fix(windows): reclaim terminal resources and retain font owners

Persist the pending ConPTY lifetime, process snapshot and native font ownership fixes. Keep lifecycle regression tests and the Windows memory stress tool together with the ownership contracts.

scripts/tests/test_windows_memory_stress.py

@@ -0,0 +1,128 @@
+import unittest
+from unittest.mock import Mock
+import subprocess
+
+from scripts.windows_memory_stress import MIB, close_owned_process, summarize
+
+
+def sample(phase, commit, resident=40):
+    return {"phase": phase, "private_commit_bytes": commit * MIB,
+            "private_working_set_bytes": resident * MIB, "working_set_bytes": (resident + 50) * MIB}
+
+
+def complete_samples():
+    return [sample("idle", 100), sample("settled-0", 130), sample("settled-1", 131),
+            sample("tabs-open-0", 170), sample("tabs-closed-0", 132),
+            sample("tabs-open-1", 171), sample("tabs-closed-1", 133)]
+
+
+class WindowsMemoryStressTests(unittest.TestCase):
+    def checkpoints(self):
+        return [{"phase": row["phase"], "handles": 700, "threads": 120}
+                for row in complete_samples() if not row["phase"].startswith("tabs-open")]
+
+    def test_warm_cache_and_reclaimed_tabs_fit_both_budgets(self):
+        result = summarize(complete_samples(), 2, 180, 4)
+        self.assertTrue(result["budget_enforced"])
+        self.assertEqual(result["violations"], [])
+        self.assertEqual(result["tab_growth_after_warmup_bytes"], MIB)
+
+    def test_falling_working_set_does_not_hide_private_commit_growth(self):
+        samples = complete_samples()
+        samples[-1] = sample("tabs-closed-1", 155, resident=10)
+        result = summarize(samples, 2, 180, 4)
+        self.assertEqual(len(result["violations"]), 1)
+        self.assertIn("retained", result["violations"][0])
+
+    def test_transient_peak_is_checked_even_when_all_tabs_release(self):
+        samples = complete_samples() + [sample("tabs-open-1", 300)]
+        result = summarize(samples, 2, 180, 4)
+        self.assertEqual(result["sampled_peak_private_commit_bytes"], 300 * MIB)
+        self.assertEqual(len(result["violations"]), 1)
+        self.assertIn("peak", result["violations"][0])
+
+    def test_late_release_does_not_hide_earlier_retained_growth(self):
+        samples = complete_samples()
+        samples[-1] = sample("tabs-closed-1", 155)
+        samples += [sample("settled-2", 130), sample("tabs-closed-2", 132)]
+        result = summarize(samples, 3, 180, 4)
+        self.assertGreater(result["tab_growth_after_warmup_bytes"], 4 * MIB)
+        self.assertEqual(len(result["violations"]), 1)
+
+    def test_incomplete_run_cannot_report_a_budget_pass(self):
+        with self.assertRaisesRegex(ValueError, "tabs-closed-1"):
+            summarize(complete_samples()[:-1], 2, 180, 4)
+        with self.assertRaises(ValueError):
+            summarize([], 2, 180, 4)
+
+    def test_observation_without_limits_does_not_claim_a_budget(self):
+        result = summarize(complete_samples(), 2, None, None)
+        self.assertFalse(result["budget_enforced"])
+        self.assertIsNone(result["peak_budget_mib"])
+        self.assertIsNone(result["growth_budget_mib"])
+
+    def test_resource_leak_fails_even_when_memory_is_below_budget(self):
+        checkpoints = self.checkpoints()
+        checkpoints[-1].update(handles=736, threads=128)
+        result = summarize(complete_samples(), 2, 180, 4, checkpoints=checkpoints,
+                           handle_growth_limit=8, thread_growth_limit=4)
+        self.assertEqual(result["resource_growth_after_warmup"], {"handles": 36, "threads": 8})
+        self.assertEqual(len(result["violations"]), 2)
+
+    def test_missing_resource_checkpoints_cannot_pass_resource_budgets(self):
+        with self.assertRaisesRegex(ValueError, "checkpoints"):
+            summarize(complete_samples(), 2, 180, 4, handle_growth_limit=8)
