create give-up: follow-ups after #247 (Windows stop channel, stopped host, timing docs, other loop errors) #264

Follow-ups from the review of #247 (for #209). On Linux and macOS, a create that gives up now stops its host through the ChildProcess handle, and the host ends the program and records destroyed. These items stay open.

1. Windows: a host that is not yet named keeps serving a failed create

On Windows, ChildProcess.kill('SIGTERM') ends the host at once, without its shutdown. So #247 stops the host only once the manifest names the program (childPid set), and the next reconcile then kills the program and records failed. If the host has not written its first manifest yet, create leaves it alone, as before #247. A host that starts slowly can then still serve a session whose create failed, which is the #209 bug, in its most likely case. A fix needs a stop channel other than SIGTERM, for example an IPC message at spawn. docs/USAGE.md documents the limit.

2. A stopped or blocked host keeps its program

A host stopped with SIGSTOP, or with a blocked event loop, handles the SIGTERM only when it runs again. Until then, the program runs and the session reads running. Only destroy --force ends it sooner. USAGE and the lifecycle SKILL's scope do not say this.

3. Document the cleanup timing and the exit code change

The session reaches destroyed about 2 to 6 s after create exits 6, so a caller that checks at once still sees it running. A later destroy of such a session now exits 4 (SESSION_ALREADY_DESTROYED) instead of 0.

4. Errors other than readiness errors skip the stop

Inside the readiness loop of runCreateCommand (src/cli/commands/create.ts), errors that are not readiness errors still rethrow without host.stop(). Examples are an error from readCreateResult or readManifestIfExists, or an error that is not a CliError. The create error envelope also carries no sessionId. Both are older than #247, but they are a leak path like #209.

5. Test gaps

No unit test covers stop() after the host has exited. The lifecycle facts.mjs does not check that the host registers its SIGTERM handler before the manifest wait.

Refs #209, #247

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high