROCESS_TABLE_READ_BOUND_MS = 2_000;
+
+/** Resolve `promise`'s value, or `onTimeout` once `ms` elapse first. The
+ *  bound's timer is cleared whichever side wins. */
+export function withinBound(promise, ms, onTimeout) {
+  let timer = null;
+  const bound = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(onTimeout), ms);
+    timer.unref?.();
+  });
+  return Promise.race([promise, bound]).finally(() => clearTimeout(timer));
+}
+
+/** Every kill path: wait for the pre-kill `snapshot` (true, or a promise) at
+ *  most PROCESS_TABLE_READ_BOUND_MS, then run `kill` whether it landed or not. */
+export function killAfterSnapshot(snapshot, kill) {
+  return withinBound(Promise.resolve(snapshot), PROCESS_TABLE_READ_BOUND_MS, false).then(kill);
+}
+
+const identityKey = (entry) => `${entry.pid}:${entry.token ?? ''}`;
+
+/** Tracks one command's process tree across its termination.
+ *
+ *  `capture()` records the identities of the root and every descendant while
+ *  the root is still alive — before a kill can break the parent chain (an
+ *  exited Windows intermediate orphans its children; a POSIX descendant may
+ *  leave the process group). `observe()` takes one strict table read and
+ *  answers 'running', 'gone' or 'unknown':
+ *    - the root is alive (same identity)                     → running
+ *    - no complete pre-exit capture exists                   → unknown
+ *    - a tracked identity, a descendant still linked to one,
+ *      or (POSIX) a member of the command's group is alive   → running
+ *    - a tracked process without a creation token is present → unknown
+ *  A failed table read rejects; callers treat it as unknown. */
+export function createProcessTreeTracker({ pid, members = [], exitObserved = false } = {}) {
+  const rootPid = Number(pid) || 0;
+  let rootToken = null;
+  let complete = false;
+  const tracked = new Map();
+  let live = [];
+  for (const entry of members) tracked.set(identityKey(entry), { ...entry });
+  if (exitObserved) complete = rootPid > 0;
+
+  const present = (table, entry) => {
+    if (!table.tokenOf.has(entry.pid)) return false;
+    if (entry.token == null) return null;
+    return table.tokenOf.get(entry.pid) === entry.token;
+  };
+  const track = (table, child) => {
+    const entry = { pid: child, token: table.tokenOf.get(child) ?? null, name: table.nameOf.get(child) || '' };
+    const key = identityKey(entry);
+    if (tracked.has(key)) return false;
+    tracked.set(key, entry);
+    return true;
+  };
+  // The root's pid still names OUR root (or nothing): its dangling child links
+  // are ours. A different process under that pid is a reuse — not ours.
+  const rootPidIsOurs = (table, rootAlive) =>
+    rootAlive || !table.tokenOf.has(rootPid) || (rootToken != null && table.tokenOf.get(rootPid) === rootToken);
+
+  function absorb(table, rootAlive) {
+    const from = [];
+    if (rootPidIsOurs(table, rootAlive)) from.push(rootPid);
+    for (const entry of tracked.values()) if (present(table, entry) === true) from.push(entry.pid);
+    const seen = new Set(from);
+    while (from.length) {
+      const cur = from.pop();
+      for (const child of table.childrenOf.get(cur) ?? []) {
+        if (seen.has(child)) continue;
+        seen.add(child);
+        track(table, child);
+        from.push(child);
+      }
+    }
+    // POSIX: the command owns the group whose id is the root pid. While any
+    // member exists that id cannot be reused, so a live process holding the
+    // pid that is not our root means our group is gone.
+    if (!isWin && rootPidIsOurs(table, rootAlive)) {
+      for (const [member, pgid] of table.pgidOf ?? []) {
+        if (pgid === rootPid && member !== rootPid) track(table, member);
+      }
+    }
+    if (rootAlive) {
+      rootToken = rootToken ?? table.tokenOf.get(rootPid) ?? null;
+      complete = true;
+    }
+  }
+
+  function rootIsAlive(table, rootExited) {
+    if (rootExited || !table.tokenOf.has(rootPid)) return false;
+    return rootToken == null || table.tokenOf.get(rootPid) === rootToken;
+  }
