test: diagnose null Windows process identities after quarantine failure

[BunsDev]

A null WTS process SID caused terminal quarantine to fail in #201, but the failure report could not distinguish a vanished process from an unreadable live token. Add a test-only observation to the ordinary Windows suite: one query/synchronize handle, at most two zero-time waits and one token query, fixed result labels/codes, and guaranteed handle cleanup. No SID is emitted and the original failure remains fatal.

Preserve nested exceptions instead of flattening them into text. Traverse aggregate siblings within twelve total exceptions and share one probe budget, so combined producer/quarantine failures reach the reporter. Managed tests cover diagnostic states, exception cleanup, traversal and bounds; a native self-process fixture proves the real reporting path.

Production supervisor, protected workflow and frozen authority lock are unchanged. Observations describe the newly opened handle and cannot prove continuity or PID reuse relative to the earlier WTS row. Tracks #206; this diagnostic does not close it.

Validation: typecheck, lint, production build and independent review passed. Normal suites covered 598 passing cases after focused reruns: the changed wrapper assertion was updated, and an unchanged schema fixture passed retry after a five-second timeout under host load. Heavy suite: 569 passed / 35 skipped. Standalone PowerShell diagnostic/reporter tests, parser, metadata and whitespace checks passed. Native Windows CI remains required before merge.

Preserve chat and active worktrees.

Current validation head: fe41e3f07cfe2e95908622d520c8533e2fb30597. The unexpected-query fixture now owns its arguments, delegates and counters independently of matrix order; standalone PowerShell tests and lint passed. Full CI 34462291567 is active with ci:full, including Rust/native Windows dependencies. No merge or native acceptance claimed yet.

Terminal native validation

Full CI run 34462291567 passed all ten jobs at fe41e3f07cfe2e95908622d520c8533e2fb30597. Windows job 102824997157 explicitly reports Bounded null-SID diagnostic cases passed. Packaged conformance also passed. The automated fixture finding is addressed by the independent unexpected-failure delegates in this head. GitHub review-thread resolution remains pending; this diagnostic change does not establish the cause of #206 or change production supervisor acceptance.

[Copilot]

🟡 Changes recommended

The new PowerShell diagnostic test has a hidden dependency on loop-captured state that makes one post-loop assertion brittle and order-dependent.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR enhances Windows terminal-quarantine failure diagnostics in the conformance suite by adding a bounded, test-only “null WTS SID” observation and improving exception-chain reporting so the underlying causes are visible without changing pass/fail behavior.

Changes:

• Add a test-only Windows process SID observation probe with strict call/handle-cleanup bounds and fixed outcome labels/codes.
• Update the Windows failure reporter to traverse aggregate exception siblings within a 12-exception bound and emit a single observation line when the known WTS-null-SID message appears.
• Preserve nested exceptions (instead of flattening to text) for terminal-producer failures, and document/hash the new diagnostic artifacts.

File summaries

File	Description
src/client-v1-conformance-workflow.test.ts	Updates expected failure-source string to match the new producer-attempt exception wrapping.
scripts/windows-process-sid-diagnostics.test.ps1	Adds PowerShell tests for the bounded observation states, call limits, and handle cleanup behavior, plus reporter traversal checks.
scripts/windows-process-sid-diagnostics.cs	Introduces the bounded, test-only process-handle observation helper returning fixed diagnostic labels/codes.
scripts/windows-job-supervisor.test.ps1	Extends failure reporting to traverse aggregate siblings, emits the bounded observation once, and preserves nested exceptions for producer-attempt failures.
docs/phase1-conformance.md	Documents the new bounded observation behavior and adds file hash entries for new/updated diagnostic scripts.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.