fix: distinguish exited Linux zombies from live owners

[luokerenx4]

Problem and resulting behavior

Lifecycle grouping #1677 exposed real descendant shutdown failures on Linux containers without a reaping init. Positive kill(pid, 0) includes exited zombies, but a zombie thread-group leader can also retain executing workers. Independent review additionally showed that a regex could backtrack into a legal comm (worker) Z 1 x) and treat an actual live S state as dead.

The positive signal probe now parses procfs fields only after comm's final ). It excludes only state=Z with num_threads=1. Linux retains the zombie leader in this count: a live worker makes it at least two; at the one-thread snapshot the sole remaining task is already exited and cannot create another worker. Multiple, missing or invalid counts stay live. No empty/unreadable/racing task-directory scan grants exit: no task scan is used. Permission failures remain live; ESRCH and invalid-PID/range errors remain absent. Signal order, saved descendant PIDs and shutdown budgets are unchanged.

Reviewable evidence

• Real Node wrappers and detached descendants use the legal adversarial process name, confirmed from actual procfs. IPC readiness precedes signaling. Graceful and POSIX TERM-ignoring branches preserve actual cleanup, including the retained descendant receiving KILL after wrapper exit. Windows retains original taskkill/absent-child semantics, without POSIX handler expectations.
• Independent Guardian/headless cleanup oracles require absent PID or both zombie state and exactly one remaining thread. A leader-only Z assertion cannot mask a live worker. Headless interruption and partial-output assertions remain.
• Two new synthetic regressions fail against previous head 8676b8c6: adversarial live names and zombie leaders with workers/unknown counts. Both require live roots still reaching TERM/KILL and reporting survivors. Existing positive states, procfs/permission errors and invalid PIDs remain covered.
• Optional isolated C pthread diagnostic: leader Z, count 2, worker S, output continues after TERM. Old controller returned false; corrected controller stays true, executes TERM then KILL, and the managed parent reaps the subprocess in finally. cc -pthread is a local diagnostic only, not a cross-platform test dependency. Source/logs are preserved with the local validation evidence.
• Owner guide and canonical grouping plan explain the name parser, conservative thread-group proof and residual native/reaping limits. No timeout increase, cleanup skipping or unrelated refactor.

Validation

• Guardian package: 10 files/71 passed (2.61s); Guardian/root typechecks passed.
• Scoped Guardian six mapped paths plus headless: 7 files/84 passed (6.49s). Strengthened independent cleanup oracles: 2 files/29 passed (6.35s). Whole critical gate passed 18/all required references with accepted receipt; never narrowed.
• Real pnpm test:system:guardian passed healthy conflict/graceful takeover, crashed-lock recovery and stubborn forced takeover, including actual pnpm dev conflict path.
• Two adversarial regressions alone on prior head plus new spec: 2 failed, 10 excluded; this is a diagnostic baseline, not acceptance. Corrected package passes all 71 cases. Native pthread diagnostic confirms TERM survival and required SIGKILL with complete reaping.
• Earlier complete hermetic backstop: 877 files passed/4 failed/1 skipped; 7498 tests passed/24 failed/5 skipped, 444.75s. Remaining files: Desktop smoke group liveness (1), installer umask fixture (1), Supervisor PTY fixture/output failures (21), and Supervisor mock (1, independently fixed in test: map bounded startup and lifecycle evidence #1677). Writable npm cache resolves packaging; no blanket host attribution for PTY failures. No repeated whole-repository suite for these bounded parser/thread regressions.
• Prior combined test: map bounded startup and lifecycle evidence #1677/fix: distinguish exited Linux zombies from live owners #1678 source selections passed. Current new process regressions are validated in the scoped/package/system gates above; native Windows/macOS/Bun/Electron, installed launchers, independent ports/locks and external-init PID-entry reaping remain unverified.

The original review validation is recorded below; subsequent integration and authorized merge are recorded at the end.

Final-head CI after independent review

Head eca2c0c16bb2e521158bf01d34ffc8fcca3a6fab: Dev PR Clean Build 36777830189 completed successfully, including workflow contracts, whole critical gate, receipt upload and complete workspace build. Receipt artifact ID 11127055678 is associated with this exact head. The earlier full-suite and native/platform limitations remain explicit. No release.

Authorized integration and merge

After #1677 merged as a8d2850152481f108ee76bef76ca753270382898, dev merged cleanly into this feature with no documentation conflict. Integration head 2fd161147f58cc5b36fdbd74ce44b4c654b2db7d passed workflow contracts (12 files/108), startup + desktop selections (11 files/157), Guardian selection (6 files/67), and the whole critical gate (18 required tests). Exact-head Dev PR Clean Build 36797510698 succeeded, including complete workspace build and critical-local-receipt artifact 11133814770 tied to that exact SHA.

With explicit maintainer merge authorization, normal merge used the expected-head SHA guard and produced 0a10220d7c918f7f6b6590fff0135c6d6b45d587. Fetched dev confirms both parents and the same tested source tree. No bypass, force push, or release. PTY, installer fixture and independent Desktop smoke failures remain separate diagnosis work; this merge does not claim their acceptance.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
openalice-demo	Ready	Preview	Oct 1, 2026 12:42am UTC