Silent exit(1) of fourda.exe ~2-6 min after launch in detached/headless dev launches (pre-existing, bisected to before #498)

[runyourempire]

Symptom

target\debug\fourda.exe exits with code exactly 1, silently — no Rust panic (crash guard's default hook prints nothing with RUST_BACKTRACE=full), no Windows Event Log fault record, rotating log ends mid-flight with no RunEvent::Exit / tray-cleanup lines. Death lands 2–19 minutes after launch.

Evidence (5 reproductions, 2026-08-21, all local times UTC+10)

Run	Binary	Launch mode	Lifetime	Last log lines before death
1	#498 (f76dfb13)	detached pnpm tauri dev (hidden cmd) — vite UP, webview served (eval_js worked)	337s	Scoring backfill cycle scored=77
2	#498	same	195s	Scoring backfill cycle scored=14 (earlier: Notification window JS never loaded — recreating → Window destroyed label=notification)
3	#498	bare exe, no vite, RUST_BACKTRACE=full, stderr captured	~6min	ACE context loaded for scoring
4	#498	bare exe via cmd wrapper capturing %ERRORLEVEL%	~19min	Preemption feed cache warmed items=149 — TRUE_EXIT=1
5	pre-#498 (af0f1daa)	same as 4	~3min	Main window shown (dev server poll fallback) / Phase 0 EXCEEDED budget — TRUE_EXIT=1

What this rules out

• fix(intel+licensing): hydrate OSV advisories (recall bug), clock-rollback floor, recovery/charge robustness, upsell attribution #498's changes — run 5 reproduces on the pre-fix(intel+licensing): hydrate OSV advisories (recall bug), clock-rollback floor, recovery/charge robustness, upsell attribution #498 binary. Bisected: pre-existing.
• A Rust panic — full backtrace enabled, default hook chained after zeroize, nothing printed.
• The high-stakes recall scan — run 4 executed it cleanly (misscored=259 dep_matched=294) minutes before dying.
• Scheduled-task instance collision — deaths 2–5 fall outside the 30-min task windows.
• A single fatal step — the last-logged step differs every time (backfill, ACE load, preemption warm, window-shown).

What it points at

Exit code exactly 1 with zero output = a deliberate process::exit(1) — the only fit found is tao's event-loop termination path on Windows (app_setup.rs notes tao process::exit()s when the loop terminates). The strongest environmental correlate: every dying run was a detached / hidden-window / console-less launch (Start-Process hidden cmd). Yesterday's interactive pnpm tauri dev sessions on the same binary class ran for hours. Runs 3–5 additionally had no vite server (webviews starved: Notification window JS never loaded, first-light budget exceeded). Suspect space: WebView2 render-process death in starved/hidden windows → window destroyed → last-window/event-loop teardown → exit(1).

Impact

• Normal operator workflow (interactive pnpm tauri dev) appears unaffected.
• The 30-min scheduled --engine-once refreshes are unaffected (no event loop).
• Agent-driven detached launches for live verification are unreliable until this is understood.

Repro

Launch the debug exe hidden with no vite server (Start-Process -WindowStyle Hidden via cmd), watch it for ~5–20 min.

[runyourempire]

Data point 6: a post-investigation detached relaunch (Start-Process hidden cmd → pnpm run tauri dev, log data/tauri-dev-3.log) also died within minutes — 3/3 detached dev-chain launches and 3/3 bare-exe launches dead, 0 survivors, across both pre- and post-#498 binaries. The environmental correlation (detached/hidden launch context) is now 6/6. Interactive terminal launches remain the reliable path.

[runyourempire]

Root cause found — two legs, both fixed in #527.

Leg 1 (most deaths): external image-name kills by the repo's own tooling. The Validate workflow's Frontend job ran taskkill /F /IM fourda.exe on the self-hosted runner — the dev box itself — so every frontend-touching PR's CI killed every live fourda.exe with exit code exactly 1, silently. Correlation: PID 11728 alive 22:10 local 2026-08-24, dead inside PR #526's Frontend window 22:17:28–22:24:30 (run 32726284990). scripts/kill-fourda.cjs (run by pnpm run dev / local smoke flows) is the local flavor — it explains deaths with no CI running, including 2026-08-23 15:51Z. This retro-explains the whole 08-21 evidence table: heavy PR/validation days made "2–19 min after launch" simply the time until the next kill, and the pre-#498 bisect reproduced because the killer was external to the binary. taskkill freed nothing: fourda.exe is the vite client, never the port-4444 listener.

Leg 2 (the tao suspicion was also real): the zero-window teardown hazard. RunEvent::ExitRequested { code: None } — fired when the last window is destroyed — was never answered with prevent_exit(). The notification/briefing "JS never loaded — recreating" recovery destroys the stale window before its replacement exists; if it was the last window, tao terminates and process::exit()s, losing the buffered log tail (why logs "end mid-flight"). #527 wires the guard (prevent when code: None + tray alive) and instruments every exit path with attribution, including console-ctrl fingerprinting (observed live: 12:19:20Z console-close death) and a forensic classification table in exit_guard.rs for any future occurrence.

Remaining follow-up outside #527's scope: scripts/kill-fourda.cjs / kill-port.cjs (currently peer-WIP) should adopt the same port-scoped approach so pnpm run dev stops killing unrelated instances by image name.

#527's own CI is the self-demonstration: it runs the fixed Frontend step, and the operator's live instance is expected to survive it.