[LutzLange]

feat(agent): stop a sandboxed session the daemon has lost track of

Builds on PR 1 and lands after it. When the daemon starts the MXC executor (wxc-exec.exe) but then
cannot record the launch pid, or loses track of the executor during the start-up watch or later in
the poller, it now stops the executor instead of dropping the handle. Stopping the executor ends
the box: in the lab every process with the box's AppContainer identity was gone within seconds.
Before this change such a box kept running, unrecorded and with a live credential file until the
next sweep.

What changes

• LaunchChild::kill (Ok for an executor that has already exited); ProcessChild calls
  std::process::Child::kill (TerminateProcess on Windows).
• One stop_executor helper at the three places that lose track of the executor. A kill error is
  logged as a warning and never replaces the original error or keeps the launch from being marked
  exited.
• Behaviour change: a box whose launch fails after the executor started, or which the poller can
  no longer watch, is now stopped.
• README: the 500 list names the watch failures; a sentence says a running sandboxed session the
  daemon can no longer watch is stopped.
• No config, schema, core or provider change. Boxes still survive a daemon restart (the kill is
  explicit, not on drop).

Process evidence

(The spec, review and lab paths below live in the engineering workspace used to build this series,
not in this repository.)

• Spec: specs/PR-2.md (v5 frozen after four Opus spec-review rounds; the scope was cut from the
  original policy/engine PR to this one change, the rest is listed under "Later").
• Tests first: 6 tests by a separate agent (308c237) plus one Windows-only unit test that stops a
  real child process; strengthened and renamed during review, every change ledgered
  (specs/PR-2-test-changes.md). 6 on Linux, 7 on Windows.
• Gate (lab/evidence/pr2a/gate-v2.log; v3 is a doc comment, fmt + clippy re-run): fmt, clippy
  -D warnings, unit tests, schema, frontend build + lint, Storybook, test guard: PASSED.
• Reviews (reviews/PR-2a-*.md): conformance (Sonnet), adversarial (Opus, mutation probes),
  maintainer fit (Opus) on v1; delta review v2 (Opus) pass with minors; v3 wording-only.
  Fixed on the way: the missing README sentence, a test that did not check the launch directory was
  removed, a poller test that could not detect a kill after the directory removal, two test errors
  that could not be told apart.
• Lab (lab/evidence/pr2a/first-run-92e99b1.md, Windows 11 VM, build = v3 + fix(agent): store Windows secrets as encrypted files keyed from Credential Manager agentdesktop-dev/agentdesktop#171): K0–K2 pass.
  • K1: terminating wxc-exec (the pid the daemon recorded) ended all nine descendants (Claude
    Code, cmd, conhost, all with the box's AppContainer token) within 10 s; the launch shows
    exited, exitCode -1, its directory removed.
  • K2: a normal launch still works: AppContainer token, a completed turn, gateway
    POST /v1/messages 200, normal exit exitCode 0.
  • The three daemon-initiated stop paths cannot be provoked in the lab without fault injection;
    unit tests cover them.

Known limits and follow-ups

• No bounded wait after the kill: TerminateProcess is asynchronous, so the launch directory removal
  can race the teardown and leave the credential file until the next startup sweep.
• No test pins the kill before the launch is marked exited (the code does it in that order; tests
  pin it before the directory removal).
• cargo clippy --all-targets --target x86_64-pc-windows-gnu fails on an existing clone_on_copy
  in bin/agentdesktop-service.rs:83, a file this PR does not touch; separate fix.
• Please squash-merge (the first commit carries the tests against todo!() stubs).

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The focused termination changes preserve error handling and cleanup behavior, with regression coverage and no identified blocking issues.

No open issues 🎉

What changed in this PR

Stops sandbox executors when the daemon cannot record or monitor them, preventing sessions from continuing untracked.

Changes:

• Adds explicit termination to all three tracking-failure paths while preserving original errors.
• Adds regression tests and a Windows process-termination test.
• Documents the behavior without changing daemon-restart survival.

File	Description
README.md	Documents termination on tracking failures.
crates/​agent/​src/​launch/​writer_tests.rs	Updates the test child with kill support.
crates/​agent/​src/​launch/​tests.rs	Tests termination, error preservation, and cleanup.
crates/​agent/​src/​launch/​mod.rs	Stops executors before tracking-failure cleanup.
crates/​agent/​src/​launch/​host.rs	Implements process termination and tests it on Windows.

_{Review effort: Balanced}