+        with self.assertRaisesRegex(ValueError, "tabs-closed-1"):
+            summarize(complete_samples(), 2, 180, 4, checkpoints=self.checkpoints()[:-1],
+                      thread_growth_limit=4)
+
+    def test_invalid_budgets_cannot_disable_the_gate(self):
+        for limit in (float("nan"), float("inf"), -1):
+            with self.subTest(limit=limit), self.assertRaises(ValueError):
+                summarize(complete_samples(), 2, limit, 4)
+
+    def test_normal_window_close_does_not_force_terminate(self):
+        process = Mock(pid=123)
+        process.poll.return_value = None
+        process.wait.side_effect = lambda **_: setattr(process.poll, "return_value", 0)
+        native = Mock()
+        result = close_owned_process(process, native)
+        self.assertTrue(result["normal_exit"])
+        self.assertFalse(result["forced_termination"])
+        process.terminate.assert_not_called()
+
+    def test_sampler_initialization_failure_still_reclaims_its_process(self):
+        process = Mock(pid=123)
+        process.poll.return_value = None
+        process.wait.side_effect = lambda **_: setattr(process.poll, "return_value", 1)
+        result = close_owned_process(process, None)
+        self.assertFalse(result["normal_exit"])
+        self.assertTrue(result["forced_termination"])
+        process.terminate.assert_called_once()
+
+    def test_a_crash_cannot_count_as_normal_cleanup(self):
+        process = Mock(pid=123)
+        process.poll.return_value = -1073741819
+        result = close_owned_process(process, Mock())
+        self.assertFalse(result["normal_exit"])
+        self.assertFalse(result["forced_termination"])
+        process.terminate.assert_not_called()
+
+    def test_hung_close_is_a_failure_even_if_forced_cleanup_succeeds(self):
+        process = Mock(pid=123)
+        process.poll.return_value = None
+
+        def wait(**_):
+            if not process.terminate.called:
+                raise subprocess.TimeoutExpired("owned test process", 15)
+            process.poll.return_value = 1
+
+        process.wait.side_effect = wait
+        result = close_owned_process(process, Mock())
+        self.assertFalse(result["normal_exit"])
+        self.assertTrue(result["forced_termination"])
+        self.assertTrue(result["errors"])
+
+
+if __name__ == "__main__":
+    unittest.main()

scripts/windows-memory-stress.md

@@ -0,0 +1,111 @@
+# Windows 产品内存压力测试
+
+`windows_memory_stress.py` 启动真实 GPUI 产品，通过真实 PTY 写入持续输出，
+再反复创建和关闭标签。它检查输出结束后内存、线程和句柄能否保持稳定。
+测试使用独立配置、工作目录和临时目录；每次输出目录必须是新目录。
+
+需要 Windows 原生 Python 3.11+，不需要第三方 Python 包。先构建真实产品：
+
+```powershell
+cargo build --release --locked -p nebula --bin pebrel --features gpui-shell
+```
+
+确认 `pebrel.exe` 同目录存在产品附带的 `conpty.dll` 和 `OpenConsole.exe`。
+后面的命令在仓库根目录运行；构建及测试输出都应放在当前环境允许的路径内。
+
+## 短回归与长测
+
+以下预算用于本机 Windows 11、144 DPI、1280 × 900 外窗、默认 10000 行历史、
+Maple Mono Normal NF CN 16 px 的回归条件。首次校准可不传预算，仅观察数据；
+未配置预算的报告会明确标为观察运行。预算一旦选定，应在前后对照中保持一致，
+超标时先定位分配和资源生命周期。
+
+```powershell
+python scripts/windows_memory_stress.py `
+  --app target/release/pebrel.exe `
+  --output tmp/memory-short-01 `
+  --cycles 8 --tabs 4 --payload-mib 11 `
+  --max-private-commit-mib 256 --max-growth-mib 16 `
+  --max-handle-growth 8 --max-thread-growth 4
+
+python scripts/windows_memory_stress.py `
+  --app target/release/pebrel.exe `
+  --output tmp/memory-long-01 `
+  --cycles 32 --tabs 4 --payload-mib 64 `
+  --max-private-commit-mib 256 --max-growth-mib 16 `
+  --max-handle-growth 8 --max-thread-growth 4
+```
+
+长测包含约 2 GiB 混合 ASCII、CJK、Nerd Font 和 ANSI 彩色输出，以及
+128 次标签关闭。每一轮输出后还写入 240 次交替屏幕重绘。
+语料按完整块向上取整，报告记录实际字节数。它不是固定帧率动画或显示 FPS 测试。
+
+程序会固定窗口大小，并从终端内读取真实行列数。比较两个程序时必须检查报告中的
+行列数相同，仅设置相同像素尺寸并不足够。测试期间应保留正常显示的窗口，避免
+输入、切换配置或调整窗口尺寸。将编译和其他高负载工作与正式测量分开。
+
+## 测量口径与通过条件
+
+| 数据 | 含义 |
+| --- | --- |
+| `private_commit_bytes` | Pebrel 自己的私有提交量，是本脚本内存预算的依据 |
+| `private_working_set_bytes` | Pebrel 当前驻留在 RAM 中的私有页面 |
+| `working_set_bytes` | 总工作集，包含驻留的共享页面，不能再与私有工作集相加 |
