Windows: os.kill(pid, 0) liveness probes call TerminateProcess (registry.py, dashboard/app.py)

[laynepenney]

Problem

os.kill(pid, 0) is used as a non-destructive process-liveness probe in three places, but on Windows os.kill(pid, sig) calls TerminateProcess for every signal except CTRL_C_EVENT / CTRL_BREAK_EVENT — signal 0 included. So on Windows these "check if the process exists" probes would attempt to terminate the target pid rather than test it.

Sites (on dev after #1000):

• src/synapt/recall/registry.py:302 — os.kill(pid, 0) # Check if process exists
• src/synapt/dashboard/app.py:224
• src/synapt/dashboard/app.py:495

Why it wasn't caught until now

The windows-latest CI matrix only began running once the store-isolation collection fix (#1000) let the suite reach test execution on Windows. The unit suite passes, so no current test exercises these code paths on Windows — but they are latent bugs for any Windows deployment of the registry or dashboard.

Suggested fix

Route liveness through a platform-branching, non-destructive probe — exactly what src/synapt/recall/session_start.py::_pid_alive / _pid_alive_win32 already do (win32: OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION) + GetExitCodeProcess + CloseHandle; POSIX: os.kill(pid, 0)). Consider extracting that helper to a shared util and calling it from all three sites.

Separate concern, same file: dashboard/app.py:521/:528 use os.kill(pid, SIGTERM/SIGKILL) for actual termination (SIGKILL does not exist on Windows) — triage whether the dashboard is POSIX-only.

Found during #1000's windows-latest bring-up.
Premium boundary: recall is OSS (registry + dashboard are local primitives). No identity/org.

[laynepenney]

Confirmed against current dev and the Python os.kill contract. The three liveness calls are unsafe on Windows. The official docs say that on Windows every value other than the two console control events unconditionally invokes TerminateProcess, which includes 0: https://docs.python.org/3/library/os.html#os.kill

There is also a POSIX bug in two of the same callers:

• registry.detect_crashed_agents catches PermissionError and appends the agent to crashed. For a signal-0 probe, permission denied means the process exists but is owned by another user.
• dashboard._is_pid_alive catches OSError, which also folds PermissionError into False.
• dashboard._pid_is_running has the correct POSIX permission reading, but still uses the destructive Windows call.

The existing implementation to reuse is stronger than the issue summary alone suggests. recall/session_start.py already has:

• platform dispatch that makes os.kill unreachable on win32;
• query-only OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION);
• GetExitCodeProcess == STILL_ACTIVE;
• guaranteed CloseHandle;
• declared pointer-sized ctypes signatures, including a wide-handle witness;
• the correct POSIX PermissionError -> True behavior.

Concrete repair path:

1. Extract that primitive to a dependency-light synapt.recall.process module as public-in-package pid_alive plus private Win32 helpers.
2. Make session_start, registry.detect_crashed_agents, dashboard._is_pid_alive, and dashboard._pid_is_running consume that one function. Keeping wrappers temporarily is fine if tests patch those names, but there must be one implementation.
3. Move/retain the existing dispatch and native-contract witnesses at the shared module. Add consumer witnesses proving registry and both dashboard paths call the shared helper. Add the POSIX permission-denied control so a Windows repair cannot preserve the existing false-dead classification.
4. Treat dashboard._stop_dashboard separately. Its SIGTERM call is intentional termination, not liveness. POSIX can retain SIGTERM then SIGKILL. Windows needs an explicit TerminateProcess-shaped branch and must never evaluate signal.SIGKILL, which is not portable there. That can land in the same PR if witnessed, but should not be hidden inside pid_alive.

Suggested mutation set:

• force the shared helper to use os.kill on win32: the Win32 dispatch witness dies;
• map POSIX PermissionError to false: the permission control dies;
• route any one of the three consumers around pid_alive: that consumer witness dies;
• remove CloseHandle or the ctypes prototypes: the existing native-contract witnesses die.

Scope: OSS. No premium/identity boundary issue. I recommend one shared-helper PR plus the explicit dashboard-stop branch, rather than copying the Win32 primitive three more times.