fix(run): contain Windows command descendants

[debuggingfuture]

Windows command pulls contain their descendants in a private Job Object before the command executes. Cancellation and successful parent exit terminate the command tree and return only after retained member handles are signalled, the direct child is reaped, and the job reports zero active processes. Membership changes and failed queries refuse completion.

The child starts suspended. A finite thread snapshot requires one owned launch thread; a retained thread handle confirms process ownership before Job admission and the sole resume. Missing or ambiguous ownership, admission failures, unexpected suspension counts, and job-query errors refuse the pull. Kill-on-close remains enabled; breakaway remains disabled.

Test-first obligations follow packages with production source changes. Unrelated test-only portability edits remain covered by the full workspace without requiring an invented behavioral failure against unchanged source. Every changed source package still requires its own changed integration test and a failing base replay; refactor classification retains its existing contract. A mixed-package regression verifies these controls and confirms that a failing unrelated test-only edit still fails the workspace.

Native x86-64 and ARM64 MSVC regressions reproduce both baseline command-tree failures after successful compilation and test listing. Each fixture verifies its descendant's retained handle, creation identity, and unique executable before cleanup. Rust 1.97.0 native execution passes both command-tree regressions and all five portable admission tests on both architectures. Final Windows production source, fixtures, and dependencies match that native-tested source exactly.

Validation:

• Native x86-64 and ARM64 checks pass, including directory synchronization, file identity across rename, lock cleanup, conditional creation, ledger writes, and audit writes. The temporary workflow and its content assertion are absent; native Rust fixtures remain.
• Windows GNU integration compilation and production library Clippy with -D warnings pass. All 123 owning engine integration tests and all 177 owning CI integration tests pass. Normal CI Clippy and compiler checks pass; the existing topology type-complexity warning remains.
• The locked full workspace passes 2,230 tests with 0 failures and 8 ignored tests, required Lean 4.29.1 and Wasm, and four test threads. The current stacked head passes pins, schema and test-first against Serve governed console workflows and verify protocol traces #399; test-first completes in 86.0 seconds. The CI regression fails behaviorally against the base; the portable engine base replay fails compilation because its private helper is absent, distinct from the captured native runtime failures.

The command-source interface and query budgets retain their existing shape. The adapter uses the existing locked Windows API dependency version 0.61.2. Standing native Windows dispatch and Windows release packaging remain open; the ten-cell release matrix covers Linux and macOS. These repairs do not complete all of issue #54.

The regressions exercise run.cancel and assurance.test.

Boundary questions:

• Does the engine already do this? Command containment belongs to its platform adapter.
• Does a surface reimplement registered policy? No.
• Does a second state model mirror the engine? No.
• Could an engine change silently disagree? The shared command interface and native descendant regressions hold the adapter.

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://build-windows-target-gate.spec.contextful.work (commit 3b43651)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://b673a7c7.spec.contextful.work	3b43651	2026-10-08T00:10:04.514Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://0299cb5e.spec.contextful.work	0671e34	2026-10-05T20:39:49.904Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://b044e2ba.spec.contextful.work	8b0749e	2026-10-03T23:53:09.057Z	Visit the dashboard ↗

[debuggingfuture]

Parked: Windows delivery is deferred (assurance.build.windows-target, assurance.gate.windows-checks, #429). This stays a draft outside the landing queue until an explicit Windows support decision.

[debuggingfuture]

Superseded by #424, which carries the Windows Job Object command containment and its native lifetime tests; the remaining changes are on main.