mixdog 1.4.1 → 1.4.2

package/src/runtime/agent/orchestrator/tools/lib/shell-descendants.mjs

@@ -54,6 +54,17 @@ export function killAfterSnapshot(snapshot, kill) {
 
 const identityKey = (entry) => `${entry.pid}:${entry.token ?? ''}`;
 
+// Windows keeps a process's parent id after that parent exits and hands the
+// pid to a new process within milliseconds, so a parent link can name a
+// process created after the one listing it: an unrelated process then looks
+// like the new holder's child. A child is never created before its parent.
+// (POSIX reparents orphans, so its links never dangle.) Only kernel creation
+// times are compared — the table's tokens and the spawn server's root
+// creation time, both FILETIME ticks — at the table's microsecond precision;
+// a parent whose time is unknown excludes nothing. Any other token (POSIX
+// lstart, scripted test tokens) is unknown.
+const createdUs = (ticks) => (typeof ticks === 'string' && /^\d+$/.test(ticks) ? BigInt(ticks) / 10n : null);
+
 /** Tracks one command's process tree across its termination.
  *
  *  `capture()` records the identities of the root and every descendant while
@@ -66,8 +77,11 @@ const identityKey = (entry) => `${entry.pid}:${entry.token ?? ''}`;
  *      or (POSIX) a member of the command's group is alive   → running
  *    - no complete pre-exit capture exists                   → unknown
  *    - a tracked process without a creation token is present → unknown
- *  A failed table read rejects; callers treat it as unknown. */
-export function createProcessTreeTracker({ pid, members = [], exitObserved = false } = {}) {
+ *  A failed table read rejects; callers treat it as unknown.
+ *
+ *  `rootCreationTime`: the root's kernel creation time from its spawn (see
+ *  native-spawn-client), known even once the root is gone uncaptured. */
+export function createProcessTreeTracker({ pid, members = [], exitObserved = false, rootCreationTime = null } = {}) {
   const rootPid = Number(pid) || 0;
   let rootToken = null;
   let complete = false;
@@ -92,6 +106,12 @@ export function createProcessTreeTracker({ pid, members = [], exitObserved = fal
   // are ours. A different process under that pid is a reuse — not ours.
   const rootPidIsOurs = (table, rootAlive) =>
     rootAlive || !table.tokenOf.has(rootPid) || (rootToken != null && table.tokenOf.get(rootPid) === rootToken);
+  // When `cur` (a live root, or a present identity) was created, if known.
+  const createdAt = (table, cur, rootAlive) => {
+    if (!isWin) return null;
+    if (cur !== rootPid) return createdUs(table.tokenOf.get(cur));
+    return createdUs(rootCreationTime) ?? createdUs(rootAlive ? table.tokenOf.get(rootPid) : rootToken);
+  };
 
   function absorb(table, rootAlive) {
     const from = [];
@@ -100,8 +120,11 @@ export function createProcessTreeTracker({ pid, members = [], exitObserved = fal
     const seen = new Set(from);
     while (from.length) {
       const cur = from.pop();
+      const parentCreated = createdAt(table, cur, rootAlive);
       for (const child of table.childrenOf.get(cur) ?? []) {
         if (seen.has(child)) continue;
+        const childCreated = parentCreated == null ? null : createdUs(table.tokenOf.get(child));
+        if (childCreated != null && childCreated < parentCreated) continue;
         seen.add(child);
         track(table, child);
         from.push(child);
@@ -173,19 +196,77 @@ export function createProcessTreeTracker({ pid, members = [], exitObserved = fal
   };
 }
 