+
+  return {
+    get complete() {
+      return complete;
+    },
+    /** Identities currently known alive after the last observation. */
+    get live() {
+      return live;
+    },
+    /** Pre-termination snapshot; call while the root still runs. */
+    async capture({ rootExited = false } = {}) {
+      if (rootPid <= 0) return false;
+      let table = await readProcessTable({ shared: true });
+      // A shared read may have begun before this root was spawned.
+      if (!table.tokenOf.has(rootPid)) table = await readProcessTable();
+      absorb(table, rootIsAlive(table, rootExited));
+      return complete;
+    },
+    /** For a root that exited ON ITS OWN (no kill in between): it is observed
+     *  after exit exactly like a foreground command's settle. Callers never
+     *  waive a missing pre-kill snapshot with it. */
+    acceptExitObservation() {
+      if (rootPid > 0) complete = true;
+    },
+    async observe({ rootExited = true } = {}) {
+      if (rootPid <= 0) return 'unknown';
+      const table = await readProcessTable();
+      const rootAlive = rootIsAlive(table, rootExited);
+      absorb(table, rootAlive);
+      live = [];
+      if (rootAlive) {
+        live = [{ pid: rootPid, token: rootToken, name: table.nameOf.get(rootPid) || '' }];
+        return 'running';
+      }
+      if (!complete) return 'unknown';
+      let unknown = false;
+      for (const entry of tracked.values()) {
+        const state = present(table, entry);
+        if (state === true) live.push(entry);
+        else if (state === null) unknown = true;
+      }
+      if (live.length > 0) return 'running';
+      return unknown ? 'unknown' : 'gone';
+    },
+  };
+}
+
+/** One observation loop: observe now, then every `intervalMs` until the tree
+ *  is confirmed gone, then run `onTerminated` once. 'running', 'unknown', a
+ *  failed or unanswered (by the next cadence tick) observation and a failing
+ *  `onTerminated` all re-check on the same cadence; the first pass that is not
+ *  'gone' calls `onUnconfirmed` once. The returned stop() clears the pending
+ *  timer; nothing else (listener, timer) outlives the loop. Nothing in it ever
+ *  releases on time alone. */
+export function watchTermination({
+  tracker,
+  rootExited = () => true,
+  onTerminated,
+  onUnconfirmed = null,
+  releaseRequested = null,
+  intervalMs = TERMINATION_RECHECK_MS,
+}) {
+  let timer = null;
+  let stopped = false;
+  let reportedUnconfirmed = false;
+  const stop = () => {
+    stopped = true;
+    if (timer) clearTimeout(timer);
+    timer = null;
+  };
+  const pass = async () => {
+    timer = null;
+    if (stopped) return;
+    let state = 'unknown';
+    let observation = null;
+    // An explicit user force-release made from another process (the hold's
+    // workspace is visible there): released as if confirmed, never on time.
+    if (releaseRequested?.()) state = 'gone';
+    else
+      try {
+        observation = tracker.observe({ rootExited: rootExited() });
+        observation.catch(() => {});
+        // A pass that has not answered by the next cadence tick is unknown.
+        state = await withinBound(observation, intervalMs, 'unknown');
+      } catch {
+        state = 'unknown';
+      }
+    if (stopped) return;
+    if (state !== 'gone' && !reportedUnconfirmed) {
+      reportedUnconfirmed = true;
+      try {
+        onUnconfirmed?.();
+      } catch {
+        /* presentation only */
+      }
+    }
+    if (state === 'gone') {
+      try {
+        await onTerminated();
+        stop();
+        return;
+      } catch {
+        /* the release failed: the reservation stays and is re-checked */
+      }
+    }
+    // The next pass never starts beside this pass's enumerator: a table read
+    // always settles by its own deadline (killed on timeout).
+    if (observation)
+      await observation.then(
+        () => {},
+        () => {}
+      );
+    if (stopped) return;
+    timer = setTimeout(pass, intervalMs);
+    timer.unref?.();
+  };
+  void pass();
+  return stop;
+}
 
