tests: no test may perform a real os.kill(pid, 0) on Windows — the rule is enforced in one file, nowhere else #1351

The rule

No test may execute a real os.kill(pid, 0) on Windows. signal.CTRL_C_EVENT is 0 there, and CPython's os_kill_impl routes it to GenerateConsoleCtrlEvent(CTRL_C_EVENT, pid) before the TerminateProcess fallback — so the call is not a probe but a Ctrl+C to that pid's console process group, the whole console included, the runner's pytest included.

Where it is enforced today, and where it is not

• tests/test_stop_all.py — guarded (PR emrg: one platform-correct liveness probe (#1349) #1350, _POSIX_ONLY + _tests_that_reach_a_real_probe, an AST scan with its own control). The scan caught a real blind spot on its first draft: it matched only attribute calls, so a directly-imported pid_alive(...) would have gone unseen.
• Everywhere else in tests/ — unguarded. Nothing stops a new test in another file from reaching a real default-argument probe. The class of test that does it is narrow but not hypothetical: it is exactly what PR emrg: one platform-correct liveness probe (#1349) #1350's first CI round did (run 35258286311 — the test passed on windows-2025 and the next test died with KeyboardInterrupt inside subprocess.py:1606, exit 1, 2462 passed, 118 skipped).
• tests/conftest.py's _NoSignalOs guard (PR emrg: guard the daemon red line at its two uncovered routes #1348) is deliberately scoped to emrg.client.daemon_manager's namespace, and its Popen guard to spawning a daemon stop/restart. Both are about the daemon, not about os.kill in general — and neither reaches a probe made from emrg._stop_all or a test's own os.kill.

Measured exposure right now

grep -rn "os\.kill(" tests/*.py   # real calls, excluding mock/patch mention

At f5ece5ae the only real-call sites are the two _POSIX_ONLY tests in tests/test_stop_all.py, so the suite is currently clean — this issue is about the guard, not about a live defect.

What a fix would look like

A suite-wide version of the same rule, in one place, keyed on the act rather than on a helper's name: on a Windows host, any os.kill(pid, 0) performed by a test (directly, or through a default argument) fails the test loudly instead of signalling the console. The shape that fits this repo's discipline:

• the guard must be driven by an injected predicate over (pid, sig) for the platform table, so the Windows decision is pinnable on POSIX runners (the reasoning PR emrg: guard the daemon red line at its two uncovered routes #1348 and PR emrg: one platform-correct liveness probe (#1349) #1350 both used);
• it must refuse before the call, so the positive controls stay safe to write (MANIFESTO 第四条附则二's family of rules);
• and it needs a both-ways control — a scan that finds nothing must be distinguishable from one that cannot see.

Note for whoever picks this up: tests/test_stop_all.py's AST scan is per-file (it reads its own source). A conftest-level rule and that scan would be two instruments answering different questions — this file's tests vs any test — so landing the suite-wide rule does not make the per-file one redundant, but it does make it the weaker of the two.

Evidence

• PR emrg: one platform-correct liveness probe (#1349) #1350 first round: run 35258286311 — test-windows fail, log line tests/test_stop_all.py::TestPidAliveIsPlatformCorrect::test_a_live_pid_on_posix PASSED followed by !!!!!!!!!!!!!!!!!!!!!!!!!!!!!! KeyboardInterrupt !!!!!!!!!!!!!!!!!!!!!!!!!!!!!! / subprocess.py:1606.
• PR emrg: one platform-correct liveness probe (#1349) #1350 fixed round: run 35259197926 — both legs pass; the two real-probe tests SKIPPED on windows, the scan PASSED there.
• Same mechanism, test-side counterpart: PR emrg: guard the daemon red line at its two uncovered routes #1348; product side: PR emrg: one platform-correct liveness probe (#1349) #1350 / issue stop/cli: os.kill(pid, 0) is a Ctrl+C on Windows, and two product paths still use it as a liveness probe #1349.