+/** The tracker of a KILLED tree the native spawn server contains (a Windows
+ *  job object nothing can break away from), driven only by the server's
+ *  outcome for that job (`outcome()`, see native-spawn-client treeOutcome).
+ *  It never reads the process table: membership is the job's, never a guess
+ *  from parent links, which a reused root pid makes point at the wrong
+ *  processes. So the kill never waits for a snapshot.
+ *    'empty'                 gone
+ *    'preserved'             the root exited on its own before the kill
+ *                            reached the server, which kept its survivors in
+ *                            the job: `cancel()` re-sends the kill to exactly
+ *                            that job (once), and its verdict follows
+ *    'unverified'/'released' unknown for good, and incomplete, so a
+ *                            force-release ends the watch: never gone
+ *    anything else           unknown until the server reports (a lost server
+ *                            never does) */
+export function createContainedTreeTracker({ outcome, cancel }) {
+  let cancelled = false;
+  return {
+    contained: true,
+    get complete() {
+      const value = outcome();
+      return value !== 'unverified' && value !== 'released';
+    },
+    live: [],
+    capture: async () => true,
+    acceptExitObservation() {},
+    async observe() {
+      const value = outcome();
+      if (value === 'empty') return 'gone';
+      if (value === 'preserved' && !cancelled) {
+        cancelled = true;
+        try {
+          cancel();
+        } catch {
+          /* the server link is gone: the outcome stays unknown */
+        }
+      }
+      return 'unknown';
+    },
+  };
+}
+
 /** Terminate every identity the last observation found alive (console hosts
  *  excepted: they are witnesses, never workers). These are processes of a tree
  *  that was KILLED — they escaped its process group (setsid, job control, a
  *  double fork that kept its parent link) or outlived the root on Windows —
  *  so the kill is not finished while they run. Windows: taskkill /T /F;
  *  POSIX: SIGTERM, then SIGKILL after a short grace. */
-function sweepLiveIdentities(tracker) {
+export function sweepLiveIdentities(tracker) {
   const targets = tracker.live
     .filter((entry) => entry.token != null && !CONSOLE_HOST.test(entry.name))
     .map((entry) => entry.pid);
   return targets.length > 0 ? killProcessTrees(targets) : Promise.resolve();
 }
 
+/** A tracker for a watch that goes on after its hold was force-released: an
+ *  observation that stays 'unknown' on a tracker that can never complete (the
+ *  root is gone and its pre-kill capture was incomplete) ends the watch via
+ *  `stop`. Termination is never reported by it. */
+export function endWatchWhenUnconfirmable(tracker, { released, stop }) {
+  return Object.create(tracker, {
+    observe: {
+      value: async (options) => {
+        const state = await tracker.observe(options);
+        if (released() && state === 'unknown' && !tracker.complete) stop();
+        return state;
+      },
+    },
+  });
+}
+
 /** One observation loop: observe now, then every `intervalMs` until the tree
  *  is confirmed gone, then run `onTerminated` once. 'running', 'unknown', a
  *  failed or unanswered (by the next cadence tick) observation and a failing
@@ -194,8 +275,9 @@ function sweepLiveIdentities(tracker) {
  *  timer; nothing else (listener, timer) outlives the loop. Nothing in it ever
  *  releases on time alone.
  *
- *  `sweep` (a killed tree): a pass that finds captured identities alive
- *  terminates them and observes again in the same pass, so a cancellation
+ *  `sweep` (a killed tree; a boolean, or a predicate read on every pass so a
+ *  cancel that arrives later is retried each cadence): a pass that finds
+ *  captured identities alive terminates them and observes again in the same pass, so a cancellation
  *  ends with the tree gone instead of a held folder over live processes.
  *  A missing pre-kill capture stays unknown even if the owning session
  *  closes: its lifetime is not evidence that every descendant has exited. */
@@ -230,7 +312,7 @@ export function watchTermination({
         observation.catch(() => {});
         // A pass that has not answered by the next cadence tick is unknown.
         state = await withinBound(observation, intervalMs, 'unknown');
-        if (state === 'running' && sweep && !stopped) {
+        if (state === 'running' && !stopped && (typeof sweep === 'function' ? sweep() : sweep)) {
           await withinBound(
             sweepLiveIdentities(tracker).catch(() => {}),
             intervalMs,
@@ -315,24 +397,26 @@ function delay(ms) {
  *               by pid (Windows re-parents nothing: a process whose parent
  *               exited keeps a dangling parent id, so an intermediate that
  *               already exited breaks the link).
- *  Rejects when the process table cannot be read completely. */
-export async function probeShellDescendants({ pid } = {}) {
+ *  Rejects when the process table cannot be read completely.
+ *  `rootCreationTime`: see createProcessTreeTracker. */
+export async function probeShellDescendants({ pid, rootCreationTime = null } = {}) {
   const root = Number(pid) || 0;
   if (root <= 0) return null;
   // POSIX fast path: no member of the command's group at all.
   if (!isWin && !groupAlive(root)) return null;
-  const tracker = createProcessTreeTracker({ pid: root, exitObserved: true });
+  const tracker = createProcessTreeTracker({ pid: root, exitObserved: true, rootCreationTime });
   const state = await tracker.observe({ rootExited: true });
   if (state === 'gone') return null;
   if (state === 'unknown') throw new Error('Remaining child processes could not be verified.');
-  return survivorHandle(root, tracker.live);
+  return survivorHandle(root, tracker.live, rootCreationTime);
 }
 