 // Windows attaches a console host to the hidden console the shell runs in. It
 // is a real child of the shell and it lives exactly as long as console clients
@@ -44,7 +256,7 @@ function groupAlive(pgid) {
     process.kill(-pgid, 0);
     return true;
   } catch (error) {
-    return error?.code === 'EPERM';
+    return error?.code !== 'ESRCH';
   }
 }
 
@@ -61,73 +273,101 @@ function delay(ms) {
  *  reports a plain completion), or a handle describing the survivors:
  *    groupPid   POSIX process group that still has members
  *    killPids   pids a cancellation can signal directly
- *    watchPids  pids whose liveness answers "is this task still running?"
+ *    watchPids  pids of the observed survivors
+ *    watch      their identities ({ pid, token, name }); liveness and kills
+ *               compare these, never the bare pid
  *    reachable  false when survivors are observable but no longer addressable
  *               by pid (Windows re-parents nothing: a process whose parent
  *               exited keeps a dangling parent id, so an intermediate that
- *               already exited breaks the link). */
-export async function probeShellDescendants({ pid, stdioHeld = false } = {}) {
+ *               already exited breaks the link).
+ *  Rejects when the process table cannot be read completely. */
+export async function probeShellDescendants({ pid } = {}) {
   const root = Number(pid) || 0;
   if (root <= 0) return null;
-  if (!isWin) {
-    if (!groupAlive(root)) return null;
-    return { groupPid: root, killPids: [], watchPids: [], reachable: true };
-  }
-  if (!stdioHeld) return null;
-  const found = await collectDescendantProcesses(root).catch(() => []);
-  const live = found.filter((entry) => isPidAlive(entry.pid));
-  if (live.length === 0) return null;
-  const killPids = live.filter((entry) => !CONSOLE_HOST.test(entry.name)).map((entry) => entry.pid);
+  // POSIX fast path: no member of the command's group at all.
+  if (!isWin && !groupAlive(root)) return null;
+  const tracker = createProcessTreeTracker({ pid: root, exitObserved: true });
+  const state = await tracker.observe({ rootExited: true });
+  if (state === 'gone') return null;
+  if (state === 'unknown') throw new Error('Remaining child processes could not be verified.');
+  return survivorHandle(root, tracker.live);
+}
+
+function survivorHandle(rootPid, live) {
+  const watch = live.map(({ pid, token, name }) => ({ pid, token, name }));
+  const killPids = watch.filter((entry) => !CONSOLE_HOST.test(entry.name)).map((entry) => entry.pid);
   return {
-    groupPid: null,
+    rootPid,
+    groupPid: isWin ? null : rootPid,
     killPids,
-    watchPids: live.map((entry) => entry.pid),
-    reachable: killPids.length > 0,
+    watchPids: watch.map((entry) => entry.pid),
+    watch,
+    reachable: !isWin || killPids.length > 0,
   };
 }
 
-/** True while the observed survivors are still running. */
-export function descendantsAlive(handle) {
-  if (!handle) return false;
-  if (handle.groupPid) return groupAlive(handle.groupPid);
-  return handle.watchPids.some((pid) => isPidAlive(pid));
-}
+const trackerFor = (handle) =>
+  createProcessTreeTracker({ pid: handle.rootPid, members: handle.watch, exitObserved: true });
 
-/** Resolve once every observed survivor has exited. Poll-based on purpose:
- *  these processes are not our children any more, so there is no exit event to
- *  subscribe to — only their liveness can be observed. */
-export async function waitForShellDescendants(handle, { pollMs = 1_000, signal = null } = {}) {
-  while (descendantsAlive(handle)) {
-    if (signal?.aborted) return false;
-    await delay(pollMs);
-  }
-  return true;
+/** Resolve once every observed survivor (by identity) has exited, or false
+ *  once `signal` aborts. These processes are not our children any more, so
+ *  there is no exit event to subscribe to; the shared observation loop
+ *  re-checks them at the termination cadence. */
+export function waitForShellDescendants(handle, { signal = null } = {}) {
+  if (!handle) return Promise.resolve(true);
+  return new Promise((resolve) => {
+    if (signal?.aborted) {
+      resolve(false);
+      return;
+    }
+    const onAbort = () => {
+      stop();
+      resolve(false);
+    };
+    const stop = watchTermination({
+      tracker: trackerFor(handle),
+      onTerminated: () => {
+        signal?.removeEventListener('abort', onAbort);
+        resolve(true);
+      },
+    });
+    signal?.addEventListener('abort', onAbort, { once: true });
+  });
 }
 
