Related: #151325 (follow-up), #150427, #150244.

What Problem This Solves

Ordinary owned stdio children on Windows could not certify descendant extinction, so cleanup regularly ended as uncertain after the parent exited. This follows up on #151325 while preserving the non-fatal cleanup containment from #150427. Job support must remain optional for command startup, while callers requiring verified tree cleanup must retain their state when certification is uncertain.

Why This Change Was Made

createChildAdapter is the one spawn attachment point. It extends the existing scripts/lib/managed-windows-job* owner from #150244. The native launcher joins a retained kill-on-close Job before target code can run or fork, preserving interactive stdio, extra descriptors, worker IPC, and startup admission. The adapter installs lifecycle observers before releasing command startup.

Missing Koffi or launcher support keeps the ordinary spawn path and reports uncertain/job-unavailable. Job creation, configuration, or pre-command admission failures retire the containment attempt, revalidate launch authority, and use the ordinary spawn path with uncertain/job-create-failed, uncertain/job-configuration-failed, or uncertain/job-admission-failed, retaining the cause. Job observation failures retain uncertain/job-observation-failed for the same scope-policy evaluation. Genuine command-launch errors and cancellation still fail. The command is never retried.

The supervisor interprets the certification before retiring the run. An uncertain receipt records a scope-local cleanup failure with its typed reason and the original receipt as cause for required-all and locally owned owned-only scopes. Transport-only cleanup and backend-owned owned-only cleanup remain independent. A local transport certificate cannot certify an external backend for required-all. The existing agent-exec cleanup gate now retains its state lock and temporary state on uncertainty; no production change to agent-exec was needed. This addresses ClawSweeper's scope-cleanup finding.

Production/tooling is +406/−108 (net +298); tests/support are +802/−81 (net +721). Growth stays with existing owners: the shared Job helper owns capability checks, admission classification, readiness and accounting; its launcher preserves IPC; the adapter selects containment and fallback; the supervisor interprets certification according to scope policy. The latest scope repair adds only four net production lines, including deletion of the adapter conversion that discarded typed Job observation uncertainty. The Claude prompt/skill artifact owner retains files and warns on an uncertain receipt; certified removal already in progress is joined before return. The fd-count-only handoff and IPC exclusion were deleted, with no parallel Job helper. The non-Job cancellation path remains necessary for portable installations.

User Impact

Windows MCP servers, language servers, exec sessions, and workers get native Job certification where supported without losing interactive input or IPC. JavaScript-only portable archives and installations with unavailable or failing Job support still launch commands. Tree-required callers preserve locks and temporary state when descendants remain unverified. Existing non-fatal handling of genuine transport cleanup errors is unchanged. Non-Windows process behavior is preserved. No new options, dependencies, schemas, retries, or timeouts are introduced.

Evidence

Current landing evidence for 7d937b017c456167a7e747e5a2a28df461dd0885: CI run 35354835669 is GREEN. The exact-head native watcher reports rollup=green github_rollup=SUCCESS pending=0 superseded=0; the campaign recorded 158 passed, 12 skipped, zero failures, including both Windows node-test jobs. No manual rerun was requested.

The 13-commit rebase from reviewed head 92c8d53c82a4d5cdb32efafc3716f9f827ac20ac preserves the patch. Range-diff shows only surrounding fixture context changed by main, with no semantic change. The round-three Codex P1 review remains scoped-clean (0.84 confidence).

ClawSweeper follow-up: the latest completed review (September 18, 2026, 14:57 UTC) covers this exact head and reports Ready for maintainer review, no findings, sufficient Windows proof, and Before merge: None. There are no outstanding Rank-up moves.

The previous Windows log-access concern was resolved by the maintainer's acceptance of hosted Windows node-test jobs and the capability matrix for this Windows-only supervisor change: native support absent → ordinary spawn plus uncertain/job-unavailable; native support present → certified cleanup; Job setup/admission failure → ordinary spawn plus the typed uncertain reason; tree-required cleanup retains resources on uncertainty. An additional reviewer log-download attempt was skipped under that decision. This preserves one shared Job owner, optional native support, and scope-owned resource retention. Both exact-head Windows jobs succeeded: part 1, part 2.

The earlier-head results below are retained as historical evidence; their unrelated CI failures are superseded by the green current-head run.

• Local proof is macOS-only: 243 focused tests passed, with six native Windows cases skipped locally. Windows proof comes from both repository Windows node-test jobs on this PR.
• Pre-fix negative controls reproduced four policy failures (required-all and owned owned-only, each with unavailable or failed Job admission) and four agent-exec failures (unavailable/failed setup × temporary/explicit state). Scope cleanup wrongly resolved, locks were released, and temporary state was deleted. Six additional observation-uncertainty cases failed before removing the adapter's generic-error conversion. Three real-command artifact regressions also reproduced premature prompt deletion for unavailable, setup-failed, and observation-failed certification. All regressions pass after their owner repairs.
• Policy coverage includes unavailable native support, failed Job admission, failed Job observation, and confirmed extinction for all three policies, plus external-backend ownership. Concurrent transport-only cleanup remains successful. Existing command-launch, cancellation, grandchild, interactive stdin/IPC, portable-worker, and managed-Job tests remain covered.
• Codex local and fresh committed-branch P1 reviews are scoped-clean on 92c8d53c82a4d5cdb32efafc3716f9f827ac20ac (--mode branch --base origin/main --max-priority P1). Native Windows CI results are recorded below.
• pnpm check:changed passes every gate preceding the unchanged main SDK surface-budget failure: deprecated channel-message exports are 137 > 136, introduced by fix: keep routine polling out of progress and history #151456. The existing base-only reproduction is retained; no SDK export or budget changed here. All 25 remaining selected checks passed separately, including all typecheck and lint lanes; final core typechecking and scoped lint passed after the observation repair.
• Exact-head CI run 35351486775 is terminal on 92c8d53c82a4d5cdb32efafc3716f9f827ac20ac: 155 success, 12 skipped, 3 failed. Both Windows jobs passed. No manual reruns were requested.

The two non-Windows failures are reported separately from the cleanup repair. Numeric campaign class IDs have not been verified; the descriptive classes above are supported by the logs and source inspection. Neither failure was rerun. The prior head's Matrix download, UI iframe readiness, and Telegram skill-suite failures are absent on this head.