-function survivorHandle(rootPid, live) {
+function survivorHandle(rootPid, live, rootCreationTime) {
   const watch = live.map(({ pid, token, name }) => ({ pid, token, name }));
   const killPids = watch.filter((entry) => !CONSOLE_HOST.test(entry.name)).map((entry) => entry.pid);
   return {
     rootPid,
+    rootCreationTime,
     groupPid: isWin ? null : rootPid,
     killPids,
     watchPids: watch.map((entry) => entry.pid),
@@ -342,13 +426,18 @@ function survivorHandle(rootPid, live) {
 }
 
 const trackerFor = (handle) =>
-  createProcessTreeTracker({ pid: handle.rootPid, members: handle.watch, exitObserved: true });
+  createProcessTreeTracker({
+    pid: handle.rootPid,
+    members: handle.watch,
+    exitObserved: true,
+    rootCreationTime: handle.rootCreationTime,
+  });
 
 /** Resolve once every observed survivor (by identity) has exited, or false
  *  once `signal` aborts. These processes are not our children any more, so
  *  there is no exit event to subscribe to; the shared observation loop
  *  re-checks them at the termination cadence. */
-export function waitForShellDescendants(handle, { signal = null } = {}) {
+export function waitForShellDescendants(handle, { signal = null, sweep = false } = {}) {
   if (!handle) return Promise.resolve(true);
   return new Promise((resolve) => {
     if (signal?.aborted) {
@@ -361,6 +450,7 @@ export function waitForShellDescendants(handle, { signal = null } = {}) {
     };
     const stop = watchTermination({
       tracker: trackerFor(handle),
+      sweep,
       onTerminated: () => {
         signal?.removeEventListener('abort', onAbort);
         resolve(true);

package/src/runtime/agent/orchestrator/tools/lib/shell-run-background/promote-job.mjs

@@ -92,6 +92,8 @@ export async function handOverLease(run) {
   const lease = run.resourceLease;
   run.resourceLease = null;
   await lease?.release();
-  run.workspaceAdmission?.();
+  const released = run.workspaceAdmission?.();
   run.workspaceAdmission = null;
+  // Fails only when workspace admission stopped (reported there), which keeps the folder held.
+  await Promise.resolve(released).catch(() => {});
 }

package/src/runtime/agent/orchestrator/tools/lib/shell-run-settle.mjs

@@ -3,7 +3,7 @@
 // lease cleanup that a promoted or unconfirmed-kill child defers to its own
 // real exit.
 import { ExecResult, SHELL_OUTPUT_INLINE_CAP } from '../shell-exec-output.mjs';
-import { createProcessTreeTracker, probeShellDescendants, watchTermination } from './shell-descendants.mjs';
+import { endWatchWhenUnconfirmable, probeShellDescendants, watchTermination } from './shell-descendants.mjs';
 import { unregisterOwnedShellTree } from './owned-shell-trees.mjs';
 import {
   adoptShellWorkspaceAdmission,
@@ -17,6 +17,7 @@ import {
   detachAbortHandler,
   keepTerminationUnconfirmedRecord,
   releaseResourceLease,
+  runTreeTracker,
 } from './shell-run-state.mjs';
 
 // Unconfirmed-kill cleanup ceiling: the result is already reported, but the
@@ -26,8 +27,8 @@ import {
 // it follows confirmed termination only (see below).
 const UNCONFIRMED_KILL_CLEANUP_CEILING_MS = 60_000;
 