+| `cpu_seconds` | Pebrel 累积的用户态和内核态 CPU 时间 |
+| `handles` / `threads` | Pebrel 的句柄和线程数；线程在阶段检查点读取 |
+
+每 100 ms 采样一次。完成输出并等待稳定、或关闭新增标签并恢复单标签后，
+用该阶段最后五个内存样本的中位数比较。第一轮负责预热，后续每一轮都与它比较，
+取最大增长量；不能让最后一次回收掩盖前面某一轮的残留增长。
+
+脚本同时检查全部采样中的私有提交峰值、预热后的提交增长、句柄增长和线程增长。
+输出必须在实际终端里出现完成标记；所有阶段必须齐全。测试窗口必须恢复到一个
+标签并保持原几何状态，进程最终正常退出。任一预算超标或阶段失败均返回非零退出码。
+关闭确认失败时保留现场进程树，不自动确认关闭来绕过产品的工作保护。
+
+清理先对本次创建的窗口发送关闭请求。若失败，仅终止脚本保有句柄的那个测试进程，
+并把该次运行记为失败。不会按进程名称批量结束实例。脚本没有设置进程内存上限、
+调用工作集裁剪或生成完整内存转储。
+
+## 证据文件
+
+- `instance.json`：PID、进程创建时间、EXE SHA256、脚本 SHA256、Windows/Python
+  版本和逻辑处理器数；可通过 `--source-manifest <文件>` 同时记录源码清单的路径和 SHA256。
+- `report.json`：实际窗口/网格、每轮输出量、提交峰值、残留增长及预算结果。
+- `samples.json` / `checkpoints.json`：原始计数，即使测试中断也保存。
+  检查点还记录系统总物理内存、可用物理内存和内存负载，帮助识别页面驻留差异。
+- `failure.json` / `failure-context.json`：失败原因、所处阶段及可读到的测试实例进程树。
+- `cleanup.json`：是否正常退出，是否发生强制清理。
+- `work/*-<轮次>.json`：终端内写入程序记录的实际输出量、行列数和写入耗时。
+
+`drain_seconds` 包含 PTY 背压等待，不代表输入延迟或屏幕真正呈现的帧率。
+100 ms 采样可能错过更短的峰值。计数不含 shell、输出程序或 WSL 虚拟机；
+如需比较整个终端产品的进程组，应另行使用一致的进程归属和计数口径。
+工作集还受页面驻留、其他应用和驱动影响，不能凭它下降就宣称减少了分配。
+上述测试预算也不是应用在任意硬件、任意标签数下的运行时硬上限。
+
+## 相关回归与实现依据
+
+```powershell
+python -m unittest scripts.tests.test_windows_memory_stress
+cargo test --locked -p nebula_terminal --test windows_pty_lifecycle -- --nocapture
+cargo test --locked -p nebula --bin pebrel --features gpui-shell process_tree:: -- --test-threads=1
+```
+
+本地终端输出沿用现有有界 PTY 缓冲和有限历史网格。此次回收修复关闭了创建
+ConPTY 时遗留的调用方管道副本，让 EOF 能结束读取/排空线程；shell、主线程、
+属性表和旁加载 DLL 使用各自的所有权释放。等待回调完成或取消后才释放其上下文，
+避免把内存回收变成回调访问已释放数据。
+
+字体修复由精确固定的 GPUI 分支提供：DirectWrite 持有字体数据的 COM 所有者，
+静态字体直接使用程序映像中的字节，导入字体保留原 Vec，直到最后一个原生消费者
+释放。原生内容、指针、引用寿命测试与真实窗口字体比对属于独立验收项。
+
+Windows 会保留已经退出的父进程 PID；号码复用后，仅按 PID 连边会把无关进程
+误接到新标签上。平台适配层现在一次读取进程创建时间，公共进程树规则断开
+“父进程比子进程还年轻”的关系。缺失创建时间时保留关系，真实忙碌子进程仍受保护。
+这使用已存在的 Windows 绑定，无额外后台轮询或持久化格式。
+
+生命周期回归使用产品附带的 OpenConsole。Windows 11 build 22631 的系统内置
+ConPTY 在独立最小探针中仍出现每次创建/关闭保留一个宿主句柄的问题；本次修改
+没有修复该系统实现，也没有放宽产品回归预算去吸收它。

scripts/windows_memory_stress.py

@@ -0,0 +1,579 @@
+#!/usr/bin/env python3
+"""Exercise an isolated Windows product and sample its own memory counters."""
+
+from __future__ import annotations
+
+import argparse
+from contextlib import contextmanager
+import ctypes
+from ctypes import wintypes
+import hashlib
+import json
+import math
+import os
+from pathlib import Path
+import platform
+import statistics
+import subprocess
+import sys
+import threading
+import time
+
+if __package__ in {None, ""}:
+    sys.path.insert(0, os.fspath(Path(__file__).resolve().parent.parent))
+
+from scripts.conformance.harness import RuntimeClient
+
+
+MIB = 1024 * 1024
+
+
+def summarize(samples: list[dict], cycles: int, peak_limit: float | None,
+              growth_limit: float | None, *, checkpoints: list[dict] | None = None,
+              handle_growth_limit: int | None = None, thread_growth_limit: int | None = None) -> dict:
+    if cycles < 2 or not samples:
+        raise ValueError("at least two complete cycles and memory samples are required")
+    for limit in (peak_limit, growth_limit, handle_growth_limit, thread_growth_limit):
+        if limit is not None and (not math.isfinite(limit) or limit < 0):
+            raise ValueError("budgets must be finite and nonnegative")
+    phases = {}
+    for phase in ["idle"] + [f"settled-{n}" for n in range(cycles)] + [
+        f"tabs-closed-{n}" for n in range(cycles)
+    ]:
+        rows = [row for row in samples if row["phase"] == phase]
+        if not rows:
+            raise ValueError(f"missing measurement phase: {phase}")
+        phases[phase] = {
+            key: statistics.median(row[key] for row in rows[-5:])
+            for key in ("private_commit_bytes", "private_working_set_bytes", "working_set_bytes")
+        }
+    peak = max(row["private_commit_bytes"] for row in samples)
+    # Compare equal workloads after warmup. A falling working set cannot mask
+    # growth in committed private allocations.
