@@ -103,6 +103,30 @@ test('a failed or thrown CIM query is unknown evidence, as a failed ps is', () =
   });
 });
 
+test('the CIM row body never lets one null field raise, and pins the invariant culture', () => {
+  windowsPlatform(() => {
+    // The System Idle Process has no CreationDate. Formatting that row must
+    // print an empty stamp, not raise: a terminating error mid-pipeline exits
+    // 1 and blanks the ENTIRE snapshot, turning one odd process into unknown
+    // evidence for every pid.
+    cimAnswers(`0|0||System Idle Process\r\n4343|4321||cmd.exe\r\n${DAEMON_ROW}\r\n`);
+    const observations = readHostProcessIdentityObservations([DAEMON_PID, 4343]);
+    assert.deepEqual(observations.get(DAEMON_PID), { state: 'R', startTime: DAEMON_START });
+    assert.equal(
+      observations.get(4343),
+      undefined,
+      'a null-birth row is unknown, not a false birth',
+    );
+  });
+  const command = String(mockRunCmdSync.mock.calls[0]![1][3]);
+  assert.match(command, /if \(\$_\.CreationDate\)/, 'null birth prints empty instead of raising');
+  assert.match(
+    command,
+    /CultureInfo\]::InvariantCulture/,
+    'custom format follows the host calendar',
+  );
+});
+
 test('the Windows batch snapshot answers one observation query for every selected pid', () => {
   windowsPlatform(() => {
     cimAnswers(
@@ -161,7 +185,7 @@ test('the Windows process list parses CIM rows through the injected command runn
       runCommand: async (cmd, args, options) => {
         calls.push({ cmd, args, timeoutMs: options.timeoutMs });
         return {
-          stdout: `\uFEFF${DAEMON_ROW}\r\n0|0||\r\nnot a row\r\n`,
+          stdout: `\uFEFF0|0||System Idle Process\r\n${DAEMON_ROW}\r\n0|0||\r\nnot a row\r\n`,
           stderr: '',
           exitCode: 0,
         };
 
@@ -258,14 +258,22 @@ function isWindowsHostPlatform(): boolean {
   return hostPlatform() === 'win32';
 }
 
-// Rows are `pid|ppid|creation|command` with a culture-invariant UTC creation
-// stamp, so the value recorded in daemon.json compares equal on every read of
-// the same process lifetime. Newlines inside a command line are flattened so
+// Rows are `pid|ppid|creation|command`. The creation stamp is formatted with
+// the invariant culture, so the value recorded in daemon.json compares equal
+// on every read of the same process lifetime regardless of host locale. The
+// row rule is that a null field prints empty and never raises: the CIM table
+// carries rows without a CreationDate (the System Idle Process), and a
+// terminating error mid-pipeline would exit 1 and blank the whole snapshot
+// instead of that one row. Newlines inside a command line are flattened so
 // one process is one row; the command may still contain `|`, which only ever
 // lands in the final capture group.
 const WINDOWS_PROCESS_ROW_BODY =
-  " | ForEach-Object { '{0}|{1}|{2}|{3}' -f $_.ProcessId, $_.ParentProcessId," +
-  " $_.CreationDate.ToUniversalTime().ToString('yyyyMMddHHmmssfffffff')," +
+  ' | ForEach-Object {' +
+  ' $birth = if ($_.CreationDate) {' +
+  " $_.CreationDate.ToUniversalTime().ToString('yyyyMMddHHmmssfffffff'," +
+  ' [System.Globalization.CultureInfo]::InvariantCulture)' +
+  " } else { '' };" +
+  " '{0}|{1}|{2}|{3}' -f $_.ProcessId, $_.ParentProcessId, $birth," +
   String.raw` ($_.CommandLine -replace '[\r\n]+', ' ') }`;
 
 function windowsProcessQueryArgs(pids: readonly number[]): string[] {
 
@@ -166,6 +166,42 @@ test('startup interrupts an exact simctl recorder before clearing its record', a
   }
 });
 