-/** Settles once a held run's whole tree is confirmed gone (or its hold was
- *  force-released): what its result left in use defers to this. */
+/** Settles once a held run's whole tree is confirmed gone: what its result
+ *  left in use defers to this. A force-release does not settle it. */
 function treeSettled(run) {
   if (!run.treeSettled) {
     run.treeSettled = new Promise((resolve) => {
@@ -52,28 +53,56 @@ export function releaseAdmissionOnConfirmedTermination(run, { markNow = true, sw
   // gone only once its first observation is not 'gone'.
   if (markNow) keepTerminationUnconfirmedRecord(run);
   treeSettled(run);
+  // The workspace leases stop counting here; the returned promise settles once
+  // their removal is on disk. A force-release only drops the hold: the tree
+  // stays observed, and only its confirmed exit settles it (`terminated`).
+  let released;
+  let holdDropped = false;
   const release = () => {
-    run.workspaceAdmission?.();
-    run.workspaceAdmission = null;
-    run.stopTerminationWatch?.();
     clearTerminationHold(run.foregroundRecordId);
-    clearForegroundRecord(run);
+    if (!holdDropped) {
+      released = run.workspaceAdmission?.();
+      run.workspaceAdmission = null;
+      clearForegroundRecord(run);
+      holdDropped = true;
+    }
+    return released;
+  };
+  const terminated = () => {
+    const dropped = release();
+    run.stopTerminationWatch?.();
     run.resolveTreeSettled();
+    return dropped;
   };
   registerTerminationHold(run.foregroundRecordId, {
     ownerSessionId: run.foregroundRecordInput?.ownerSessionId || null,
     cwd: run.foregroundRecordInput?.cwd || null,
     release,
   });
-  run.terminationTracker = run.terminationTracker || createProcessTreeTracker({ pid: child.pid });
+  runTreeTracker(run);
+  // After a force-release the watch only waits for a confirmed exit. An
+  // incomplete pre-kill capture of a root that is gone can never be completed,
+  // so an observation that stays unknown on it ends the watch (never settling
+  // the tree: `treeSettled` follows a confirmed exit only).
   run.stopTerminationWatch = watchTermination({
-    tracker: run.terminationTracker,
+    tracker: endWatchWhenUnconfirmable(run.terminationTracker, {
+      released: () => holdDropped,
+      stop: () => run.stopTerminationWatch?.(),
+    }),
     rootExited: () => child.exitCode != null || child.signalCode != null,
     // A killed run is not over while processes it started still run.
     sweep,
-    onTerminated: release,
-    onUnconfirmed: markNow ? null : () => keepTerminationUnconfirmedRecord(run),
-    releaseRequested: () => takeReleaseRequest(run.foregroundRecordId),
+    onTerminated: terminated,
+    onUnconfirmed: markNow
+      ? null
+      : () => {
+          if (!holdDropped) keepTerminationUnconfirmedRecord(run);
+        },
+    // A release requested from another process is the same force-release.
+    releaseRequested: () => {
+      if (takeReleaseRequest(run.foregroundRecordId)) void release();
+      return false;
+    },
   });
 }
 
@@ -165,8 +194,11 @@ export async function readCapturedOutput(taskOutput, final = false) {
 // instead of a clean finish; null means nothing survived.
 async function probeSurvivingDescendants(run) {
   if (run.killed || run.timedOut || !run.child?.pid) return null;
+  // The spawn server verified the command's job empty: nothing survived.
+  if (run.child.treeOutcome === 'empty') return null;
   const descendants = await probeShellDescendants({
     pid: run.child.pid,
+    rootCreationTime: run.child.creationTime,
   });
   if (descendants) descendants.taskId = run.foregroundRecordId;
   return descendants;
@@ -240,8 +272,7 @@ export function createSettle(run, releasePromotedCapture) {
       // explicit force-release, and the record is kept, marked unconfirmed.
       // (The probe runs only for an unkilled root, so the lifecycle is not
       // already held here.)
-      run.terminationTracker = run.terminationTracker || createProcessTreeTracker({ pid: run.child.pid });
-      run.terminationTracker.acceptExitObservation();
+      runTreeTracker(run).acceptExitObservation();
       releaseAdmissionOnConfirmedTermination(run);
     }
     // Marked unconfirmed (with its force-release) only once an observation
@@ -249,9 +280,12 @@ export function createSettle(run, releasePromotedCapture) {
     if (confirmKill) releaseAdmissionOnConfirmedTermination(run, { markNow: false });
     if (!lifecycleHeld && !descendantsUnknown && run.workspaceAdmission) {
       try {
+        let released = null;
         if (descendants) adoptShellWorkspaceAdmission(run.foregroundRecordId, run.workspaceAdmission);
-        else run.workspaceAdmission();
+        else released = run.workspaceAdmission();
         run.workspaceAdmission = null;
+        // The result is reported once the removal is on disk, as when it was written synchronously.
+        await released;
       } catch (error) {
         taskOutput.writeError = taskOutput.writeError || error;
         exitCode = exitCode || 1;