+    output_growth = max(phases[f"settled-{n}"]["private_commit_bytes"] for n in range(1, cycles)) - phases["settled-0"]["private_commit_bytes"]
+    tab_growth = max(phases[f"tabs-closed-{n}"]["private_commit_bytes"] for n in range(1, cycles)) - phases["tabs-closed-0"]["private_commit_bytes"]
+    violations = []
+    if peak_limit is not None and peak > peak_limit * MIB:
+        violations.append("sampled private commit exceeded the configured peak budget")
+    if growth_limit is not None and max(output_growth, tab_growth) > growth_limit * MIB:
+        violations.append("retained private commit grew beyond the configured warm-cycle budget")
+    resources = {}
+    if checkpoints is not None:
+        for phase in phases:
+            rows = [row for row in checkpoints if row["phase"] == phase]
+            if len(rows) != 1:
+                raise ValueError(f"require one resource checkpoint for phase: {phase}")
+            resources[phase] = {key: rows[0][key] for key in ("handles", "threads")}
+    elif handle_growth_limit is not None or thread_growth_limit is not None:
+        raise ValueError("resource budgets require complete resource checkpoints")
+    resource_growth = {}
+    for key, limit in (("handles", handle_growth_limit), ("threads", thread_growth_limit)):
+        growth = None
+        if resources:
+            growth = max(
+                resources[f"{prefix}-{n}"][key] - resources[f"{prefix}-0"][key]
+                for prefix in ("settled", "tabs-closed") for n in range(1, cycles)
+            )
+        resource_growth[key] = growth
+        if limit is not None and growth > limit:
+            violations.append(f"retained {key} grew beyond the configured warm-cycle budget")
+    return {
+        "phases": phases,
+        "resource_checkpoints": resources,
+        "resource_growth_after_warmup": resource_growth,
+        "sampled_peak_private_commit_bytes": peak,
+        "sampled_peak_private_working_set_bytes": max(row["private_working_set_bytes"] for row in samples),
+        "output_growth_after_warmup_bytes": output_growth,
+        "tab_growth_after_warmup_bytes": tab_growth,
+        "peak_budget_mib": peak_limit,
+        "growth_budget_mib": growth_limit,
+        "handle_growth_budget": handle_growth_limit,
+        "thread_growth_budget": thread_growth_limit,
+        "budget_enforced": any(limit is not None for limit in (
+            peak_limit, growth_limit, handle_growth_limit, thread_growth_limit)),
+        "violations": violations,
+    }
+
+
+class NativeProcess:
+    class Counters(ctypes.Structure):
+        _fields_ = [("size", wintypes.DWORD), ("page_faults", wintypes.DWORD)] + [
+            (name, ctypes.c_size_t) for name in (
+                "peak_working_set", "working_set", "peak_paged_pool", "paged_pool",
+                "peak_nonpaged_pool", "nonpaged_pool", "pagefile", "peak_pagefile",
+                "private_usage", "private_working_set", "shared_commit",
+            )
+        ]
+
+    class SystemMemory(ctypes.Structure):
+        _fields_ = [("length", wintypes.DWORD), ("load", wintypes.DWORD)] + [
+            (name, ctypes.c_ulonglong) for name in (
+                "total_physical", "available_physical", "total_pagefile", "available_pagefile",
+                "total_virtual", "available_virtual", "available_extended_virtual",
+            )
+        ]
+
+    def __init__(self, process: subprocess.Popen, executable: Path):
+        self.process = process
+        self.kernel = ctypes.WinDLL("kernel32", use_last_error=True)
+        self.user = ctypes.WinDLL("user32", use_last_error=True)
+        self.kernel.OpenProcess.argtypes = [wintypes.DWORD, wintypes.BOOL, wintypes.DWORD]
+        self.kernel.OpenProcess.restype = wintypes.HANDLE
+        self.kernel.CloseHandle.argtypes = [wintypes.HANDLE]
+        self.kernel.K32GetProcessMemoryInfo.argtypes = [wintypes.HANDLE, ctypes.POINTER(self.Counters), wintypes.DWORD]
+        self.kernel.QueryFullProcessImageNameW.argtypes = [wintypes.HANDLE, wintypes.DWORD, wintypes.LPWSTR, ctypes.POINTER(wintypes.DWORD)]
+        self.kernel.GetProcessTimes.argtypes = [wintypes.HANDLE] + [ctypes.POINTER(wintypes.FILETIME)] * 4
+        self.kernel.GetProcessHandleCount.argtypes = [wintypes.HANDLE, ctypes.POINTER(wintypes.DWORD)]
+        self.kernel.GlobalMemoryStatusEx.argtypes = [ctypes.POINTER(self.SystemMemory)]
+        self.handle = self.kernel.OpenProcess(0x1010, False, process.pid)
+        if not self.handle:
+            raise ctypes.WinError(ctypes.get_last_error())
+        try:
+            image = ctypes.create_unicode_buffer(32768)
+            length = wintypes.DWORD(len(image))
+            if not self.kernel.QueryFullProcessImageNameW(self.handle, 0, image, ctypes.byref(length)):
+                raise ctypes.WinError(ctypes.get_last_error())
+            if Path(image.value).resolve() != executable.resolve():
+                raise RuntimeError("the launched PID does not match the test executable")
+        except BaseException:
+            self.close()
+            raise
+        self.user.SetThreadDpiAwarenessContext.argtypes = [wintypes.HANDLE]
+        self.user.SetThreadDpiAwarenessContext.restype = wintypes.HANDLE
+        self.user.SetThreadDpiAwarenessContext(ctypes.c_void_p(-4))
+        self.user.GetWindowThreadProcessId.argtypes = [wintypes.HWND, ctypes.POINTER(wintypes.DWORD)]
+        self.user.IsWindowVisible.argtypes = [wintypes.HWND]
