[jlongster]

P2 — termination and cleanup

Complete at c92abf2, stacked on P1 #12 / conpty-runtime64427e2, above corrected T2 windows-pipes3ebd4a5. Source is frozen for T3 convergence. Do not merge.

Runtime changes

• The actor hands the unique Windows PTY master to the existing wait worker for blocking ClosePseudoConsole; actor/reader keep draining until real EOF before publishing Exited. No fifth worker or fake EOF.
• A per-terminal disconnect signal interrupts demonstrated full controller/input queue shutdown deadlocks, prioritizing shutdown without changing ordinary backpressure or resize-reply-before-input ordering.
• Late writer failures cannot overwrite a published exit. Windows post-exit input/resize returns child-exited error; snapshots/rows/replay remain readable.
• Shutdown joins are idempotent. Windows explicitly waits for the owned root process object to signal before accepting the exit status, fixing a reproduced teardown race and preserving exit code259.
• Failed close handoff retains master ownership; a regression covers it.

Exact-head verification

Windows run33786722949: native x64 AND ARM64 each passed29 library +5 callback +12 real runtime +1 retained-pointer tests (47 total), plus standalone library29/29. Architecture/PE checks, formatting, locked all-target/all-feature Clippy, build and executable smoke all passed.

Core run33786723170: Linux61 tests, macOS56, Miri5 callback +1 retained-pointer in BOTH Stacked and Tree Borrows modes, all passed. One ignored runtime test is the deliberately self-spawned fixture entry.

Runtime coverage includes natural exit/final-output ordering, exit259, strict live-captured root/PowerShell-descendant process handles, repeated termination/drop, non-reading Windows children and active-output shutdown. Combined T3 daemon coverage is tracked separately in #16.

Preserved limitations/evidence

• A pre-existing Linux blocking master-write hang after a non-reading child exits remains documented in README; no Unix I/O redesign, slave reopening, backend fork, job object or watchdog-as-cleanup claim.
• The unchanged foreground-process test hung on two old81db79a CI attempts with its background tail. Current restacked Core passed unchanged. Exact baseline/current isolated bash/dash and a500ms scheduling-gap probe did not reproduce it; logs/repro bodies remain outside Git and the issue is not dismissed or claimed fixed.
• No existing assertions or tests were weakened. T2 transport/security/Miri code and Windows API feature union were preserved in the rebase.

[jlongster]

Review follow-up (b81ed97):

• Blocking fix: a request queued in the actor before shutdown could wait forever, because shutdown now overtakes queued work and the stopped actor's buffered messages (with their reply senders) stay alive while other handles hold queue senders. Replies now use crossbeam channels, and waiters also observe the actor thread's lifetime. The extended shutdown_interrupts_actor_to_writer_backpressure test fails without this fix and passes with it.
• After the Windows master handoff, terminal replies are discarded, so a writer stopped by ClosePseudoConsole cannot end the actor before the real EOF.
• The descendant-exit assertion in the runtime test now uses a bounded 5 s wait.
  feat(daemon): enable private Windows named-pipe service #16–refactor(windows): simplify metadata reads and test setup #19 were rebased onto this commit without conflicts.