package/src/runtime/agent/orchestrator/tools/lib/shell-run-spawn.mjs

@@ -18,8 +18,9 @@ import { _maybeEncodePowerShellCommand } from '../shell-powershell.mjs';
 import { spawnShellWithRetry as _spawnShellWithRetry } from './shell-spawn-retry.mjs';
 import { STANDBY_ARGS, takeWarmShellStandby } from './shell-warm-standby.mjs';
 import { SHELL_OUTPUT_DISK_CAP } from '../shell-exec-output.mjs';
-import { admitWorkspaceActivity, tryAdmitWorkspaceActivity } from '../../../../shared/worktrees/activity-gate.mjs';
+import { admitWorkspaceActivity, tryAdmitWorkspaceActivityAsync } from '../../../../shared/worktrees/activity-gate.mjs';
 import { worktreeError } from '../../../../shared/worktrees/contract.mjs';
+import { bothReleased } from '../builtin/lib/shell-job-records.mjs';
 import { capturePreKill, registerForegroundOwnedTree, treeKillForceSettle } from './shell-run-state.mjs';
 import { releaseAdmissionOnConfirmedTermination } from './shell-run-settle.mjs';
 import { killAfterSnapshot } from './shell-descendants.mjs';
@@ -135,6 +136,8 @@ async function gatedSpawn({
         command,
         ownerSessionId,
         clientHostPid,
+        // Windows: the whole tree stays in the command's job (native-spawn-client).
+        contain: true,
         ...(stdinPipe ? { stdinPipe: true } : {}),
         ...(capture
           ? {
@@ -223,20 +226,25 @@ async function spawnAdmittedShellChild({
     }));
   run.child = spawned.child;
   registerForegroundOwnedTree(run, ownerSessionId);
+  // Attached before the admission below yields: until the caller attaches its
+  // listeners, the child's output is buffered and its close replayed.
+  spawned.attachErrorHandler(onChildError);
   const parentAdmission = run.workspaceAdmission;
-  const childAdmission = tryAdmitWorkspaceActivity(ownerSessionId || run.foregroundRecordId, cwd || process.cwd(), {
-    pid: Number(run.child.pid) || process.pid,
-    kind: 'command',
-  });
+  // The command's own lease (under its pid: what keeps the folder reserved
+  // should this runtime die). The parent's lease covers the folder until this
+  // one is written to both copies, and stays the only release until then.
+  const childAdmission = await tryAdmitWorkspaceActivityAsync(
+    ownerSessionId || run.foregroundRecordId,
+    cwd || process.cwd(),
+    {
+      pid: Number(run.child.pid) || process.pid,
+      kind: 'command',
+    }
+  );
   if (!childAdmission) throw worktreeError('WORKTREE_BUSY_JOBS', 'The command workspace changed during spawn.');
-  run.workspaceAdmission = () => {
-    childAdmission();
-    parentAdmission();
-  };
-  spawned.attachErrorHandler(onChildError);
-  // Feed the script only after the error handler is attached; server
-  // messages cannot be processed before this synchronous block yields.
