[Bug] Windows ACP shutdown can leave descendants running or silently accept cleanup failure

[slashdevcorpse]

Affected area

Agent runtime / ACP

Installation method

Built from source

Lody version or commit

12f919b

Operating system

Windows x64; deterministic Windows-platform unit fixtures, with POSIX regression coverage.

Agent or runtime

Lody auxiliary ACP processes and session sandbox process handles; provider-independent shutdown code.

What happened?

Source inspection found that auxiliary ACP shutdown calls ChildProcess.kill on Windows, which only targets the wrapper. The fallback session sandbox invokes taskkill /T but treats any helper close code as success and has no deadline. Session.killAndWait waits indefinitely after forced termination and recognizes exitCode but not signalCode; Session.terminate also swallows sandbox errors before reporting terminated.

These are reproducible lifecycle defects. They do not establish a native Codex memory leak or prove that completed native subagents retain MCP servers.

What did you expect?

For a still-live owned Windows root, await bounded recursive termination, validate helper success, observe root exit, and surface cleanup failure. Recognize signal-only exits. Never use an exited root's cached PID to authorize killing another process.

How can we reproduce it?

1. In a Windows-platform auxiliary ACP fixture, provide a live wrapper and invoke cleanup; observe direct child.kill without recursive taskkill.
2. In the fallback sandbox fixture, make taskkill emit close with code 1; termination currently resolves.
3. Give Session a process handle whose force termination resolves but which never exits; advance a fake clock beyond five seconds and observe that shutdown remains pending.
4. Make sandbox termination reject; observe that Session still emits terminated.

The accompanying patch adds deterministic regression tests for these boundaries.

How often does it happen?

Every time with the specified fixtures.

Additional context

Scope is normal explicit shutdown of live owned roots. Unexpected wrapper exit and native provider subagent cleanup need durable descendant ownership (for example Windows Job Objects); taskkill success alone does not prove the entire tree is empty. No global process scans or image-name killing are proposed.

Before submitting

• I searched the existing issues and did not find a duplicate.
• This report concerns an open-source component in this repository, not a hosted service, Web or mobile app, account, or billing issue.
• This is not a security vulnerability; security reports follow the repository's security policy.
• I removed credentials, private source, conversations, prompts, personal data, and other sensitive information.

Implementation: upstream PR series

The implementation is submitted to LodyAI/Lody in dependency order:

1. [1/3] fix: bound Windows ACP shutdown and retain failed cleanup #456 — bounded shutdown and retained cleanup ownership.
2. [2/3] fix: protect background sessions and record resource history #457 — background-aware eviction and resource history; depends on [1/3] fix: bound Windows ACP shutdown and retain failed cleanup #456.
3. [3/3] fix: own Windows process trees with native job supervision #458 — native Windows Job Object ownership; depends on [1/3] fix: bound Windows ACP shutdown and retain failed cleanup #456 and [2/3] fix: protect background sessions and record resource history #457.

These replace the fork-only PRs and the earlier closed #430/#435 submissions. Source branches retain linear ancestry; later PRs have cumulative upstream diffs, with individual-layer comparisons in their descriptions. GitHub native cross-fork stack metadata is unavailable. The complete series supplies the Windows descendant/crash ownership fix. Nothing has merged; this issue remains open.

[slashdevcorpse]

Native GitHub stack #5 in slashdevcorpse/Lody, created with gh stack link:

1. [1/3] fix: bound Windows ACP shutdown and retain failed cleanup slashdevcorpse/Lody#2 — bounded shutdown and retained cleanup ownership; base main.
2. [2/3] fix: protect background sessions and record resource history slashdevcorpse/Lody#3 — background-aware eviction and bounded resource history; base fix/windows-process-tree-cleanup.
3. [3/3] fix: own Windows process trees with native job supervision slashdevcorpse/Lody#4 — native Windows Job Object ownership; base fix/background-session-resource-history.

Replaces the closed cross-fork #430 and #435. Each PR has an incremental diff against its predecessor. GitHub native stacks require all branches in the same repository, so this stack is in the contributor fork. It has not merged or landed upstream; #429 remains open.

[slashdevcorpse]

Bot-review fixes are committed and pushed to the existing native stack:

• [1/3] fix: bound Windows ACP shutdown and retain failed cleanup slashdevcorpse/Lody#2 at 720e84c: retained-handle cleanup, bounded shutdown, failed-owner retention, terminal/request admission, and independent fleet teardown. The latest eight review findings also cover pending terminal opens, authentication cleanup races, startup owner replacement, failed Windows spawn handling, explicit termination semantics and retry assertions.
• [2/3] fix: protect background sessions and record resource history slashdevcorpse/Lody#3 at f291ca2: canonical scheduled-work protection, strict resource history and precise Windows identity; GC admission spans document teardown, with failed-unload retry and safe reopening.
• [3/3] fix: own Windows process trees with native job supervision slashdevcorpse/Lody#4 at 8a53cfd: private Job Object descendant ownership composes with retained-handle cleanup. Native build/watch/test gating and a same-run dual-architecture npm-package CI consumer are implemented.

All currently outstanding review threads have evidence-backed replies and are resolved. The latest bottom-PR automated review is still running, so this is not yet its final result. Latest local verification: 156 bottom-branch lifecycle tests; 124 composed-stack tests plus five native launcher integrations; 16 native ownership/packaging tests. The composed integration pins five original OS handles and verifies every synthetic owned process exits. The earlier 223-test GC/lifecycle run, production build and dual-architecture npm archive checks also passed.

Previous heads passed all CI, including x64, ARM64 and the same-run npm archive consumer. Current-head CI and Desktop E2E passed on all three PRs. The top head also passed x64, ARM64 and the same-run npm archive job, including prepack and archive verification of both executables plus the launcher.

Landing dependency: ship the complete three-PR stack for the Windows tree fix. The first PR supplies safe root termination; the third supplies required descendant/crash ownership. Nothing has merged or landed upstream, and real-provider memory recovery remains outside the synthetic-process evidence.