+        self.user.IsIconic.argtypes = [wintypes.HWND]
+        self.user.GetClientRect.argtypes = [wintypes.HWND, ctypes.POINTER(wintypes.RECT)]
+        self.user.GetWindowRect.argtypes = [wintypes.HWND, ctypes.POINTER(wintypes.RECT)]
+        self.user.GetDpiForWindow.argtypes = [wintypes.HWND]
+        self.user.SetWindowPos.argtypes = [wintypes.HWND, wintypes.HWND, ctypes.c_int, ctypes.c_int, ctypes.c_int, ctypes.c_int, wintypes.UINT]
+        self.user.PostMessageW.argtypes = [wintypes.HWND, wintypes.UINT, wintypes.WPARAM, wintypes.LPARAM]
+
+    def window(self) -> int:
+        found = []
+        callback_type = ctypes.WINFUNCTYPE(wintypes.BOOL, wintypes.HWND, wintypes.LPARAM)
+
+        @callback_type
+        def visit(window, _):
+            owner = wintypes.DWORD()
+            self.user.GetWindowThreadProcessId(window, ctypes.byref(owner))
+            if owner.value == self.process.pid and self.user.IsWindowVisible(window):
+                rect = wintypes.RECT()
+                self.user.GetClientRect(window, ctypes.byref(rect))
+                found.append(((rect.right - rect.left) * (rect.bottom - rect.top), window))
+            return True
+
+        self.user.EnumWindows.argtypes = [callback_type, wintypes.LPARAM]
+        self.user.EnumWindows(visit, 0)
+        if not found:
+            raise RuntimeError("the test process has no visible window")
+        return max(found)[1]
+
+    def resize(self, width: int, height: int) -> None:
+        if not self.user.SetWindowPos(self.window(), None, 0, 0, width, height, 0x16):
+            raise ctypes.WinError(ctypes.get_last_error())
+
+    def geometry(self) -> dict:
+        window = self.window()
+        client, outer = wintypes.RECT(), wintypes.RECT()
+        self.user.GetClientRect(window, ctypes.byref(client))
+        self.user.GetWindowRect(window, ctypes.byref(outer))
+        return {"client_width": client.right - client.left, "client_height": client.bottom - client.top,
+                "outer_width": outer.right - outer.left, "outer_height": outer.bottom - outer.top,
+                "dpi": self.user.GetDpiForWindow(window), "minimized": bool(self.user.IsIconic(window))}
+
+    def sample(self) -> dict:
+        counters = self.Counters()
+        counters.size = ctypes.sizeof(counters)
+        if not self.kernel.K32GetProcessMemoryInfo(self.handle, ctypes.byref(counters), counters.size):
+            raise ctypes.WinError(ctypes.get_last_error())
+        created, exited, kernel, user = (wintypes.FILETIME() for _ in range(4))
+        if not self.kernel.GetProcessTimes(self.handle, *map(ctypes.byref, (created, exited, kernel, user))):
+            raise ctypes.WinError(ctypes.get_last_error())
+        ticks = lambda value: value.dwHighDateTime * 2**32 + value.dwLowDateTime
+        handles = wintypes.DWORD()
+        if not self.kernel.GetProcessHandleCount(self.handle, ctypes.byref(handles)):
+            raise ctypes.WinError(ctypes.get_last_error())
+        return {"private_commit_bytes": counters.private_usage,
+                "private_working_set_bytes": counters.private_working_set,
+                "working_set_bytes": counters.working_set,
+                "cpu_seconds": (ticks(kernel) + ticks(user)) / 10_000_000,
+                "handles": handles.value,
+                "created_filetime": ticks(created)}
+
+    def thread_count(self) -> int:
+        class ThreadEntry(ctypes.Structure):
+            _fields_ = [(name, wintypes.DWORD) for name in ("size", "usage", "thread_id", "process_id")] + [
+                ("base_priority", wintypes.LONG), ("delta_priority", wintypes.LONG), ("flags", wintypes.DWORD)
+            ]
+        self.kernel.CreateToolhelp32Snapshot.argtypes = [wintypes.DWORD, wintypes.DWORD]
+        self.kernel.CreateToolhelp32Snapshot.restype = wintypes.HANDLE
+        self.kernel.Thread32First.argtypes = [wintypes.HANDLE, ctypes.POINTER(ThreadEntry)]
+        self.kernel.Thread32Next.argtypes = [wintypes.HANDLE, ctypes.POINTER(ThreadEntry)]
+        snapshot = self.kernel.CreateToolhelp32Snapshot(4, 0)
+        if snapshot == ctypes.c_void_p(-1).value:
+            raise ctypes.WinError(ctypes.get_last_error())
+        count = 0
+        try:
+            entry = ThreadEntry()
+            entry.size = ctypes.sizeof(entry)
+            valid = self.kernel.Thread32First(snapshot, ctypes.byref(entry))
+            while valid:
+                count += entry.process_id == self.process.pid
+                valid = self.kernel.Thread32Next(snapshot, ctypes.byref(entry))
+            if ctypes.get_last_error() != 18:
+                raise ctypes.WinError(ctypes.get_last_error())
+            return count
+        finally:
+            self.kernel.CloseHandle(snapshot)
+
+    def system_memory(self) -> dict:
+        status = self.SystemMemory()
+        status.length = ctypes.sizeof(status)
+        if not self.kernel.GlobalMemoryStatusEx(ctypes.byref(status)):
+            raise ctypes.WinError(ctypes.get_last_error())
+        return {"physical_total_bytes": status.total_physical,
+                "physical_available_bytes": status.available_physical,
+                "memory_load_percent": status.load}
+
+    def close(self) -> None:
+        if self.handle:
+            self.kernel.CloseHandle(self.handle)
+            self.handle = None
+
+
+def close_owned_process(process, native) -> dict:
+    """Prefer WM_CLOSE; a forced cleanup is a test failure, never a budget pass."""
