Route by the process that owns creation.
Apply to Node spawn and taskkill teardown while preserving pipes and cancellation.
Combine STARTF_USESHOWWINDOW with SW_HIDE in both restricted-token spawn variants.
rc.8 records 0xC0000142 failures for restricted-token children.
Four probes reveal the owner.
Capture stdout and stderr.
Exclude a pwsh-only issue.
Exercise the restricted-token path.
Separate GUI-parent behavior.
-WindowStyle Hidden is not a general repair.It is PowerShell-specific, can apply after creation, and cannot cover Node, Git, or the sandbox's process-creation contract.
A hidden window is only one gate.
No flash at start or teardown.
stdin, stdout, stderr, and exit remain correct.
Timeout, cancel, and tree kill still work.
Sandbox allow and deny behavior is unchanged.
Primary evidence.
- Official report and two-path investigation #3460
- rc.8 local subprocess creator
- rc.8 ACL sandbox creator
- Restricted-token ABI boundary
Keep the complete Windows runbook.
The canonical guide includes process-tree evidence, bounded operator options, unsafe shortcuts, two source repair contracts, eleven acceptance gates, and an incident record.
Read the complete runbook