Do not collapse four process identitiesA third-party program, official DSH Host, community desktop main process, and renderer can fail independently. “The window closed” is not root-cause evidence.

Route the first terminal fact.

Ordinary runtime exitResolve the command outcome

Preserve exit code or signal after close and bounded pipe drainage.

Spawn-level failureReject one tool call

Contain ENOENT, abort, kill, and stream failures at the owning process seam.

rc.2 already defines the core boundary.

spawnasync
→
exitfact
→
closepipes
→
doneonce
→
healthalive

Diagnose nested Windows children.

Child still alive

Capture CPU, process-tree, child start/exit, and pipe progress. This is not a close-delay diagnosis yet.

Exit without close

A descendant may hold an inherited pipe. Timestamp both events and vary stdio only in a disposable probe.

PowerShell works

Treat it as an executor-topology comparison, not proof that a shell is the general fix.

alpha.1 is not a proven fix for report #4796 The relevant spawn boundary is unchanged and the grandchild process-group test is POSIX-only. A Windows fixture must prove done settlement, output preservation, cancellation, tree exit, and no orphans.

Repair locally, exit globally.

Own EPIPE

Stop stdin writes and keep the authoritative child outcome.

Bound every stream

Consume, cap, spill, close, and record truncation explicitly.

Do not limp on

A global unknown exception is a cleanup and supervised-restart boundary.

Six proof gates.

Primary evidence.

Prove survival beyond the visible window.

The canonical guide covers synchronous freezes, Windows self-termination, official versus community ownership, raw stream handling, global exception policy, safe reproduction, and twenty acceptance gates.

Read the complete guide