@@ -43,7 +43,7 @@ They are listed cheapest first, and that ordering is the rule: **write a test at
 
 **1. Unit** — `tests/unit/`. Starts nothing; calls plain functions. Pure logic: parsing a ticket reference, deriving a status, building a command line. Blind to anything touching disk, a process or a window.
 
-**2. Integration** — the files named `*.integration.test.cjs`. Runs the real modules against real Git repositories in a temporary directory. Proves Git does what the code assumes when it switches a branch, applies a patch or updates trunk. Blind to everything above the module boundary.
+**2. Integration** — the files named `*.integration.test.cjs`. Runs the real modules against real Git repositories, or real processes, in a temporary directory. Proves Git does what the code assumes when it switches a branch, applies a patch or updates trunk, and that a process tree behaves the way the kill and let-go paths assume (`kill-tree`, `orphan-pipe`). Blind to everything above the module boundary.
 
 **3. IPC wiring** — one file, `tests/unit/ipc-wiring.test.cjs`. Loads the real `src/main.js` with `electron` replaced by a double, and exercises every handler: what each returns, what it rejects, what error it gives. Blind to the window, and its store is a stand-in rather than the real one.
 
 
@@ -75,18 +75,25 @@ function killChildTree(child, deps = {}) {
  * there, which `close` not having fired tells it. Never throws; returns true
  * when a kill was attempted.
  *
+ * `groupOnly` is for a caller that knows the leader is dead because it saw
+ * its `exit` (#498): if the group is gone too there is nothing left to kill,
+ * and the bare pid may already be someone else's, so the fallback must not
+ * run. Without it the fallback stays, for a child that never led a group.
+ *
  * @param {number}              pid
  * @param {'SIGTERM'|'SIGKILL'} [signal]         Windows forces regardless.
  * @param {Object}              [deps]
  * @param {string}              [deps.platform]
  * @param {Function}            [deps.spawnSync]
  * @param {Function}            [deps.kill]
+ * @param {boolean}             [deps.groupOnly] POSIX: never fall back to the bare pid (see below)
  * @return {boolean}
  */
 function killTreeByPid(pid, signal = 'SIGTERM', {
 	platform = process.platform,
 	spawnSync = require('child_process').spawnSync,
-	kill = process.kill
+	kill = process.kill,
+	groupOnly = false
 } = {}) {
 	const plan = killTreePlan(platform, pid, signal);
 	if (!plan) return false;
@@ -97,6 +104,7 @@ function killTreeByPid(pid, signal = 'SIGTERM', {
 	try {
 		kill(plan.target, plan.signal);
 	} catch {
+		if (groupOnly) return true;
 		try { kill(plan.fallback, plan.signal); } catch {}
 	}
 	return true;
 
@@ -3428,7 +3428,39 @@ function runNpmWithEngineRetry({ runnerPath, args, cwd, onLog, onDone, register,
 			}, 0);
 		});
 