-  // Single atomic write+EOF, as for the standby.
+  run.workspaceAdmission = () => bothReleased(childAdmission, parentAdmission);
+  // Feed the script only once its lease is written. Single atomic write+EOF,
+  // as for the standby.
   abortSignal?.throwIfAborted();
   if (standby) standby.feed(spawnCommand, cwd);
   else if (stdinScript !== null) spawned.child.writeStdin(stdinScript, { close: true });
@@ -249,18 +257,23 @@ async function spawnAdmittedShellChild({
     run.foregroundRecordTimer = null;
     if (run.settled || run.autoBackgrounded || !run.child?.pid) return;
     run.foregroundRecordPublished = true;
-    try {
-      publishForegroundShellRecord({
-        ...run.foregroundRecordInput,
-        jobId: run.foregroundRecordId,
-        pid: run.child.pid,
-        startedAtMs: run.commandStartedAtMs,
-      });
-    } catch (error) {
-      run.spawnError = error;
-      run.failureReason = 'workspace publication failed';
-      treeKillForceSettle(run, 'workspace-publication-failed');
-    }
+    void (async () => {
+      try {
+        await publishForegroundShellRecord({
+          ...run.foregroundRecordInput,
+          jobId: run.foregroundRecordId,
+          pid: run.child.pid,
+          startedAtMs: run.commandStartedAtMs,
+        });
+      } catch (error) {
+        // The record's lease could not be written: the command is stopped, as
+        // before — unless it ended or was promoted (its own leases) meanwhile.
+        if (run.settled || run.autoBackgrounded) return;
+        run.spawnError = error;
+        run.failureReason = 'workspace publication failed';
+        treeKillForceSettle(run, 'workspace-publication-failed');
+      }
+    })();
   }, FOREGROUND_RECORD_DELAY_MS);
   run.foregroundRecordTimer.unref?.();
 }
@@ -278,11 +291,16 @@ export async function spawnShellChild(input) {
     return await spawnAdmittedShellChild(input);
   } catch (error) {
     if (!input.run.child) {
-      input.run.workspaceAdmission();
+      const released = input.run.workspaceAdmission();
       input.run.workspaceAdmission = null;
+      // The spawn's own error is the one reported; a release fails only when
+      // workspace admission stopped (which keeps the folder held).
+      await Promise.resolve(released).catch(() => {});
     } else {
       try {
-        // Identities first: the kill may break the parent chain.
+        input.run.killed = true;
+        // Identities first: the kill may break the parent chain (a contained
+        // tree needs none: its kill is at once and verified by the server).
         // Bounded: the kill is sent even if the snapshot hangs or fails.
         await killAfterSnapshot(capturePreKill(input.run), () => killShellJob(input.run.foregroundRecordId));
         const detail = await waitForShellJob(input.run.foregroundRecordId);

