Drive the shutdown path where the requested signal reports a child error without exiting, the bounded marker grace expires, and fallback SIGKILL is accepted.
Assert that both signals are attempted and that close drains the successful fallback exit before preserving the original child error, restoring per-file 100% branch and line coverage for the launcher.
Update the bilingual pairing checksum after the English and Chinese Windows DACL RFCs were revised together to describe semantic ACE-policy comparison.
This restores the repository's recorded translation-consistency contract without changing either document's content.
Use Node's explicit inherit stdio mode for the fake descendant instead of passing the parent process stream objects as child descriptors.
This keeps the grandchild's stdout and stderr handles open across the fake ACP parent's exit on Windows, so launcher shutdown must drain the late buffered update and stderr bytes just as it does on POSIX.
A successful Windows termination request can end the process before Node publishes exitCode or signalCode. If a child error wins the shutdown race, give that accepted exit a bounded observation window before escalating or reporting fallback refusal.
Cover a delayed real exit edge, preserve prompt refusal behavior for a genuinely live child, and document the launcher grace without weakening the complete stdio and parser drain boundary.
Refresh PR #380 against master at ab96fdb63 immediately before landing so the admin merge is evaluated against the current repository contracts rather than the branch's earlier base.
Take the merged SQLite owner-only permission hardening and its regenerated config catalog while preserving the examples/repl-agent rename. The merge leaves examples/coding-agent absent and keeps demo:repl wired to the renamed leaf.
ReplaceFileW preserves ACLs by merging security information, which may reserialize auto-inheritance state and duplicate equivalent ACEs. Compare the final ordered, de-duplicated ACE policy instead of requiring byte-identical self-relative descriptor buffers.
Update the host-independent binding assertion to expect the namespaced absolute paths that the Win32 boundary actually receives, and align the package and bilingual RFC contracts with the semantic DACL guarantee.
Treat an absolute path.relative() result as a cross-volume path instead of incorrectly abbreviating it beneath the user's home directory.
Allow embeddings to project a logical footer cwd without changing the operational session cwd. The recorded-session harness now uses a POSIX-shaped display alias for both the footer and filesystem result paths, preserving the existing pre-normalization layout width on every host.
Keep runtime-provided labels behind terminal-control escaping, cover that boundary, and document the embedding contract.
Bring the follow-up branch onto master after PR #379 landed so the rename is reviewed and validated against the current generated Cordis catalog and JSDoc completeness contract.
The histories merge without a content conflict: master's catalog generator changes remain intact, while the repl-agent move continues to own only example paths, front-door naming, and their documentation derivatives.
Name the runnable leaf for the line-oriented front door it owns, matching the existing tui-agent and acp-agent organization. Move the complete config, Code Mode overlay, tests, metadata, and generated composition graph together, then update every loader path and repository reference.
Keep the shared model identity independent of its terminal front door by phrasing the persona as a coding-agent role rather than retaining the retired leaf name. Regenerate graph and tool catalogs and re-record each affected bilingual pair so derived documentation cannot point at the removed path.
Model the requested signal setting a child termination marker before the launcher begins fallback handling. The regression proves close drains inherited stdio and propagates the original process error without sending a redundant SIGKILL.
This complements the post-check fallback-refusal race and restores the launcher's required 100% per-file statement and branch coverage.
Exercise both exitCode and signalCode arriving after the SIGTERM grace begins but before the bounded SIGKILL confirmation helper starts. This pins the fast path that avoids signaling an already-terminated child and restores the package's per-file 100% branch and statement coverage.
Keep the marker transition deterministic by withholding the synthetic exit event, matching the OS state race the defensive pre-check exists to absorb.
Bring the TUI branch onto master after PR #378 landed so PR #363 is evaluated against the current type-equivalence documentation contract.
Resolve the bilingual development-record overlap by regenerating the English/Chinese consistency record from the merged documents. This preserves the branch's built-subprocess guidance alongside master's expanded JSDoc type-equivalence rules.
Declare MoveFileExW's return value as Koffi int and model it as a numeric 32-bit Win32 BOOL. The previous Koffi bool declaration represented a one-byte C boolean and could read the native return register with the wrong ABI.
Test zero and nonzero results explicitly and assert the binding result type while preserving the existing write-through flags, error translation, and durable directory race behavior.
Update the workspace-edit Windows sidecar to the current permission preset description emitted by the ACP session configuration. The shared golden already carried this contract; only the native-Windows transcript retained the superseded wording.
Leave the platform-specific backslash path rendering unchanged so the sidecar continues to pin the one intentional Windows transcript difference.
Tianyi Cui
Yichen Jiang