+		// `close` is the event the run settles on, and it waits for the stdio
+		// pipes. A descendant that outlives npm keeps them open — wp-build after
+		// its cmd.exe was closed by hand (#497) — so npm has exited, the step is
+		// still IN PROGRESS, and the terminal keeps receiving the orphan's output
+		// (#498). Mirror of the Stop escalation (#479) on the natural-exit path:
+		// three seconds after `exit` with no `close`, force the group by pid on
+		// POSIX, where the detached group outlives its leader and the orphan
+		// goes with it, and destroy the pipes, which is what makes Node emit
+		// `close` with the exit code npm gave. The close handler then settles as
+		// usual, so the engines-retry decision stays in one place; whatever the
+		// orphan writes afterwards goes with the stream. Not forced on Windows,
+		// for the reason npm:kill gives: the pid is certainly dead by now, a
+		// `taskkill /T` on it reaches nothing of the orphan (its parent chain
+		// is gone) and could land on a reissued pid; there the orphan runs on
+		// until it finishes, and the terminal line says so.
+		let letGo = null;
+		child.once('exit', (code, signal) => {
+			letGo = setTimeout(() => {
+				if (settled) return;
+				const exit = `code ${code}${signal ? ` (signal ${signal})` : ''}`;
+				logEvent(logScope, `exited with ${exit} but a descendant still holds its output; letting go`);
+				onLog('stderr', `\nnpm exited with ${exit}, but something it started is still running and holding its output. Letting go${process.platform === 'win32' ? '; that process runs on until it finishes on its own' : ' and ending it'}.\n`);
+				// Group only: the leader is dead (this is its exit), so a group that
+				// is gone too leaves nothing to kill and a pid that may be reissued.
+				if (process.platform !== 'win32') killTreeByPid(child.pid, 'SIGKILL', { groupOnly: true });
+				for (const stream of [child.stdout, child.stderr, child.stdin]) {
+					if (stream && typeof stream.destroy === 'function') stream.destroy();
+				}
+			}, 3000);
+		});
+
 		child.on('close', (code, signal) => {
+			if (letGo) clearTimeout(letGo);
 			flushChildOutput(logScope);
 			logEvent(logScope, `exited with code ${code}${signal ? ` (signal ${signal})` : ''}`);
 			// `!settled` guards the case where the error path got there first: the
 
@@ -1860,8 +1860,9 @@ function fakeChild() {
 	const child = new EventEmitter();
 	// setEncoding is a no-op here but has to exist: the Playground handlers call
 	// it on both streams before they attach a listener.
-	child.stdout = Object.assign(new EventEmitter(), { setEncoding() {} });
-	child.stderr = Object.assign(new EventEmitter(), { setEncoding() {} });
+	child.stdout = Object.assign(new EventEmitter(), { setEncoding() {}, destroy: spy() });
+	child.stderr = Object.assign(new EventEmitter(), { setEncoding() {}, destroy: spy() });
+	child.stdin = { destroy: spy() };
 	child.pid = 4242;
 	child.exitCode = null;
 	child.kill = spy();
@@ -2129,6 +2130,105 @@ test('npm:kill ends the script tree rather than signalling the runner alone', as
 	assert.deepEqual(cp.children[0].kill.calls, [], 'the escalation must not stop at the runner');
 });
 
