pidAliveProbe uses Signal(0) — reports every live process as dead on Windows, so watchreg sweep drops all live watcher entries

[cajasmota]

Summary

pidAliveProbe in internal/daemon/reaper.go:374-383 hand-rolls a liveness check
using p.Signal(syscall.Signal(0)). On Windows, os.Process.signal returns
syscall.EWINDOWS for any signal other than Kill
($GOROOT/src/os/exec_windows.go), so the probe reports false for every process
— including healthy, running ones.

Consequence: on Windows the watcher registry sweep
(Reaper.sweepWatchers -> watchreg.Sweep) classifies every live grafel watch
process as dead and drops its registry entry. The daemon then loses track of
watchers it is actually running.

Why it wasn't caught

internal/daemon is excluded from the always-on windows.yml tripwire, and the
full 3-OS matrix in .github/workflows/test.yml only runs on version tags and the
ci:full label — so this path is effectively untested on Windows in normal CI.

The repo already has the right primitive

internal/process provides a platform-correct implementation that is already used
elsewhere (internal/daemon/pidfile.go:188):

• internal/process/isalive_windows.go:24
• internal/process/isalive_unix.go:18

pidAliveProbe should delegate to process.IsAlive rather than reimplementing the
unix-only Signal(0) idiom.

Suggested fix

Replace the body of pidAliveProbe with a call to process.IsAlive, and add a
watchreg-sweep test that runs on Windows (using the existing portable
spawnLiveChild helper at internal/daemon/pidfile_test.go:141-162, which already
branches cmd /C ping -n 31 vs sleep 30) asserting a live watcher entry is
retained.

Provenance

Found during the independent adversarial review of the #5933 fix. It is
pre-existing and out of scope for that PR, but it sits in the same call path:
it is why a naive liveness-based test added in #5933 would fail on Windows.

Relevant to the v0.1.9 release gate, which requires green CI on macOS + Linux +
Windows.

Related

• Split-mode reaper kills every watcher forever: LiveDaemonPID defaults to engine os.Getpid but watchers stamp daemon.pid → 5-min reindex treadmill #5933 (split-mode reaper orphan-PID mismatch — same call path)
• Daemon-owned reaping of stale 'archigraph watch' PIDs (follow-up to #5140) #5142 (watcher PID registry), daemon: spawn watch subprocesses via own binary path + reap orphaned/stale-version watchers #5632 (foreign-watcher sweep)

[cajasmota]

Fixed in 9fae0967b (#6058). pidAliveProbe is deleted; the reaper now uses process.IsAlive (reaper.go:316), the same probe as the six other call sites.

Worth recording what this was costing: because watchreg.Sweep checks !deps.Alive before the ownership comparison and continues, every registered watcher was classified Dead on Windows — so #5933's entire fail-closed orphan contract was unreachable dead code there, and every 5-minute sweep wiped the watcher inventory.

A source-level guard (TestNoPrivateSignalZeroLivenessProbe) now walks internal/ and fails if a signal-0 liveness probe reappears, exempting only internal/process itself.

One disclosed behaviour change on unix: the old probe treated EPERM as dead, process.IsAlive treats it as alive. That is the more defensible fail-closed direction and matches every other call site; documented in reaper_eperm_unix_test.go.