Follow-ups from the adversarial review of #74 (merged as-is; verdict was approve, no P0/P1).
P2 — grandchild kill is not runtime-proven. The force-kill case in ports/tauri/packaging/windows/tests/test-hardware-session-launcher.ps1 asserts only the direct child app PID disappears after $forcedLauncher.Kill(); the fake runtime's RunApp() spawns nothing, so the Job Object's descendant-kill (the engine grandchild) is unexercised. Residual risk is bounded (kernel job inheritance + the dual env/latch gate, and the guardian still removes the latch half), but a future regression adding CREATE_BREAKAWAY_FROM_JOB to the engine spawn would go undetected. Smallest fix: have the fake app spawn a fake engine child and assert its PID is absent after the forced kill. Note the PowerShell 5.1 suite is not run by CI (only the .sh twin is), so this needs authoring/validation on a real Windows host.
P3s (optional):
- Add one fully-clean-parent-env launch case to the PS suite (every current case runs with a polluted parent; production norm is clean).
scanstudio-hardware-session-latch.sh: use ${process_argument##*/} for the scanstudio_bridge.cli orphan match too, so path-qualified forms are covered.- Consider a longer/retried guardian-ready window than 10 s (cold machines can fail closed pre-arming; safe but flaky).
- ContactSheet not-enabled guidance names the Start-menu shortcut but not the portable
.cmd equivalent.
build-and-verify.ps1 preflight: also check for a lingering scanstudio-engine* process.- Latch helper: SIGKILL'd runs leave stale
.hw-motion-* temp files (hygiene only).
Follow-ups from the adversarial review of #74 (merged as-is; verdict was approve, no P0/P1).
P2 — grandchild kill is not runtime-proven. The force-kill case in
ports/tauri/packaging/windows/tests/test-hardware-session-launcher.ps1asserts only the direct child app PID disappears after$forcedLauncher.Kill(); the fake runtime'sRunApp()spawns nothing, so the Job Object's descendant-kill (the engine grandchild) is unexercised. Residual risk is bounded (kernel job inheritance + the dual env/latch gate, and the guardian still removes the latch half), but a future regression addingCREATE_BREAKAWAY_FROM_JOBto the engine spawn would go undetected. Smallest fix: have the fake app spawn a fake engine child and assert its PID is absent after the forced kill. Note the PowerShell 5.1 suite is not run by CI (only the.shtwin is), so this needs authoring/validation on a real Windows host.P3s (optional):
scanstudio-hardware-session-latch.sh: use${process_argument##*/}for thescanstudio_bridge.cliorphan match too, so path-qualified forms are covered..cmdequivalent.build-and-verify.ps1preflight: also check for a lingeringscanstudio-engine*process..hw-motion-*temp files (hygiene only).