-/** Terminate the survivors. POSIX signals the whole process group, so the kill
- *  is complete by construction; Windows kills every reachable tree and then
- *  RE-OBSERVES, so the caller reports what actually died instead of what was
- *  signalled. */
+/** Terminate the survivors, signalling only processes whose identity still
+ *  matches the observation, then RE-OBSERVE so the caller reports what
+ *  actually died instead of what was signalled. Never rejects. */
 export async function killShellDescendants(handle) {
   if (!handle) return { terminated: true, survivors: [] };
-  if (handle.groupPid) {
-    try {
-      process.kill(-handle.groupPid, 'SIGTERM');
-    } catch {
-      /* already gone */
-    }
-    await delay(200);
-    if (groupAlive(handle.groupPid)) {
+  try {
+    const table = await readProcessTable();
+    // The group id is ours only while no other process holds the root pid.
+    if (handle.groupPid && !table.tokenOf.has(handle.groupPid)) {
       try {
-        process.kill(-handle.groupPid, 'SIGKILL');
+        process.kill(-handle.groupPid, 'SIGTERM');
       } catch {
         /* already gone */
       }
-      await delay(100);
+      await delay(200);
+      if (groupAlive(handle.groupPid)) {
+        try {
+          process.kill(-handle.groupPid, 'SIGKILL');
+        } catch {
+          /* already gone */
+        }
+        await delay(100);
+      }
     }
-    return { terminated: !groupAlive(handle.groupPid), survivors: [] };
+    const targets = handle.watch
+      .filter((entry) => entry.token != null && table.tokenOf.get(entry.pid) === entry.token)
+      .filter((entry) => !CONSOLE_HOST.test(entry.name))
+      .map((entry) => entry.pid);
+    await killProcessTrees(targets).catch(() => {});
+    const tracker = trackerFor(handle);
+    const state = await tracker.observe({ rootExited: true });
+    return { terminated: state === 'gone', survivors: tracker.live.map((entry) => entry.pid) };
+  } catch {
+    return { terminated: false, survivors: [...handle.watchPids] };
   }
-  await killProcessTrees(handle.killPids).catch(() => {});
-  const survivors = handle.watchPids.filter((pid) => isPidAlive(pid));
-  return { terminated: survivors.length === 0, survivors };
 }

package/src/runtime/agent/orchestrator/tools/lib/shell-run-background/promote-job.mjs

@@ -84,4 +84,6 @@ export async function handOverLease(run) {
   const lease = run.resourceLease;
   run.resourceLease = null;
   await lease?.release();
+  run.workspaceAdmission?.();
+  run.workspaceAdmission = null;
 }

package/src/runtime/agent/orchestrator/tools/lib/shell-run-settle.mjs

@@ -3,20 +3,65 @@
 // lease cleanup that a promoted or unconfirmed-kill child defers to its own
 // real exit.
 import { ExecResult, SHELL_OUTPUT_INLINE_CAP } from '../shell-exec-output.mjs';
-import { probeShellDescendants, STDIO_HELD_AFTER_EXIT_MS } from './shell-descendants.mjs';
+import { createProcessTreeTracker, probeShellDescendants, watchTermination } from './shell-descendants.mjs';
+import { unregisterOwnedShellTree } from './owned-shell-trees.mjs';
+import {
+  adoptShellWorkspaceAdmission,
+  clearTerminationHold,
+  registerTerminationHold,
+  takeReleaseRequest,
+} from '../builtin/lib/shell-job-records.mjs';
 import {
   clearForegroundRecord,
   clearForegroundTimers,
   detachAbortHandler,
+  keepTerminationUnconfirmedRecord,
   releaseResourceLease,
 } from './shell-run-state.mjs';
 