+    result = {"pid": process.pid, "normal_exit": False, "forced_termination": False, "errors": []}
+    if process.poll() is None and native is not None:
+        try:
+            if not native.user.PostMessageW(native.window(), 0x10, 0, 0):
+                raise RuntimeError("WM_CLOSE was rejected")
+            process.wait(timeout=15)
+        except (OSError, RuntimeError, subprocess.TimeoutExpired) as error:
+            result["errors"].append(str(error))
+    result["normal_exit"] = process.poll() == 0
+    if process.poll() is None:
+        result["forced_termination"] = True
+        try:
+            # Popen retains the handle to the exact process we created. Do not
+            # search by executable name or touch another instance's children.
+            process.terminate()
+            process.wait(timeout=15)
+        except (OSError, subprocess.TimeoutExpired) as error:
+            result["errors"].append(str(error))
+    result["returncode"] = process.poll()
+    return result
+
+
+@contextmanager
+def isolated_process(executable: Path, work: Path, env: dict, output: Path):
+    with (output / "product.log").open("wb") as log:
+        process = subprocess.Popen(
+            [os.fspath(executable), "--gpui", "--working-directory", os.fspath(work),
+             "-e", os.path.join(os.environ["SystemRoot"], "System32", "cmd.exe"), "/d", "/q"],
+            cwd=work, env=env, stdout=log, stderr=subprocess.STDOUT,
+        )
+        native = None
+        try:
+            native = NativeProcess(process, executable)
+            yield process, native
+        except BaseException as error:
+            (output / "failure.json").write_text(
+                json.dumps({"pid": process.pid, "error": str(error)}, indent=2), encoding="utf-8")
+            raise
+        finally:
+            cleanup = close_owned_process(process, native)
+            if native is not None:
+                native.close()
+            (output / "cleanup.json").write_text(json.dumps(cleanup, indent=2), encoding="utf-8")
+            report_path = output / "report.json"
+            if report_path.exists():
+                report = json.loads(report_path.read_text(encoding="utf-8"))
+                report["cleanup"] = cleanup
+                if not cleanup["normal_exit"]:
+                    report["summary"]["violations"].append("the owned test process did not close normally")
+                report_path.write_text(json.dumps(report, indent=2), encoding="utf-8")
+                if not cleanup["normal_exit"]:
+                    raise RuntimeError(f"test process cleanup failed: {cleanup}")
+
+
+def writer(args: argparse.Namespace) -> None:
+    if os.name == "nt":
+        import msvcrt
+        if not ctypes.windll.kernel32.SetConsoleOutputCP(65001):
+            raise ctypes.WinError()
+        msvcrt.setmode(sys.stdout.fileno(), os.O_BINARY)
+    grid = os.get_terminal_size(sys.stdout.fileno())
+    started = time.perf_counter()
+    byte_count = 0
+    with Path(args.payload).open("rb") as stream:
+        while chunk := stream.read(65536):
+            remaining = memoryview(chunk)
+            while remaining:
+                written = os.write(sys.stdout.fileno(), remaining)
+                if written <= 0:
+                    raise RuntimeError("terminal output stopped accepting bytes")
+                byte_count += written
+                remaining = remaining[written:]
+    elapsed = time.perf_counter() - started
+    marker = "PEBREL_STRESS_COMPLETED_" + Path(args.result).stem
+    os.write(sys.stdout.fileno(), ("\r\n" + marker + "\r\n").encode())
+    Path(args.result).write_text(json.dumps({"bytes": byte_count, "drain_seconds": elapsed, "marker": marker,
+                                           "columns": grid.columns, "rows": grid.lines}), encoding="utf-8")
+
+
+def corpus(directory: Path, mebibytes: int) -> tuple[Path, Path]:
+    text = directory / "mixed-output.txt"
+    rows = []
+    for index in range(512):
+        cjk = "".join(chr(0x4E00 + (index * 16 + offset) % 4096) for offset in range(16))
+        rows.append(f"\x1b[38;5;{index % 256}m{index:04d} ascii 0123456789 {cjk} \ue0b0 \uf120 \uf07b\x1b[0m\r\n")
+    block = "".join(rows).encode("utf-8")
+    with text.open("wb") as stream:
+        for _ in range((mebibytes * MIB + len(block) - 1) // len(block)):
+            stream.write(block)
+    redraw = directory / "redraw.txt"
+    with redraw.open("wb") as stream:
+        stream.write(b"\x1b[?1049h\x1b[?25l")
+        for frame in range(240):
+            stream.write(b"\x1b[H")
+            for row in range(24):
+                stream.write((f"\x1b[38;5;{(frame + row) % 256}m" + "▀▄" * 40 + "\x1b[0m\r\n").encode("utf-8"))
+        stream.write(b"\x1b[?25h\x1b[?1049l")
+    return text, redraw
+
+
+def run(args: argparse.Namespace) -> int:
+    if os.name != "nt":
+        raise RuntimeError("this sampler requires native Windows Python")
+    executable, output = Path(args.app).resolve(), Path(args.output).resolve()
+    output.mkdir(parents=True, exist_ok=False)
+    config, work, temporary = (output / name for name in ("config", "work", "temp"))
+    for directory in (config, work, temporary):
+        directory.mkdir()
+    settings = ["shell=cmd", "language=en", "theme=SilverLight", "follow_system_theme=0",
+                "font_family=Maple Mono Normal NF CN", "font_size=16", "keep_session=0",
+                "restore_session=0", "resume_ai=0", "tray=0", "ai_hooks=0", "ai_toasts=0",
+                "fetch=0", "powerline=0", "auto_check_updates=0", "quick_terminal_hotkey=",
+                "opacity=1", "blur=0", "windowing_behavior=use_new"]
+    (config / "pebrel_settings.txt").write_text("\n".join(settings) + "\n", encoding="utf-8")
+    (config / "pebrel.toml").write_text("# Isolated memory stress configuration.\n", encoding="utf-8")
+    payloads = corpus(work, args.payload_mib)