+test('startup treats a zombie identity as missing without signaling it', async () => {
+  // The reaper asks one identity read the zombie question, and a zombie has
+  // already terminated: it is cleaned as missing, never signaled. Before this
+  // case the fixture could seed zombiePids but never did, so every facts.zombie
+  // branch ran uncovered.
+  const stateDir = mkdtempForTestSync('agent-device-owned-process-zombie-reap-');
+  const store = createOwnedProcessRecordStore({
+    stateDir,
+    sessionsDir: path.join(stateDir, 'sessions'),
+    resolveSessionDir: (sessionId) => path.join(stateDir, 'sessions', sessionId),
+  });
+  const record = {
+    pid: 303,
+    startTime: 'start-303',
+    command: 'command-303',
+    purpose: 'managed-web-browser',
+  };
+  processState.alive.add(record.pid);
+  processState.zombiePids.add(record.pid);
+  processState.starts.set(record.pid, record.startTime);
+  processState.commands.set(record.pid, record.command);
+  const killSpy = vi.spyOn(process, 'kill').mockImplementation(() => true);
+
+  try {
+    store.replace({ kind: 'daemon' }, [record]);
+
+    const summary = await reapOwnedProcessRecordsAtStartup(store);
+
+    assert.deepEqual(summary.missingPids, [record.pid]);
+    assert.equal(killSpy.mock.calls.length, 0);
+    assert.equal(store.read().length, 0);
+  } finally {
+    fs.rmSync(stateDir, { recursive: true, force: true });
+  }
+});
+
 test('startup retains a record when the pid identity was reused', async () => {
   const stateDir = mkdtempForTestSync('agent-device-owned-process-reuse-');
   const store = createOwnedProcessRecordStore({
 
@@ -84,3 +84,11 @@ test('a pid outside the native range is unknown without a liveness probe', () =>
   assert.equal(mockIsProcessZombie.mock.calls.length, 0);
   assert.equal(mockReadProcessStartTime.mock.calls.length, 0);
 });
+
+test('the snapshot path probes liveness for the owner pid exactly once', () => {
+  // The guards were once duplicated across the snapshot entry and the shared
+  // judge, paying two kill(pid, 0) per poll on the very path whose single
+  // snapshot exists to stop double probing.
+  assert.equal(classifyOwnerLiveness({ owner: { pid: OWNER_PID, startTime: 'start-a' } }), 'live');
+  assert.equal(mockIsProcessAlive.mock.calls.length, 1);
+});
@@ -74,11 +74,11 @@ export function classifyOwnerLiveness(params: {
   // read as two probes double the cost of every lock-ownership poll on hosts
   // where a probe starts a fresh process tool, and one snapshot also judges both
   // facts at the same instant instead of stitching two separate host answers.
-  if (!isProcessPid(params.owner.pid)) return 'unknown';
-  if (!isProcessAlive(params.owner.pid)) return 'owner-process-dead';
+  const guarded = guardOwnerPid(params.owner);
+  if (guarded) return guarded;
   const observation =
     readHostProcessIdentityObservations([params.owner.pid]).get(params.owner.pid) ?? null;
-  return classifyOwnerLivenessFromObservation(params, observation);
+  return classifyLiveOwnerFromObservation(params, observation);
 }
 
 export function classifyOwnerLivenessFromObservation(
@@ -88,9 +88,29 @@ export function classifyOwnerLivenessFromObservation(
   },
   observation?: HostProcessIdentityObservation | null,
 ): OwnerLiveness {
-  const { owner, stateDir } = params;
+  // The snapshot was taken before this call, so the guards run again here: a
+  // claim whose owner died between snapshot and judgment must read dead.
+  const guarded = guardOwnerPid(params.owner);
+  if (guarded) return guarded;
+  return classifyLiveOwnerFromObservation(params, observation);
+}
+
+/** The verdicts provable from the pid alone; undefined means the caller may probe on. */
+function guardOwnerPid(owner: Pick<OwnerIdentity, 'pid' | 'startTime'>): OwnerLiveness | undefined {
   if (!isProcessPid(owner.pid)) return 'unknown';
   if (!isProcessAlive(owner.pid)) return 'owner-process-dead';
+  return undefined;
+}
+
+/** Judges an owner the caller has established as a live, valid pid; probes no liveness. */
+function classifyLiveOwnerFromObservation(
+  params: {
+    owner: Pick<OwnerIdentity, 'pid' | 'startTime'>;
+    stateDir?: string;
+  },
+  observation?: HostProcessIdentityObservation | null,
+): OwnerLiveness {
+  const { owner, stateDir } = params;
   if (observation !== undefined ? observation?.state.startsWith('Z') : isProcessZombie(owner.pid)) {
     return 'owner-process-dead';
   }