[mihir-s-05]

An unassigned Windows gate can outlive an abruptly terminated owner after it has opened its event. The retained gate waits for its original 30-second timeout without starting the requested workload. If the owner dies before that open, the real OpenEventW instead fails and the gate exits; after successful Job Object assignment, owner death stops the gate and ready descendants.

This supplies the source-pinned native audit requested by #4905's handoff. It directly exercises current main's shared run_windows_command and the frozen opt-in stream owner from #5463. The production implementation and selected frontier are unchanged.

Audit, reproduction and limits · canonical claim/result

The contribution centers on the shared-runner handoff, the two sides of the event-open race, and a kill-on-close-disabled counterfactual. The submission refresh exposed a concurrent stream-adapter audit; its overlapping three stream cuts are credited as independent corroboration. Scope coordination. These are separate Codex-assisted sessions under the same account, not independent human review.

Validation at 682687b4b41d3252ca6ea1a50e62aee83cf56ca2, native Windows 11 build 26300 / CPython 3.12.0 x64:

• 14 cases pass in each normal and optimized mode: before event opening, waiting before assignment, assigned before release, ready workload/child after release, normal resume, and two actual weakened controls, for both targets.
• Bypassing the gate is rejected for starting work before assignment. Disabling kill-on-close is rejected for leaving the gate/workload/child alive after owner termination.
• Native handles identify the live processes before termination. Observations precede the separate outer fixture job's cleanup; every fixture is subsequently stopped.
• The optimized complete run succeeds in a standalone copy with no .git and empty PATH. A changed executable source byte rejects before fixture launch or receipt creation.
• Exact source commit/blob/SHA256 bindings, original versus mutant gate hashes, receipt coverage, staged bytes and git diff --check pass. Raw native receipts retain their bytes.

Normal receipt · optimized receipt · source and overlap validation

python -I -W error -B docs/research/windows-owner-death-audit/probe.py --output normal.json
python -I -O -W error -B docs/research/windows-owner-death-audit/probe.py --output optimized.json

The original gate algorithm executes with explicit native-call tracing and controlled pauses; this is instrumented evidence, not a natural-crash frequency or universal crash-safety claim. All cases use nested fixture jobs. Other Windows/Python versions, restrictive job policies, death inside native API calls, complete consumer integration and hosted native CI are untested. The transient unassigned waiter is observed, not repaired. This native-only audit is not registered as a generic Linux research replay. The selected baseline attempt stopped at a sparse-omitted certificate; no baseline pass, selected cold replay or mathematical acceptance is claimed.

Started from and refreshed against canonical main 32890bc5de034ab8fc93ac88ead7279a6a416d04, priority revision 7. Final overlap covered 379 open PRs, 4,797 Discussion records and all 7,402 tracked in-scope notes, with reported complete pagination/inventory, followed by direct live claim checks. Coverage is not a novelty guarantee.

Credit ywz65 (#2469/#2452), Mihir Srivastava (#4683/#4905/#5463), Nick Petalas, Brian/JoyboyBrian, Paul Romeo, Douglas Colkitt, Aaron Wang/navinor, woklerx, Tekalign, Arham Tahir and the retained source/lifetime lineage. Prepared for Mihir Srivastava with substantial OpenAI Codex assistance, one agent; Apache-2.0. Original source headers and notices are retained.