+    env = {key: value for key, value in os.environ.items() if not key.startswith(("PEBREL_", "NEBULA_", "GPUI_"))}
+    for prefix in ("PEBREL", "NEBULA"):
+        env[prefix + "_CONFIG_DIR"] = os.fspath(config)
+        env[prefix + "_GPUI_CONFIG"] = os.fspath(config / "pebrel.toml")
+        env[prefix + "_CONFIG_FILE"] = os.fspath(config / "pebrel.toml")
+    env.update(TEMP=os.fspath(temporary), TMP=os.fspath(temporary), PYTHONUTF8="1")
+    with isolated_process(executable, work, env, output) as (process, native):
+        return measure(args, process, native, executable, output, config, work, payloads)
+
+
+def measure(args, process, native, executable, output, config, work, payloads) -> int:
+    with executable.open("rb") as binary:
+        executable_hash = hashlib.file_digest(binary, "sha256").hexdigest()
+    source_manifest = None
+    if args.source_manifest:
+        path = Path(args.source_manifest).resolve()
+        source_manifest = {"path": os.fspath(path), "sha256": hashlib.sha256(path.read_bytes()).hexdigest()}
+    identity = {"pid": process.pid, "executable": os.fspath(executable),
+                "sha256": executable_hash,
+                "source_manifest": source_manifest,
+                "harness_sha256": hashlib.sha256(Path(__file__).read_bytes()).hexdigest(),
+                "python_version": platform.python_version(),
+                "windows_version": platform.version(), "machine": platform.machine(),
+                "logical_processors": os.cpu_count(), "system_memory": native.system_memory(),
+                **native.sample()}
+    (output / "instance.json").write_text(json.dumps(identity, indent=2), encoding="utf-8")
+    samples, runs, sampler_errors, checkpoints = [], [], [], []
+    stop = threading.Event()
+    phase = "startup"
+    started = time.monotonic()
+
+    def sample_loop():
+        while not stop.is_set():
+            try:
+                samples.append({"elapsed_seconds": time.monotonic() - started, "phase": phase, **native.sample()})
+            except OSError as error:
+                sampler_errors.append(str(error))
+                return
+            stop.wait(0.1)
+
+    sampler = threading.Thread(target=sample_loop, daemon=True)
+    sampler.start()
+    client = None
+    window_id = None
+
+    def checkpoint():
+        row = {"phase": phase, "pid": process.pid, "elapsed_seconds": time.monotonic() - started,
+               "threads": native.thread_count(), "system_memory": native.system_memory(), **native.sample()}
+        checkpoints.append(row)
+        print(json.dumps(row), flush=True)
+    try:
+        deadline = time.monotonic() + 45
+        while time.monotonic() < deadline:
+            if process.poll() is not None:
+                raise RuntimeError(f"the product exited during startup: {process.returncode}")
+            try:
+                client = RuntimeClient.from_port_file(config / "runtime.port")
+                snapshot = client.request("runtime.snapshot")["result"]
+                window = snapshot["windows"][0]
+                pane_id = window["tabs"][0]["panes"][0]["id"]
+                window_id = window["id"]
+                if snapshot.get("process_id") != process.pid:
+                    raise RuntimeError("runtime endpoint belongs to a different process")
+                break
+            except (OSError, KeyError, IndexError):
+                time.sleep(0.2)
+        else:
+            raise RuntimeError("the isolated runtime did not become ready")
+        native.resize(args.width, args.height)
+        time.sleep(5)
+        geometry = native.geometry()
+        phase = "idle"
+        time.sleep(10)
+        checkpoint()
+
+        def request(method, params=None):
+            return client.request(method, params or {}, timeout=15)["result"]
+
+        def prompt(command):
+            return request("pane.prompt", {"window_id": window_id, "pane_id": pane_id, "text": command, "submit": True})
+
+        prompt("chcp 65001 >nul")
+        time.sleep(0.5)
+        for cycle in range(args.cycles):
+            for kind, payload in zip(("output", "redraw"), payloads):
+                phase = f"{kind}-{cycle}"
+                result_path = work / f"{kind}-{cycle}.json"
+                command = subprocess.list2cmdline([sys.executable, "-I", os.fspath(Path(__file__).resolve()),
+                                                   "--writer", "--payload", os.fspath(payload), "--result", os.fspath(result_path)])
+                prompt(command)
+                deadline = time.monotonic() + 120
+                while time.monotonic() < deadline:
+                    if result_path.is_file():
+                        try:
+                            result = json.loads(result_path.read_text(encoding="utf-8"))
+                        except json.JSONDecodeError:
+                            time.sleep(0.1)
+                            continue
+                        read = request("pane.read", {"window_id": window_id, "pane_id": pane_id, "lines": 80})
+                        if result["marker"] in read["text"].splitlines():
+                            runs.append({"kind": kind, "cycle": cycle, "history_available": read["history_available"], **result})
+                            break
+                    time.sleep(0.1)
+                else:
+                    raise RuntimeError(f"{phase} did not finish in the terminal")
+            phase = f"settled-{cycle}"
+            time.sleep(args.settle_seconds)
+            checkpoint()
+
+        for cycle in range(args.cycles):
+            phase = f"tabs-open-{cycle}"
+            for _ in range(args.tabs):
+                request("tab.new", {"window_id": window_id, "cwd": os.fspath(work)})
+            time.sleep(2)
+            snapshot = request("runtime.snapshot")