+// #498: `close` waits for the stdio pipes, and a descendant that outlived npm
+// (wp-build after its cmd.exe was closed by hand, #497) keeps them open. npm
+// has exited, the step stays IN PROGRESS. Mirror of the Stop escalation on the
+// natural-exit path: three seconds after `exit` with no `close`, force the
+// group by pid (POSIX; the detached group outlives its leader) and destroy the
+// pipes, which is what makes Node emit the `close` the run settles on.
+test('a runner that exited but never closed is let go after a grace, with npm\'s code', async (t) => {
+	const cp = stubbedSpawn();
+	const killTreeByPid = spy();
+	const main = loadMain({
+		stubs: {
+			...silentLogging(),
+			'child_process': { spawn: cp.spawn },
+			'./kill-tree': { killTreeByPid }
+		}
+	});
+	const event = createIpcEvent();
+	const { runId } = await main.invokeWith('npm:run-script', event, '/sites/wp', 'build');
+	const child = cp.children[0];
+	t.mock.timers.enable({ apis: ['setTimeout'] });
+
+	child.emit('exit', 1, null);
+	t.mock.timers.tick(2999);
+	assert.deepEqual(killTreeByPid.calls, [], 'the grace is what tells an orphan from a pipe still draining');
+	assert.deepEqual(child.stdout.destroy.calls, []);
+	t.mock.timers.tick(1);
+
+	// The forced group signal is POSIX; on Windows the pid is dead and a
+	// taskkill on it could land on a reissued one (the npm:kill rule).
+	assert.deepEqual(
+		killTreeByPid.calls,
+		process.platform === 'win32' ? [] : [[child.pid, 'SIGKILL', { groupOnly: true }]],
+		'POSIX forces the group the runner led by pid, and only the group; Windows must not'
+	);
+	for (const stream of [child.stdout, child.stderr, child.stdin]) {
+		assert.equal(stream.destroy.calls.length, 1, 'the pipe the orphan holds has to be destroyed, or close never comes');
+	}
+	// The contributor is told in the terminal, not only in the log file.
+	assert.ok(
+		event.sent.some((m) => m.channel === 'npm:run-script:log' && m.payload.type === 'stderr' && /still running and holding its output/.test(m.payload.data)),
+		'the let-go said nothing in the terminal'
+	);
+	assert.ok(!event.sent.some((m) => m.channel === 'npm:run-script:done'), 'done is the close handler\'s to send');
+	// Node emits close with the stored exit code once the destroyed pipes shut.
+	child.emit('close', 1, null);
+	assert.deepEqual(event.sent.filter((m) => m.channel === 'npm:run-script:done').map((m) => m.payload), [{ runId, code: 1 }]);
+});
+
+test('a runner whose close follows its exit inside the grace is left alone', async (t) => {
+	const cp = stubbedSpawn();
+	const killTreeByPid = spy();
+	const main = loadMain({
+		stubs: {
+			...silentLogging(),
+			'child_process': { spawn: cp.spawn },
+			'./kill-tree': { killTreeByPid }
+		}
+	});
+	const event = createIpcEvent();
+	const { runId } = await main.invokeWith('npm:run-script', event, '/sites/wp', 'build');
+	const child = cp.children[0];
+	t.mock.timers.enable({ apis: ['setTimeout'] });
+
+	child.emit('exit', 0, null);
+	child.emit('close', 0, null);
+	t.mock.timers.tick(3000);
+
+	assert.deepEqual(killTreeByPid.calls, [], 'a tree that closed has nothing left to force, and its pid may be reissued');
+	assert.deepEqual(child.stdout.destroy.calls, []);
+	assert.deepEqual(event.sent.filter((m) => m.channel === 'npm:run-script:done').map((m) => m.payload), [{ runId, code: 0 }]);
+});
+
+test('an install that exited but never closed is let go the same way', async (t) => {
+	const cp = stubbedSpawn();
+	const killTreeByPid = spy();
+	const main = loadMain({
+		stubs: {
+			...silentLogging(),
+			// The install's done writes installFailed to the store first.
+			...fakeSettingsStore().stubs,
+			'child_process': { spawn: cp.spawn },
+			'./kill-tree': { killTreeByPid }
+		}
+	});
+	const event = createIpcEvent();
+	const { installId } = await main.invokeWith('npm:install', event, '/sites/wp');
+	const child = cp.children[0];
+	t.mock.timers.enable({ apis: ['setTimeout'] });
+
+	child.emit('exit', 1, null);
+	t.mock.timers.tick(3000);
+	assert.deepEqual(killTreeByPid.calls, process.platform === 'win32' ? [] : [[child.pid, 'SIGKILL', { groupOnly: true }]]);
+	assert.equal(child.stderr.destroy.calls.length, 1);
+	child.emit('close', 1, null);
+	// The install's done follows a store write.
+	await new Promise((resolve) => setImmediate(resolve));
+	assert.deepEqual(event.sent.filter((m) => m.channel === 'npm:install:done').map((m) => m.payload), [{ installId, code: 1 }]);
+});
+
 test('npm:kill arms no escalation for a child that had already closed', async (t) => {
 	const cp = stubbedSpawn();
 	const killTreeByPid = spy();
 
@@ -40,6 +40,19 @@ test('killTreeByPid forces the group even though the ChildProcess that led it ha
 	assert.equal(killTreeByPid(0, 'SIGKILL', { platform: 'darwin', kill: () => { throw new Error('must not be called'); } }), false, 'a pid that names no live process is refused, forced or not');
 });
 