package/src/runtime/agent/orchestrator/tools/lib/shell-run-state.mjs

@@ -6,13 +6,31 @@
 import { randomUUID } from 'node:crypto';
 import { publishForegroundShellRecord, retireForegroundShellRecord } from '../builtin/shell-jobs.mjs';
 import { ShellTextDecoder, TaskOutput, treeKill } from '../shell-exec-output.mjs';
-import { createProcessTreeTracker, killAfterSnapshot } from './shell-descendants.mjs';
+import { createContainedTreeTracker, createProcessTreeTracker } from './shell-descendants.mjs';
 import { registerOwnedShellTree } from './owned-shell-trees.mjs';
 
+/** The tracker of the run's process tree, created once. A killed tree the
+ *  spawn server contains is gone on its verified-empty report alone; every
+ *  other tree (no containment, or a root that exited on its own and left
+ *  survivors) is observed through the process table. */
+export function runTreeTracker(run) {
+  run.terminationTracker =
+    run.terminationTracker ||
+    (run.killed === true && run.child.contained === true
+      ? createContainedTreeTracker({
+          outcome: () => run.child.treeOutcome,
+          // Survivors the server kept in the job: the kill, by request id.
+          cancel: () => treeKill(run.child),
+        })
+      : createProcessTreeTracker({ pid: run.child.pid, rootCreationTime: run.child.creationTime }));
+  return run.terminationTracker;
+}
+
 /** One pre-kill identity read of the run's tree (every kill path shares it):
- *  resolves true once the capture is complete, false when it failed. */
+ *  resolves true once the capture is complete, false when it failed. A
+ *  contained kill needs none: true at once, so the kill is never delayed. */
 export function capturePreKill(run) {
-  run.terminationTracker = run.terminationTracker || createProcessTreeTracker({ pid: run.child.pid });
+  if (runTreeTracker(run).contained) return true;
   const rootExited = run.child.exitCode != null || run.child.signalCode != null;
   return run.terminationTracker.capture({ rootExited }).catch(() => false);
 }
@@ -32,6 +50,7 @@ export function registerForegroundOwnedTree(run, ownerSessionId) {
       run.killCause = run.killCause || 'session-close';
       // Always a fresh read: an earlier one predates what the run started
       // since. Pending, the kill is sent at the snapshot bound regardless.
+      // A contained tree answers true at once: its cancel is sent at once.
       return capturePreKill(run);
     },
   };
@@ -219,18 +238,23 @@ export function keepTerminationUnconfirmedRecord(run) {
 // Record the tree's identities while the root is still alive, THEN kill: once
 // an intermediate dies its children's parent links dangle and a snapshot taken
 // afterwards can no longer find them.
-// The kill waits for the snapshot at most PROCESS_TABLE_READ_BOUND_MS and is
-// sent whether the snapshot succeeded, failed or is still pending (a late
-// snapshot is still absorbed; a missing one leaves the outcome unknown, so the
-// workspace stays held under the observation loop). The confirmation deadline
-// starts once the kill is actually issued.
+// The kill waits until the snapshot succeeded or failed, never just for a
+// while: a read still in flight takes its table after a kill sent beside it,
+// finds the root gone, and the tree could never be confirmed terminated (the
+// workspace then stays held until a force-release). A healthy table read takes
+// seconds on a loaded host; a stuck one ends at its enumeration deadline
+// (ENUMERATION_DEADLINE_MS), and the kill is sent then, the outcome unknown.
+// A tree the spawn server contains is killed at once instead: its job holds
+// every descendant, and the server reports when that job is empty.
+// The confirmation deadline starts once the kill is actually issued.
 function snapshotThenKill(run, afterKill) {
-  if (!run.child?.pid) {
+  const snapshot = run.child?.pid ? capturePreKill(run) : true;
+  if (snapshot === true) {
     treeKill(run.child);
     afterKill();
     return;
   }
-  void killAfterSnapshot(capturePreKill(run), () => {
+  void snapshot.then(() => {
     treeKill(run.child);
     afterKill();
   });

package/src/runtime/agent/orchestrator/tools/lib/shell-warm-standby.mjs

@@ -102,6 +102,8 @@ function ensureWarmShellStandby({ shell, env }) {
         outputLimit: SHELL_OUTPUT_DISK_CAP,
         rawOutput: true,
         stdinPipe: true,
+        // The command it is fed runs contained, like a fresh spawn's.
+        contain: true,
         shellType: 'powershell',
         command: '(warm shell standby)',
       },

package/src/runtime/agent/orchestrator/tools/lib/wait-until-fixture.mjs

@@ -0,0 +1,26 @@
+// Test support: wait for a real condition on a wall-clock budget. A fixed
+// number of event-loop turns is load-dependent (async record writes and
+// process-table reads take more turns on a busy machine); elapsed time is not.
+// Polls on a short real timer (never a busy loop). The real setTimeout is
+// captured at load, before any test enables mock timers, so a mocked clock
+// cannot freeze the wait.
+import assert from 'node:assert/strict';
+
+const realSetTimeout = setTimeout;
+const POLL_MS = 5;
+const tick = () => new Promise((resolve) => realSetTimeout(resolve, POLL_MS));
+
+/** Resolves with the first truthy `read()` (sync or async); fails with `what`
+ *  once `timeoutMs` has passed without one. */
+export async function waitUntil(
+  read,
+  { timeoutMs = 10_000, what = String(read).replace(/\s+/g, ' ').slice(0, 160) } = {}
+) {
+  const deadline = Date.now() + timeoutMs;
+  for (;;) {
+    const value = await read();
+    if (value) return value;
+    if (Date.now() >= deadline) assert.fail(`condition not reached within ${timeoutMs}ms: ${what}`);
+    await tick();
+  }
+}

package/src/runtime/agent/orchestrator/tools/shell-command.mjs

@@ -432,7 +432,7 @@ function attachChildExit(run, releasePromotedCapture) {
   // child termination regardless — give 'close' a 3 s grace then
   // settle anyway. The grace outlives the spawn server's own 2 s drain
   // deadline, so the real exit status normally still arrives first.
-  child.once('exit', (code, signal) => {
+  const onExit = (code, signal) => {
     if (!run.rootExitAtMs) run.rootExitAtMs = Date.now();
     const grace = setTimeout(() => {
       if (run.settled || run.promotionClose) return;
@@ -449,7 +449,12 @@ function attachChildExit(run, releasePromotedCapture) {
       run.settle(code == null ? 1 : code, signal);
     }, 3000);
     if (grace.unref) grace.unref();
-  });
+  };
+  // The spawn awaits the command's workspace lease before these listeners
+  // exist; a root that exited meanwhile ('close' is replayed, 'exit' is not)
+  // starts its grace now.
+  if (child.exitCode != null || child.signalCode != null) onExit(child.exitCode, child.signalCode);
+  else child.once('exit', onExit);
 }
 
 // Live-progress heartbeat: every 2 s while the foreground command runs, emit

package/src/runtime/agent/orchestrator/tools/spawn-manifest.json

@@ -1,30 +1,30 @@
 {
-  "version": "0.1.11",
+  "version": "0.1.12",
   "_comment": "Synced from immutable spawn-v release assets.",
   "assets": {
     "darwin-arm64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/spawn-v0.1.11/mixdog-spawn-darwin-arm64",
-      "sha256": "6f1a7e6597dcc8785d12c5a13c42388110d9f4a2e5378ca2773172adbf50de60"
+      "url": "https://github.com/tribgames/mixdog/releases/download/spawn-v0.1.12/mixdog-spawn-darwin-arm64",
+      "sha256": "bc2307b1c089e07f829a8a1daf4dfdfc128e3221d8f70609ffbdcc3f8b596806"
     },
     "darwin-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/spawn-v0.1.11/mixdog-spawn-darwin-x64",
-      "sha256": "ff755eb9848cb3ce90f3df24136bb84a52f9ff6c67002c4d764beb6d7906e6b2"
+      "url": "https://github.com/tribgames/mixdog/releases/download/spawn-v0.1.12/mixdog-spawn-darwin-x64",
+      "sha256": "4b1d221a29128046c417cfae5617e2898e1b7bc564dca686b2608b6cb14bf3af"
     },
     "linux-arm64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/spawn-v0.1.11/mixdog-spawn-linux-arm64",
-      "sha256": "3bc0fccde46537046d498a2b953aa92ef4afacc95c96c563ce1d6fb92d74e593"
+      "url": "https://github.com/tribgames/mixdog/releases/download/spawn-v0.1.12/mixdog-spawn-linux-arm64",
+      "sha256": "2f577f54693726db0d285a16c3af2ad25b73fd705fd2fd4ac5c18ce795f657a9"
     },
     "linux-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/spawn-v0.1.11/mixdog-spawn-linux-x64",
-      "sha256": "16dc4e3bf6636335c1325c88bbb5245529731525953466e761d363897b59aac7"
+      "url": "https://github.com/tribgames/mixdog/releases/download/spawn-v0.1.12/mixdog-spawn-linux-x64",
+      "sha256": "83b52edfe2b810d5cf6544b03ab263eedcf7b2ef3c73107a45a33f6f7871e59e"
     },
     "win32-arm64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/spawn-v0.1.11/mixdog-spawn-win32-arm64.exe",
-      "sha256": "c2fb5499d3d44405e27c79f8db65694299d61ddf029f466df68549fc2f2c5f5c"
+      "url": "https://github.com/tribgames/mixdog/releases/download/spawn-v0.1.12/mixdog-spawn-win32-arm64.exe",
+      "sha256": "33872113fc0ca3cd2a2f6cf36c33430431388a5e36f254c8a0c6a44932057009"
     },
     "win32-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/spawn-v0.1.11/mixdog-spawn-win32-x64.exe",
-      "sha256": "50531a9f033dc22eff3ec5b2a9d10441ffdfac0e50d9acf9047e4f302e5d70d9"
+      "url": "https://github.com/tribgames/mixdog/releases/download/spawn-v0.1.12/mixdog-spawn-win32-x64.exe",
+      "sha256": "0070823fa03a50819077d60a407f4f8e26becafe3541ecdfabe522fc5e05a8cb"
     }
   }
 }