[raiseCatError]

Review of #416 and #420 together. Stacked on #420; /track stays in v0.21, window-owned.

Findings and fixes

Safety gate (commands /track and /watch started at once and repeated without asking)

Command	Before	Now
echo x > ~/.zshrc 2>/dev/null	allowed (any >/dev/null excused every redirect; paste review said read-only)	refused; each redirect judged on its own target
ls >| out	asked (split as a pipe)	refused
env rm -rf …, env -i …, FOO=1 df, LD_PRELOAD=… df	allowed / asked	asks first (runs or changes another command)
npm publish, npm login, npm audit fix, npm x …, pnpm dlx …, bun x …	allowed	asks first
ssh host rm -rf x, curl -X POST, curl -d, curl -o file, plain wget, gopher://	allowed (unless a dotted remote host was spotted)	asks first
scp, rsync	allowed	refused (copies files; rsync -n asks)
git -c core.fsmonitor=… status, GIT_EXTERNAL_DIFF=… git diff, --ext-diff	allowed	asks first
git log --output=f, sort -o, find -fprint, tree -o, yq -i, jest -u, --fix, --write, --watch	allowed	refused
shutdown, reboot, halt, poweroff, systemctl reboot	asked	refused
npm test 2>&1	refused as a background job	allowed
ping 8.8.8.8, ping nas	local (2 s minimum)	remote (asks, 15 s minimum)

Read-only probes still start at once: ping/dig/nslookup/host/traceroute, nc -z, a curl GET/HEAD to stdout or -o /dev/null, wget -O -/--spider, npm view/outdated/audit. &> stays refused: dash, /bin/sh on Debian/Ubuntu, reads it as a background job.

Process lifecycle

• When a sample's shell exited, the close handler cancelled the KILL fallback even when other members of its process group were still alive. A TERM-ignoring child that closed its output survived /track stop (reproduced with a pid probe). On close, anything left in the group now gets TERM, then KILL after the grace period. That timer keeps a closing window alive for at most 1.5 s.
• fix(v0.21): harden /track refresh and finalization lifecycle #420's refresh-start event now fires after the child's handlers are attached. A throwing listener can no longer leave a child unwired.
• A tracker whose directory disappeared said spawn /bin/sh ENOENT; it now names the directory and keeps retrying.

Presentation

• More than two active trackers share one summary row above the composer (eight trackers took eight rows).
• State marks respect Safe glyphs. The unknown-command confirmation says "Track …?".
• Live rows split and sanitized the whole 200 kB result every frame (1–3 ms per frame with eight large trackers). This is now computed once per result (~0.5 ms per frame).

#420 itself: reviewed. Re-entrant rendering: render() is synchronous and only reads the scheduler, and every emit happens after scheduler state is consistent. Stale references: a deleted trackBlocks entry is only read through get(id) with a stopped fallback. Duplicate finalization: stop() emits once, record() ignores stopped trackers, and the window's exit unsubscribes before dispose(). No defects found beyond the event ordering above.

Tests

• tests/trackSafety.test.ts (new): redirects, wrappers, git options, file-writing options, network probes vs senders, remote detection.
• tests/track.test.ts: leftover processes after stop and after a finished sample (fails without the fix), the missing-directory message, Safe-glyph marks, the summary row.
• tests/trackLive.test.ts (real PTY): four trackers at once (slow with refreshing…, failing, missing command, large output), a resize, /track stop all ending every process; Bash and Fish trackers seeing a PATH change made after startup.

Docs: docs/development/track-live-command-refresh.md, physical QA 5.7–5.11, CHANGELOG.

Refs #393, #410, #416, #420