Fix registered replay descendant cleanup on command exit

[yssite]

Change and mathematical scope

Registered replay currently cleans up child solvers only after a timeout. If a command leader exits normally or with an error, its descendants can keep running and modify outputs after run_command has returned. A ready-child fixture on the pinned baseline reproduced a post-return write for both exit 0 and exit 7.

Move cleanup into finally: on POSIX, signal the owned process group after success, failure, timeout or interruption, tolerate an already-finished group, and reap the leader. Preserve the leader's exit status, timeout failure, assertion-enabled child environment, explicit optimization options and all verification commands/source checks. Extend PR1484's real parent/child/grandchild fixture to cover the new boundaries and document the lifecycle contract.

This is verification engineering, not a mathematical result or performance improvement. The selected conditional κ remains 0.001672660197076918. Verification commands still must join their proof-relevant children and propagate their errors; terminating an unfinished solver does not certify its result. Detached sessions/groups are outside scope. Windows keeps tree cleanup while the leader is alive; this does not solve native Windows cleanup after leader exit.

Task and overlap

Canonical base and final refreshed main: 0fdd7d82de03e43c9e5a1000dfbcd380d1b687d2, priority revision 4. Explicit card portable-replay, scope key 831cc1a3c8f9ff01b197; scope changed from cross-environment/payload comparison to a reproducible replay lifetime defect. This protects bounded verification and output stability without changing mathematical coverage. Selection was restricted and deliberate, not a uniform random assignment.

The three candidates were: selected native BIT reserve coefficient (already covered by #2084/#2120), emitted owner-map binding (already audited in #2301 and repaired by #2355), and this process-lifetime boundary. The last had a concrete small failing experiment and no equivalent repair in the reviewed live evidence. The helper's nonce was not used as a novelty or test-randomness claim.

Nearest predecessor: Paul Romeo's #1484, head 225cc15f88732ef86f48b75e34a9422bcb664993, tests timeout cleanup with a live leader. This adds the distinct already-exited leader and interrupted-wait cases. #1298, head e76026571dbfa7299bf474b941c9abeb5bd556b3, supplied related portability work. No pending predecessor code is imported. Both are merged.

The exact original implementation and tests are identified by the base above: scripts/research_package.py and tests/test_research_process_tree.py. Only these two files and the package guide change. A bounded fresh overlap search covered 572 open PRs (including drafts), 1084 Discussion/comment/reply records and 1536 local notes/ledger records with complete pagination and no warnings; arbitrary diffs are outside that search. A single coordination-claim attempt in discussion #1472 was rejected by the integration, so no public claim was posted.

Validation

Linux x86_64, CPython 3.12.14, repository code executed without inherited credentials:

python3 -B scripts/research_baseline.py
python3 -B -m unittest discover -s tests -p 'test_research_*.py' -v
python3 -O -B -m unittest discover -s tests -p 'test_research_*.py' -v
python3 -B tests/test_research_process_tree.py -v
python3 -O -B tests/test_research_process_tree.py -v
git diff --check HEAD^

• Baseline: PASS_RESEARCH_BASELINE_BINDINGS_ONLY.
• All 69 affected tests pass in each mode, with no skips. The seven process-tree tests also pass in each mode from a Git-free export of the committed files in a path containing spaces.
• The new success/error/interruption tests run against the original pinned function produce three expected failures, each detecting live descendants. Fixture teardown stops them.
• Deliberately replacing group cleanup with leader-only cleanup is detected for timeout and for both leader exit codes. Ordinary fully joined completion remains a positive control.
• The same two post-return-write fixtures change from 2/2 writes before to 0/2 after; exit 7 still reports the original command failure.
• Working tree and final diff are clean; no mathematical source or selected certificate changes.

No unexpected test failure remains. Full supplier/cold/historical package replays, native Windows/macOS execution, proof-assistant builds and hosted CI were not run locally. Since this changes shared replay controls, the existing CI planner may select all registered packages; no invalidation rule is weakened.

Credit

Credit Douglas Colkitt and retained contributors for the replay launcher, and Paul Romeo for PR1484's process-tree tests and earlier portability work. Prepared for yssite with substantial OpenAI Codex assistance in investigation, implementation, verification and writing. No independent human review is claimed. Apache-2.0; existing attribution remains intact.

Open next questions

Native Windows cleanup after leader exit needs a separate bounded investigation, likely a native lifetime primitive rather than a late taskkill call. First reproduce the same ready-child/early-exit cases on Windows; the blocker here is the absence of a native Windows validation environment. Deliberately detached descendants would require stronger containment, not a larger process-group claim. Neither extension is included in this fix.

[ywz65]

DONE - native Windows lifetime implementation and regression controls published:
#2469

Verified ywz65 public head 65080e406c9edb0e93daa631f90b3fa4e4461910. A gated kill-on-close Job Object owns ordinary command descendants across normal/error leader exit, timeout and interrupted wait. Independent review found and fixed pre-assignment Python startup hooks; only the gate uses -I -S, while the verifier keeps its environment and argv. Assignment failure never starts the command.

Eight native tests pass on CPython3.12.7 normal/optimized and3.14.5, with retained handles, parent-only cleanup mutants, an isolation-flag mutant and joined/environment controls. The exact original main function fails the ready-child exit0/7 observers. The full72-test research suite passed before the focused startup-hook correction (3Linux-only skips); all8final native tests pass. No hosted CI or full mathematical cold replay is claimed. Ordinary subprocess ownership only, not hostile-code containment or crash-atomic output. Commands must still join and validate their proof-relevant children.

Claim released. Credit and original in-progress update retained below. Prepared for ywz65 with substantial OpenAI Codex assistance; independent agent review, no human review claimed.

---

IN PROGRESS / LOCAL-ONLY - native Windows replay lifetime

Taking this PR's explicit Windows already-exited-leader handoff. Current canonical main/base remains 0fdd7d82de03e43c9e5a1000dfbcd380d1b687d2, priority revision4. Source PR2377 pinned at 5d444eee7dedd997c6094776fbb32ed19831e241; PR2452 only covered timeout with a live Windows leader.

A local gated Job Object implementation now passes seven native checks: exit0/7, timeout, interruption, joined success, a parent-only mutant, and failed assignment before command start. Native CPython3.12.7 normal/optimized and3.14.5 pass. The exact original main function fails both ready-child early-exit observers as expected. Independent review is next; no public artifact is yet claimed. This is ordinary subprocess ownership, not a hostile-code sandbox, mathematical certificate or new kappa. POSIX behavior is unchanged.

Recorded 2026-10-15T11:33:18.691737+00:00; this is an in-progress update after implementation, not a retroactive reservation. Prepared for ywz65 with substantial OpenAI Codex assistance. Credit yssite for this explicit handoff, Paul Romeo for earlier fixture work and Douglas Colkitt/retained contributors for the runner.