 // Unconfirmed-kill cleanup ceiling: the result is already reported, but the
-// tree may still be alive, so closing the capture and returning the
-// admission lease wait for the child's real exit — bounded so an unkillable
-// tree cannot pin the shell lane forever.
+// tree may still be alive, so closing the capture and returning the resource
+// lease wait for the child's real exit — bounded so an unkillable tree cannot
+// pin the shell lane forever. The workspace admission is NOT bounded by it:
+// it follows confirmed termination only (see below).
 const UNCONFIRMED_KILL_CLEANUP_CEILING_MS = 60_000;
 
+/** Lifecycle completion of a run whose result is already reported: release
+ *  `run.workspaceAdmission` and retire the live record only once the root AND
+ *  every descendant identity captured before the kill are confirmed gone. One
+ *  observation loop at the termination cadence; running, unknown (incomplete
+ *  snapshot, failed table read) and a failing release all re-check, and no
+ *  timer ever releases on its own. */
+export function releaseAdmissionOnConfirmedTermination(run, { markNow = true } = {}) {
+  const { child } = run;
+  if (!child || run.stopTerminationWatch) return;
+  // Visible as "termination unconfirmed" until the lifecycle ends, with an
+  // explicit user force-release as the only other way out. An unconfirmed
+  // kill is marked at once; an owner-cancelled tree whose root is already
+  // gone only once its first observation is not 'gone'.
+  if (markNow) keepTerminationUnconfirmedRecord(run);
+  const release = () => {
+    run.workspaceAdmission?.();
+    run.workspaceAdmission = null;
+    run.stopTerminationWatch?.();
+    clearTerminationHold(run.foregroundRecordId);
+    clearForegroundRecord(run);
+  };
+  registerTerminationHold(run.foregroundRecordId, {
+    ownerSessionId: run.foregroundRecordInput?.ownerSessionId || null,
+    cwd: run.foregroundRecordInput?.cwd || null,
+    release,
+  });
+  run.terminationTracker = run.terminationTracker || createProcessTreeTracker({ pid: child.pid });
+  run.stopTerminationWatch = watchTermination({
+    tracker: run.terminationTracker,
+    rootExited: () => child.exitCode != null || child.signalCode != null,
+    onTerminated: release,
+    onUnconfirmed: markNow ? null : () => keepTerminationUnconfirmedRecord(run),
+    releaseRequested: () => takeReleaseRequest(run.foregroundRecordId),
+  });
+}
+
 // Promotion resolves the call and hands the child's lifecycle to the
 // shell-jobs registry, but the spill FDs stay owned by THIS runner and
 // nothing else would ever close them — one leaked descriptor pair per
@@ -49,9 +94,17 @@ export function createPromotedCaptureRelease(run) {
 
 function deferCleanupToChildExit(run) {
   let done = false;
+  let ceiling = null;
   const cleanup = () => {
     if (done) return;
     done = true;
+    clearTimeout(ceiling);
+    try {
+      run.child.removeListener('close', cleanup);
+      run.child.removeListener('exit', cleanup);
+    } catch {
+      /* not an emitter */
+    }
     try {
       run.taskOutput.closeFds();
     } catch {
@@ -65,8 +118,9 @@ function deferCleanupToChildExit(run) {
   } catch {
     /* child may already be gone */
   }
-  const ceiling = setTimeout(cleanup, UNCONFIRMED_KILL_CLEANUP_CEILING_MS);
+  ceiling = setTimeout(cleanup, UNCONFIRMED_KILL_CLEANUP_CEILING_MS);
   if (ceiling.unref) ceiling.unref();
+  releaseAdmissionOnConfirmedTermination(run);
 }
 
 // getStdout/getStderr can throw on a spilled-file read failure (EBADF after
@@ -96,21 +150,17 @@ export async function readCapturedOutput(taskOutput, final = false) {
 // instead of a clean finish; null means nothing survived.
 async function probeSurvivingDescendants(run) {
   if (run.killed || run.timedOut || !run.child?.pid) return null;
-  try {
-    const descendants = await probeShellDescendants({
-      pid: run.child.pid,
-      stdioHeld: run.rootExitAtMs > 0 && Date.now() - run.rootExitAtMs >= STDIO_HELD_AFTER_EXIT_MS,
-    });
-    if (descendants) descendants.taskId = run.foregroundRecordId;
-    return descendants;
-  } catch {
-    return null;
-  }
+  const descendants = await probeShellDescendants({
+    pid: run.child.pid,
+  });
+  if (descendants) descendants.taskId = run.foregroundRecordId;
+  return descendants;
 }
 
