@@ -170,19 +170,21 @@ const STOP_CASES: HostCase[] = [
   },
   {
     // Windows hides only the command line of an elevated or other-user process, and that is the #3540
-    // companion: it must be signaled and retained, never reported stopped.
+    // companion. With one recorded claim unread its lifetime is unconfirmed: it is retained, never
+    // signaled, and never reported stopped.
     name: 'recorded process hides its command line, as an elevated one does',
     identity: { command: null },
     ...DENIED_ON_TERM,
     ...HELD,
-    expect: REFUSED_ON_TERM,
+    expect: UNVERIFIED,
   },
   {
+    // The start-time and command reads fail independently: a matching command beside a start time
+    // the host did not answer is not a confirmed lifetime.
     name: 'recorded process hides its start time',
     identity: { startTime: null },
-    ...DENIED_ON_TERM,
     ...HELD,
-    expect: REFUSED_ON_TERM,
+    expect: UNVERIFIED,
   },
   {
     // POSIX `hidepid`, a `ps` that times out, or a Windows process that exited while its object still
 
@@ -138,33 +138,60 @@ test('captureHostEnvironment copies the environment and reads the working direct
   assert.equal(source.cwd.mock.calls.length, 1);
 });
 
-test('judgeProcessIdentity reads a command mismatch as reassigned only when no start time was recorded', () => {
-  const matches = (command: string) => command === 'recorded';
-  const facts = (startTime: string | null, command: string | null) => ({
-    startTime,
-    command,
-    zombie: false,
-  });
-  assert.equal(judgeProcessIdentity({ matches }, facts('S1', 'other')), 'reassigned');
-  assert.equal(
-    judgeProcessIdentity({ startTime: 'S1', matches }, facts('S1', 'other')),
+// One row per verdict rule: `ours` needs every recorded claim read and matching.
+test.each([
+  ['both claims read and matching', { startTime: 'S1', matches: true }, ['S1', 'recorded'], 'ours'],
+  ['only a start time recorded, read and matching', { startTime: 'S1' }, ['S1', null], 'ours'],
+  ['only a command recorded, read and matching', { matches: true }, [null, 'recorded'], 'ours'],
+  [
+    'a matching command beside an unread start time',
+    { startTime: 'S1', matches: true },
+    [null, 'recorded'],
     'unverified',
-  );
-  assert.equal(
-    judgeProcessIdentity({ startTime: 'S1', matches }, facts(null, 'other')),
+  ],
+  [
+    'a matching start time beside an unread command',
+    { startTime: 'S1', matches: true },
+    ['S1', null],
     'unverified',
-  );
-  assert.equal(
-    judgeProcessIdentity({ startTime: 'S1', matches }, facts('S2', 'recorded')),
+  ],
+  ['nothing read', { startTime: 'S1', matches: true }, [null, null], 'unverified'],
+  ['nothing recorded', {}, ['S1', 'recorded'], 'unverified'],
+  [
+    'a recorded start time beside a mismatching command',
+    { startTime: 'S1', matches: true },
+    ['S1', 'other'],
+    'unverified',
+  ],
+  [
+    'an unread recorded start time beside a mismatching command',
+    { startTime: 'S1', matches: true },
+    [null, 'other'],
+    'unverified',
+  ],
+  [
+    'a contradicted start time',
+    { startTime: 'S1', matches: true },
+    ['S2', 'recorded'],
     'reassigned',
-  );
-  assert.equal(judgeProcessIdentity({ startTime: 'S1', matches }, facts('S1', 'recorded')), 'ours');
-  assert.equal(judgeProcessIdentity({ startTime: 'S1', matches }, facts(null, null)), 'unverified');
+  ],
+  [
+    'a mismatching command with no start time recorded',
+    { matches: true },
+    ['S1', 'other'],
+    'reassigned',
+  ],
+] as const)('judgeProcessIdentity: %s', (_name, recorded, [startTime, command], verdict) => {
+  const expected = {
+    ...('startTime' in recorded ? { startTime: recorded.startTime } : {}),
+    ...('matches' in recorded ? { matches: (observed: string) => observed === 'recorded' } : {}),
+  };
+  assert.equal(judgeProcessIdentity(expected, { startTime, command, zombie: false }), verdict);
+});
+
+test('judgeProcessIdentity reads a zombie as exited whatever else the host says', () => {
   assert.equal(
-    judgeProcessIdentity(
-      { startTime: 'S1', matches },
-      { ...facts('S1', 'recorded'), zombie: true },
-    ),
+    judgeProcessIdentity({ startTime: 'S1' }, { startTime: 'S2', command: null, zombie: true }),
     'exited',
   );
 });
@@ -730,10 +730,11 @@ export type ProcessStopBudget = Readonly<{
  * - `reassigned`: a readable start time contradicts the record, or, when no start time was
  *   recorded, a readable command does: the pid now names a different process and the recorded one
  *   is gone.
- * - `ours`: at least one recorded claim is confirmed by a readable fact and none is contradicted.
- * - `unverified`: no recorded claim is confirmed, or a start time was recorded and the command
- *   does not match. That may be the same lifetime running something else, as after an `exec` or an
- *   argv rewrite, so it is neither proof the recorded process is gone nor permission to signal.
+ * - `ours`: every recorded claim was read and matches. One confirmed claim beside an unread one is
+ *   not enough, because the start-time and command reads can fail independently.
+ * - `unverified`: everything else. A claim the host did not answer, no claim at all, or a recorded
+ *   start time beside a command that does not match (the same lifetime may have exec'd or rewritten
+ *   its argv) is neither proof the recorded process is gone nor permission to signal.
  */
 export type ProcessIdentityVerdict = 'ours' | 'exited' | 'reassigned' | 'unverified';
 