+            window = next(value for value in snapshot["windows"] if value["id"] == window_id)
+            if len(window["tabs"]) != args.tabs + 1:
+                raise RuntimeError("the tab stress did not create the expected live tabs")
+            for tab in sorted(window["tabs"], key=lambda value: value["index"], reverse=True):
+                if tab["index"] != 0:
+                    request("tab.close", {"window_id": window_id, "tab_index": tab["index"]})
+            phase = f"tabs-closed-{cycle}"
+            time.sleep(args.settle_seconds)
+            snapshot = request("runtime.snapshot")
+            window = next(value for value in snapshot["windows"] if value["id"] == window_id)
+            if len(window["tabs"]) != 1:
+                raise RuntimeError("closing the test tabs did not restore one tab")
+            checkpoint()
+        if sampler_errors:
+            raise RuntimeError(f"native sampling failed: {sampler_errors}")
+        stop.set()
+        sampler.join()
+        result = summarize(samples, args.cycles, args.max_private_commit_mib, args.max_growth_mib,
+                           checkpoints=checkpoints, handle_growth_limit=args.max_handle_growth,
+                           thread_growth_limit=args.max_thread_growth)
+        grids = {(row["columns"], row["rows"]) for row in runs}
+        if len(grids) != 1:
+            raise RuntimeError(f"the workload grid changed during the run: {grids}")
+        final_geometry = native.geometry()
+        if final_geometry != geometry or final_geometry["minimized"]:
+            raise RuntimeError(f"test window geometry changed: {geometry} -> {final_geometry}")
+        report = {"identity": identity, "geometry": geometry, "cycles": args.cycles, "tabs_per_cycle": args.tabs,
+                  "sampling_interval_seconds": 0.1, "runs": runs, "checkpoints": checkpoints, "summary": result,
+                  "notes": ["Counters belong to Pebrel only; shell and writer children are excluded.",
+                            "Drain time includes PTY backpressure; it is not displayed FPS or input latency.",
+                            "A 100 ms sample interval can miss shorter memory peaks.",
+                            "No working-set trimming, process memory limit, or full-memory dump is used."]}
+        (output / "report.json").write_text(json.dumps(report, indent=2), encoding="utf-8")
+        print(json.dumps(result), flush=True)
+        return 1 if result["violations"] else 0
+    except BaseException:
+        context = {"phase": phase, "elapsed_seconds": time.monotonic() - started}
+        if client is not None:
+            try:
+                snapshot = client.request("runtime.snapshot", timeout=2)["result"]
+                context["runtime"] = snapshot
+                context["pane_processes"] = []
+                for window in snapshot["windows"]:
+                    if window["id"] != window_id:
+                        continue
+                    for tab in window["tabs"]:
+                        for pane in tab["panes"]:
+                            try:
+                                tree = client.request("pane.processes", {
+                                    "window_id": window_id, "pane_id": pane["id"],
+                                }, timeout=2)
+                            except (OSError, RuntimeError) as error:
+                                tree = {"error": str(error)}
+                            context["pane_processes"].append({"pane_id": pane["id"], "tree": tree})
+            except (OSError, RuntimeError, KeyError) as error:
+                context["diagnostic_error"] = str(error)
+        (output / "failure-context.json").write_text(json.dumps(context, indent=2), encoding="utf-8")
+        raise
+    finally:
+        stop.set()
+        sampler.join(timeout=2)
+        (output / "samples.json").write_text(json.dumps(samples, indent=2), encoding="utf-8")
+        (output / "checkpoints.json").write_text(json.dumps(checkpoints, indent=2), encoding="utf-8")
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--writer", action="store_true", help=argparse.SUPPRESS)
+    parser.add_argument("--payload", help=argparse.SUPPRESS)
+    parser.add_argument("--result", help=argparse.SUPPRESS)
+    parser.add_argument("--app")
+    parser.add_argument("--output")
+    parser.add_argument("--source-manifest", help="source hashes associated with the test executable")
+    parser.add_argument("--cycles", type=int, default=5)
+    parser.add_argument("--tabs", type=int, default=4)
+    parser.add_argument("--payload-mib", type=int, default=11)
+    parser.add_argument("--settle-seconds", type=float, default=3)
+    parser.add_argument("--width", type=int, default=1280)
+    parser.add_argument("--height", type=int, default=900)
+    parser.add_argument("--max-private-commit-mib", type=float)
+    parser.add_argument("--max-growth-mib", type=float)
+    parser.add_argument("--max-handle-growth", type=int)
+    parser.add_argument("--max-thread-growth", type=int)
+    args = parser.parse_args()
+    if args.writer:
+        writer(args)
+        return 0
+    if not args.app or not args.output:
+        parser.error("--app and a fresh --output directory are required")
+    if args.cycles < 2 or args.tabs < 1 or args.payload_mib < 1 or not math.isfinite(args.settle_seconds) or args.settle_seconds < 1:
+        parser.error("require cycles >= 2, tabs >= 1, payload-mib >= 1, settle-seconds >= 1")
+    if min(args.width, args.height) < 200:
+        parser.error("window width and height must be at least 200 pixels")
+    for limit in (args.max_private_commit_mib, args.max_growth_mib, args.max_handle_growth, args.max_thread_growth):
+        if limit is not None and (not math.isfinite(limit) or limit < 0):
+            parser.error("budgets must be finite and nonnegative")
+    return run(args)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())