+test('killTreeByPid with groupOnly never signals the bare pid when the group is gone', () => {
+	// The let-go after exit (#498): the leader is certainly dead, so a group
+	// that no longer exists means nothing is left, and the bare pid may have
+	// been handed to someone else since.
+	const calls = [];
+	const kill = (target, signal) => { calls.push([target, signal]); if (target < 0) throw Object.assign(new Error('ESRCH'), { code: 'ESRCH' }); };
+	assert.equal(killTreeByPid(42, 'SIGKILL', { platform: 'darwin', kill, groupOnly: true }), true);
+	assert.deepEqual(calls, [[-42, 'SIGKILL']], 'the fallback to the bare pid must not run');
+	calls.length = 0;
+	killTreeByPid(42, 'SIGKILL', { platform: 'darwin', kill });
+	assert.deepEqual(calls, [[-42, 'SIGKILL'], [42, 'SIGKILL']], 'without groupOnly the fallback stays, for a child that never led a group');
+});
+
 test('killTreePlan refuses pids that cannot name a live process', () => {
 	// pid 0 would signal the caller's own group and -1 every process the user
 	// owns — a bug here is catastrophic, so these must return null, not a plan.
 
@@ -0,0 +1,79 @@
+'use strict';
+
+// The mechanism #498 rests on, against a real process: a runner whose
+// descendant outlives it keeps the stdio pipes open, so `exit` fires and
+// `close` does not; destroying the pipes on our side is what makes Node emit
+// `close`, with the exit code the runner gave, and a forced group signal by
+// pid ends the orphan although the leader is gone. The unit suite pins the
+// wiring in main.js; this pins the Node and POSIX facts it relies on. POSIX
+// only by nature (process groups and `sh`); on Windows the orphan runs on and
+// the destroyed pipes still deliver `close`, which the wiring test covers.
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { spawn } = require('node:child_process');
+
+const { killTreeByPid } = require('../../src/kill-tree.js');
+
+const posixOnly = process.platform === 'win32' ? { skip: 'process groups are POSIX' } : {};
+
+function alive(pid) {
+	try { process.kill(pid, 0); return true; } catch { return false; }
+}
+
+function until(check, ms) {
+	return new Promise((resolve) => {
+		const started = Date.now();
+		const tick = () => {
+			if (check()) return resolve(true);
+			if (Date.now() - started > ms) return resolve(false);
+			setTimeout(tick, 50);
+		};
+		tick();
+	});
+}
+
+test('a runner whose orphan holds the pipes exits without closing, and closes once the pipes are destroyed', { ...posixOnly, timeout: 30000 }, async (t) => {
+	// runner (sh) -> orphan (node) that inherits stdout and keeps it open past
+	// the runner's own exit 3, the way wp-build outlives npm (#498). `& exit`
+	// backgrounds it so the shell itself ends at once.
+	const runner = spawn('sh', ['-c', `"$0" -e "$1" & exit 3`, process.execPath, 'console.log(process.pid); setInterval(() => {}, 1000);'], {
+		detached: true,
+		stdio: ['pipe', 'pipe', 'pipe']
+	});
+	// Straight to the group, never the bare pid: once the body has reaped the
+	// group, the runner's pid may be someone else's.
+	let orphanPid = null;
+	t.after(() => {
+		try { process.kill(-runner.pid, 'SIGKILL'); } catch {}
+		if (orphanPid !== null) { try { process.kill(orphanPid, 'SIGKILL'); } catch {} }
+	});
+
+	// Data events are not line-delimited: wait for the newline before reading
+	// the pid, or a partial chunk names some other process.
+	let stdout = '';
+	runner.stdout.on('data', (data) => {
+		stdout += String(data);
+		const newline = stdout.indexOf('\n');
+		if (orphanPid === null && newline !== -1) {
+			const pid = