[hawklithm]

Problem and resulting behavior

The proxy repeatedly disappears without a Python exception or exit event. A launcher-only Silent Process Exit configuration captured the wrapper's later self-exit but missed the actual interpreter. This change adds independent lifecycle observation and a validated dedicated real CPython runtime, so supported user-mode exits of the actual proxy and its observer can produce Windows events and dumps.

This is an evidence-collection change. The incident initiator and root cause remain unknown. Actual interpreter/observer exits were close together in the 20:38 and 21:02 incidents; that is a lead, not proof of a particular cleanup tool or caller.

Implementation

• Retain Windows process handles and record kernel creation/exit times, unsigned exit codes, parents, memory, local health, allowlisted business-log summaries and available Windows events. Support attach, discover and explicit launch; never terminate observed processes.
• Build separate real CPython console/windowed images from the existing base runtime, with its required DLLs. Bootstrap uses the original venv dependencies and editable project source. Validate workload PID, OS image, imports, copied hashes and source runtime hashes; sys.prefix intentionally points to the diagnostic runtime.
• Configure Silent Process Exit only for dedicated runtime/observer image names. Shared python.exe/pythonw.exe remain unconfigured. Validate isolated normal exit, abrupt self-exit, known external termination, exact victim/initiator dumps, and both configured production images before accepting the setup.
• Keep per-value rollback journals, restricted evidence ACLs, existing-setting conflict checks and bounded dump count. No debugger, injected callback, automatic proxy restart or system-wide process auditing change.
• Updated start entry rejects launcher-only states and existing proxies, then starts a console-free observer and the real runtime. Discovery includes dedicated runtime images and excludes observer launch command lines.
• Updated Handoff, setup/start/check/rollback documentation and new regression coverage. Raw business logs and memory dumps remain local and are excluded from this PR.

Validation and review

• Windows regression: 267 passed, 1 skipped, 1 deselected. The excluded test is the existing POSIX 0600 permission assertion on Windows.
• Isolated administrator acceptance: normal exit 23 and os._exit(29) produced matching 3000; terminating only an owned temporary process produced 3001 identifying the known test PowerShell, plus exact target/initiator mini dumps. Both configured runtime and observer images produced 3000 during temporary import/identity tests.
• Tests cover real PID/image, minimal PATH dependency loading, console-free observer lifecycle, argument round-trip, tamper rejection, and private HKCU journal/conflict/rollback behavior. Final event-filter change was additionally checked against the saved native event source; PowerShell parsing and startup CheckOnly pass.
• Code review checked process ownership, registry scope/rollback, source-runtime drift, environment/argument handling and evidence interpretation. No live proxy was started, stopped or restarted by the implementation or tests. Startup CheckOnly reports ready. The user's manual 21:18 run used the dedicated observer/runtime and subsequent health records returned HTTP 200. Startup JSON now strips PowerShell file metadata from the monitor directory string; verified against the live redirected log without restarting processes.

Limits

Silent Process Exit does not cover every kernel/Job/last-thread termination path. Dedicated image names, prefix, ancestry and console behavior are diagnostic variables; stability alone cannot establish the previous cause. Mini dumps may contain sensitive memory and count limits are not a byte quota. Native stdout/stderr files do not rotate. The earlier independent observers were preserved during implementation, but were absent in the 21:21 snapshot; their exit source is unresolved. The user's current launch observer and real runtime are alive and health checks pass. No observer has reboot autostart.