fix(windows): stop killing orphan workers behind reused parent PIDs (0.7.2)

[keli-wen]

Problem

Every Windows CI run since process-tree cleanup landed in #18 had roughly a 50% chance of failing, each time on a different test (a9887f1: dx.test staffer prompt; 07aaca0: recovery-regressions hard expiry; PR runs: hard stop escalates, group membership, continue --job, npm archive, ...). PRs were merged after their last run happened to be green; master gets one roll of the dice.

The common signature: a detached worker vanishes with no status file and a log of exactly 178 bytes (the two startup lines and nothing else), so wait reports crashed (exit 3). No internal error path can produce that: the top-level catch always writes agy-staff error: to the log. Only TerminateProcess from outside does.

Root cause

On Windows a detached worker keeps its exited dispatcher's PID in ParentProcessId. Windows reuses PIDs quickly, and with three test files running in parallel one of them soon spawns an agy process that receives that PID. When that job finishes, two independent tree walks both take our worker for its descendant and kill it:

1. tree() in companion/stream-worker.mjs follows parent links with no check that the child is younger than the parent.
2. taskkill /PID <root> /T /F does its own walk over the same stale ParentProcessId links.

Neither happened before #18 (Windows never walked process trees at all), which is why six earlier master builds were green. Diagnosis and fix design were independently reviewed by an agy review job (verdict: confirmed; it found the second, taskkill /T, path).

Fix

• tree() follows a parent link only when child.born >= parent.born. A process cannot be older than its parent; a row born before its recorded parent is an orphan behind a reused PID. This is sound: the reuser can only be born after the dispatcher exited, and the worker was born before that.
• PowerShell reports CreationDate via ToString('o') so the comparison has 100 ns precision; the default locale rendering is second-granular and would miss a reuse within the same second. parseBorn puts ISO-8601, WMIC and legacy stamps on one BigInt tick scale.
• taskkill runs without /T on Windows. Descendants are terminated one by one after passing the identity and birth-order checks, as stopExecution already did for the JS-side members.
• stopExecution never signals its own PID and takes an injectable table source.
• Docs updated (docs/REFERENCE.md, zh-CN).

Tests

• Real-process regression test: a real detached orphan, a real root with a real child, real signals. The only synthetic element is one ParentProcessId in the table, because no kernel lets a test choose the next PID it hands out (and POSIX reparents orphans to init). With the birth-order check disabled the test fails; with it, the root and its child are stopped and the orphan survives.
• Unit tests for parseBorn (ISO with offsets, WMIC, legacy), tree() stale-link pruning, the round-trip PowerShell query and the new taskkill arguments.
• Local suite: 194/194 on macOS. The Windows job will be run several times on this branch to measure the pass rate instead of relying on one green run.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RKgBCYMWQru5SawpfCLxFY

[keli-wen]

Windows pass-rate measurement on this branch (each run approved through the manual-tests gate):

Commit	Runs	Tests (Windows)	Note
fa0522e	4 (1 pull_request + 3 workflow_dispatch)	0 pass / 4 fail	every failure was the new real-process test's exact-tree assertion (Windows adds conhost.exe helpers under the root); all pre-existing tests passed in all 4 runs
f2400ee	4 (1 pull_request + 3 workflow_dispatch)	4 pass / 4 pass	membership assertion; 194 tests, ~4 min per run

Across the 8 runs the original signature (a worker vanishing with a 178-byte log and crashed) did not occur once. On master since #18 it hit roughly every second run.