 export function createSettle(run, releasePromotedCapture) {
   return async (exitCode, signal) => {
     if (run.settled) return;
+    if (run.ownedTree) unregisterOwnedShellTree(run.foregroundRecordId, run.ownedTree);
     if (run.autoBackgrounded) {
       releasePromotedCapture();
       return;
@@ -119,7 +169,15 @@ export function createSettle(run, releasePromotedCapture) {
     const { taskOutput } = run;
     // Off the readouts the instant the command is over, before any awaited
     // output capture — a finished command must never linger as "running".
-    clearForegroundRecord(run);
+    // An unconfirmed kill is NOT over: its record stays, marked unconfirmed
+    // (releaseAdmissionOnConfirmedTermination), until every process is
+    // confirmed gone or the user releases it.
+    // Every other killed run (timeout, abort, session close) completes the
+    // same way: its pre-kill snapshot, not the root's exit, decides when it
+    // is over — a captured descendant can outlive the root it was killed with.
+    const confirmKill = run.killed === true && !run.killUnconfirmed && Boolean(run.child?.pid);
+    const lifecycleHeld = run.killUnconfirmed || confirmKill;
+    if (!lifecycleHeld) clearForegroundRecord(run);
     clearForegroundTimers(run);
     detachAbortHandler(run);
     const stdoutTail = run.stdoutDecoder.end();
@@ -139,7 +197,8 @@ export function createSettle(run, releasePromotedCapture) {
     if (run.killUnconfirmed) {
       // Never confirmed dead: deleting the capture files or handing back the
       // lease now would release resources a live process still owns. The
-      // spilled paths therefore survive and travel with the result below.
+      // spilled paths therefore survive and travel with the result below, and
+      // the workspace admission stays held until termination is confirmed.
       deferCleanupToChildExit(run);
     } else if (taskOutput.spilled && taskOutput.totalDiskBytes() <= SHELL_OUTPUT_INLINE_CAP) {
       taskOutput.deleteFiles();
@@ -148,7 +207,38 @@ export function createSettle(run, releasePromotedCapture) {
       taskOutput.closeFds();
       void releaseResourceLease(run);
     }
-    const descendants = await probeSurvivingDescendants(run);
+    let descendants = null;
+    let descendantsUnknown = false;
+    try {
+      descendants = await probeSurvivingDescendants(run);
+    } catch (error) {
+      descendantsUnknown = true;
+      taskOutput.writeError = taskOutput.writeError || error;
+      exitCode = exitCode || 1;
+      run.failureReason = 'Remaining child processes could not be verified; workspace cleanup is blocked.';
+      // The root exited on its own, so it is observed after exit like any
+      // settle; the held admission joins the termination watch and the
+      // explicit force-release, and the record is kept, marked unconfirmed.
+      // (The probe runs only for an unkilled root, so the lifecycle is not
+      // already held here.)
+      run.terminationTracker = run.terminationTracker || createProcessTreeTracker({ pid: run.child.pid });
+      run.terminationTracker.acceptExitObservation();
+      releaseAdmissionOnConfirmedTermination(run);
+    }
+    // Marked unconfirmed (with its force-release) only once an observation
+    // finds a captured identity still alive or cannot tell.
+    if (confirmKill) releaseAdmissionOnConfirmedTermination(run, { markNow: false });
+    if (!lifecycleHeld && !descendantsUnknown && run.workspaceAdmission) {
+      try {
+        if (descendants) adoptShellWorkspaceAdmission(run.foregroundRecordId, run.workspaceAdmission);
+        else run.workspaceAdmission();
+        run.workspaceAdmission = null;
+      } catch (error) {
+        taskOutput.writeError = taskOutput.writeError || error;
+        exitCode = exitCode || 1;
+        run.failureReason = 'workspace admission cleanup failed';
+      }
+    }
     run.resolveResult(
       new ExecResult({
         stdout,