fix(hooks): Windows has no polite stop, and asking for one killed the console

`background_stop` opened with what looked like the symmetric counterpart of the
POSIX side's SIGTERM-then-grace:

    ::GenerateConsoleCtrlEvent(CTRL_BREAK_EVENT, ::GetProcessId(procH));

That call addresses a process GROUP attached to the CALLER's console, not a
process. When the id does not name a live group of ours — and it does not, once
the child has already exited, which `start /b`-style commands do immediately —
the event reaches everything sharing that console instead.

Measured on the Windows e2e runner: the entire suite died eleven seconds into
the hooks test with exit code -1073741510 (0xC000013A, STATUS_CONTROL_C_EXIT)
and printed no summary at all, because mcpp had sent Ctrl-Break to its own
console. Nothing local can show this: the branch is #if'd out everywhere the
code is developed, and the failure is not in the feature under test — it is the
harness dying.

The design document already said Windows has no graceful stop for a child with
no console and no window of its own. The implementation did not believe it. The
call is removed, `graceMs` is explicitly unspent on that platform, and the
asymmetry with POSIX is stated in the declaration instead of faked with a call
that reaches too far. The job object was always the mechanism.

macOS ARM64 and Linux both ran the new e2e green on the previous commit
(317_project_build_hooks.sh, 21s on macOS), so the POSIX half — process groups,
the grandchild kill, and Ctrl-C cleanup — is confirmed on two OSes.

Author: speak-agent

.agents/docs/2026-08-30-project-build-hooks-owned-intervals.md

@@ -159,6 +159,17 @@ Windows: the job object is closed, which terminates the tree at once. There is
 no graceful equivalent that does not require enumerating the job's processes
 and posting window messages; the asymmetry is stated rather than hidden.
 
+⚠️ The obvious symmetry — "ask with `GenerateConsoleCtrlEvent(CTRL_BREAK_EVENT,
+pid)` first" — was written, and it is wrong in a way no local run shows. That
+call addresses a process GROUP attached to the caller's console, not a process.
+When the id does not name a live group of ours (and it does not, once the child
+has exited — `start /b`-style commands exit immediately) the event reaches
+everything sharing the console. Measured on the Windows e2e runner: the entire
+suite died eleven seconds into the hooks test with exit code `-1073741510`
+(`0xC000013A`, `STATUS_CONTROL_C_EXIT`) and printed no summary, because mcpp had
+sent Ctrl-Break to its own console. The design said Windows has no graceful stop;
+the first implementation did not believe it. The code now matches the design.
+
 ## Output
 
 A self-closing hook inherits stdio, which is safe because nothing else is

modules/platform/src/windows/bounded_process.cppm

@@ -129,11 +129,15 @@ BackgroundChild spawn_background(const char* commandLine,
 // player finished the track" from "the command does not exist".
 int background_running(unsigned long long process, int* exitCode);
 
-// Closes the job, which terminates the whole tree at once. `graceMs` is
-// accepted for signature parity with the POSIX side and is spent waiting for
-// the child to leave on its own after the console-control event; Windows has
-// no portable graceful stop for a process with no window and no console of its
-// own, and pretending otherwise would be a promise this cannot keep.
+// Closes the job, which terminates the whole tree at once.
+//
+// `graceMs` is accepted for signature parity with the POSIX peer and is NOT
+// spent: Windows has no portable graceful stop for a child with no console and
+// no window of its own, and the call that looks like one
+// (GenerateConsoleCtrlEvent) addresses a process group attached to THIS
+// console — see the implementation for what that cost. The asymmetry with the
+// POSIX side's SIGTERM-then-grace is real and is declared here rather than
+// papered over.
 void background_stop(unsigned long long job, unsigned long long process,
                      long long graceMs);
 
@@ -474,17 +478,31 @@ void background_stop(unsigned long long job, unsigned long long process,
                            static_cast<std::uintptr_t>(job))
                      : nullptr;
 
-    // Ask first. A child created with CREATE_NEW_PROCESS_GROUP is its own
-    // group, so this reaches it and nothing else — including not reaching
-    // mcpp, which is the reason the group exists.
-    if (procH && graceMs > 0) {
-        ::GenerateConsoleCtrlEvent(CTRL_BREAK_EVENT, ::GetProcessId(procH));
-        ::WaitForSingleObject(procH, static_cast<DWORD>(graceMs));
-    }
-
-    // Then take the tree. Closing a KILL_ON_JOB_CLOSE job is the whole
-    // mechanism: TerminateProcess on the child alone would leave whatever it
-    // started behind.
+    // ⚠️ NO POLITE ASK HERE, AND `graceMs` IS DELIBERATELY UNSPENT.
+    //
+    // The obvious "ask first" is
+    //
+    //     ::GenerateConsoleCtrlEvent(CTRL_BREAK_EVENT, ::GetProcessId(procH));
+    //
+    // and it is wrong in a way that does not show up locally. That call
+    // addresses a process GROUP attached to this console, not a process; when
+    // the id does not name a live group of ours — which it does not, once the
+    // child has already exited, and `start /b`-style commands exit at once —
+    // the event reaches everything sharing the console instead. Measured on
+    // the Windows e2e runner: the whole suite died eleven seconds into the
+    // hooks test with exit code -1073741510 (0xC000013A,
+    // STATUS_CONTROL_C_EXIT) and printed no summary at all, because mcpp had
+    // Ctrl-Break'd its own console.
+    //
+    // Windows has no portable graceful stop for a child with no console and no
+    // window of its own. The job IS the mechanism; the POSIX peer's
+    // SIGTERM-then-grace has no equivalent here, and the asymmetry is stated
+    // in the declaration rather than faked with a call that reaches too far.
+    (void)graceMs;
+
+    // Closing a KILL_ON_JOB_CLOSE job takes the whole tree. TerminateProcess
+    // on the child alone would leave whatever it started behind — which for
+    // `start /b cmd /c player` is the player.
     if (jobH)  ::CloseHandle(jobH);
     if (procH) ::CloseHandle(procH);
 }