@@ -742,13 +743,14 @@ export function judgeProcessIdentity(
   facts: HostProcessIdentityFacts,
 ): ProcessIdentityVerdict {
   if (facts.zombie) return 'exited';
-  const confirmedStartTime = Boolean(expected.startTime && facts.startTime);
-  if (confirmedStartTime && facts.startTime !== expected.startTime) return 'reassigned';
-  if (expected.matches && facts.command && !expected.matches(facts.command)) {
-    return expected.startTime ? 'unverified' : 'reassigned';
-  }
-  const confirmedCommand = Boolean(expected.matches && facts.command);
-  return confirmedStartTime || confirmedCommand ? 'ours' : 'unverified';
+  const { startTime, matches } = expected;
+  if (startTime && facts.startTime && facts.startTime !== startTime) return 'reassigned';
+  const commandMatches = facts.command === null || !matches ? undefined : matches(facts.command);
+  if (!startTime && commandMatches === false) return 'reassigned';
+  if (!startTime && !matches) return 'unverified';
+  const startTimeConfirmed = !startTime || facts.startTime === startTime;
+  const commandConfirmed = !matches || commandMatches === true;
+  return startTimeConfirmed && commandConfirmed ? 'ours' : 'unverified';
 }
 
 /**
 
@@ -155,8 +155,9 @@ function appendReapOutcome(
 
 /**
  * Stops one recorded process through the shared escalation. The record names the process by start
- * time and exact command, so a pid the host shows running anything else is proven gone and never
- * signaled, and one the host will not describe is kept rather than guessed at.
+ * time and exact command, and both must be read and match before any signal. A pid the host shows
+ * in another lifetime is proven gone and never signaled; one the host will not fully describe, or
+ * that shows the recorded lifetime running another command, is kept rather than guessed at.
  */
 async function reapOwnedProcess(
   record: OwnedProcessRecord,
 
@@ -46,6 +46,7 @@ function driveHost(): void {
       const command = processState.commands.get(pid);
       return { stdout: command ? `${pid} ${command}\n` : '', stderr: '', exitCode: 0 };
     }
+    if (!processState.starts.has(pid)) return { stdout: '', stderr: 'timed out', exitCode: 1 };
     const state = processState.zombiePids.has(pid) ? 'Z' : 'S';
     return { stdout: `${pid} ${state} ${processState.starts.get(pid)}\n`, stderr: '', exitCode: 0 };
   });
@@ -318,3 +319,22 @@ test('startup counts a pid reassigned after SIGTERM as missing, not terminated',
     cleanup();
   }
 });
+
+test('startup keeps a record whose start time the host did not answer, without signaling it', async () => {
+  // The start-time and command reads fail independently: a matching command alone is not the
+  // recorded lifetime.
+  const { store, cleanup } = reapFixture('unread-start');
+  hostRuns(BROWSER);
+  processState.starts.delete(BROWSER.pid);
+  try {
+    store.replace({ kind: 'daemon' }, [BROWSER]);
+
+    const summary = await reapOwnedProcessRecordsAtStartup(store);
+
+    assert.deepEqual(summary.unconfirmedPids, [BROWSER.pid]);
+    assert.deepEqual(processState.signals, []);
+    assert.equal(store.read().length, 1);
+  } finally {
+    cleanup();
+  }
+});
@@ -407,14 +407,15 @@ function markerIdentity(marker: AppLogProcessMarker): ProcessStopIdentity {
   return { startTime: marker.startTime, matches: (command) => command === marker.command };
 }
 
-/** Owned only while both recorded facts are confirmed, under the shared identity rule. */
+/** Judged by the same identity rule the stop applies, so inspect and terminate agree. */
 async function inspectOwnedProcess(marker: AppLogProcessMarker): Promise<AppLogProcessOwnership> {
   if (!isProcessAlive(marker.pid)) return 'missing';
-  const facts = await readProcessIdentityFacts(marker.pid);
-  const verdict = judgeProcessIdentity(markerIdentity(marker), facts);
+  const verdict = judgeProcessIdentity(
+    markerIdentity(marker),
+    await readProcessIdentityFacts(marker.pid),
+  );
   if (verdict === 'exited') return 'missing';
-  const bothConfirmed = facts.startTime !== null && facts.command !== null;
-  return verdict === 'ours' && bothConfirmed ? 'owned-alive' : 'ownership-lost';
+  return verdict === 'ours' ? 'owned-alive' : 'ownership-lost';
 }
 
 /**
 
@@ -133,10 +133,10 @@ async function readOwnershipEvidence(
   if (verdict === 'exited') return 'gone';
   if (marker.startTime.length === 0 || marker.command.length === 0) return 'not-ours';
   if (verdict === 'reassigned') return 'not-ours';
-  // A recording marker is ours only while both recorded facts are confirmed, and a readable fact
-  // that does not match is a refusal.
-  if (facts.startTime === null || facts.command === null) return 'unprovable';
-  return verdict === 'ours' ? 'ours' : 'not-ours';
+  if (verdict === 'ours') return 'ours';
+  // The host answered both facts and they do not name the marker: a refusal that also holds the
+  // spawned child's handle back, unlike a host that did not answer at all.
+  return facts.startTime !== null && facts.command !== null ? 'not-ours' : 'unprovable';
 }
 
 export async function terminateManagedProcessSet(