Problem
PR #880 detaches Windows stack processes with native CreateProcess, closes the returned process handle, and retains only the PID. Later down and cleanup paths signal that bare PID.
Windows reuses PIDs. Once the original process exits, a later signal can target an unrelated process that inherited the same PID. The current pure smoke injects signal functions and does not exercise native process creation, handle lifetime, PID reuse, or the default process.kill boundary, so it cannot prove target identity.
Required design
Before detached-by-default stack lifecycle can land on Windows, Cotal needs one stable identity scheme across launch, pidfile state, status, and teardown. Acceptable shapes include:
- retaining a process capability in a supervisor that outlives the invoking CLI; or
- recording a creation identity and using an atomic open, verify, terminate operation that refuses PID reuse.
The design must define loud behavior for legacy PID-only records and for a target whose identity cannot be established.
Acceptance
- A stale PID record whose PID now belongs to another process is refused and never signalled.
- The native
CreateProcess path, detached parent exit, identity persistence, reopen, and termination are exercised on Windows.
- Manager, delivery, auth, and broker teardown use the same identity rule.
- Cleanup failures preserve the record and name the reason.
- Mutation proof removes or weakens the identity check and reddens named cells.
Context
This is the blocking prerequisite found while integrating PR #880 against current main. No current-main successor was created because preserving a known bare-PID teardown path would be unsafe.
Problem
PR #880 detaches Windows stack processes with native
CreateProcess, closes the returned process handle, and retains only the PID. Laterdownand cleanup paths signal that bare PID.Windows reuses PIDs. Once the original process exits, a later signal can target an unrelated process that inherited the same PID. The current pure smoke injects signal functions and does not exercise native process creation, handle lifetime, PID reuse, or the default
process.killboundary, so it cannot prove target identity.Required design
Before detached-by-default stack lifecycle can land on Windows, Cotal needs one stable identity scheme across launch, pidfile state, status, and teardown. Acceptable shapes include:
The design must define loud behavior for legacy PID-only records and for a target whose identity cannot be established.
Acceptance
CreateProcesspath, detached parent exit, identity persistence, reopen, and termination are exercised on Windows.Context
This is the blocking prerequisite found while integrating PR #880 against current main. No current-main successor was created because preserving a known bare-PID teardown path would be unsafe.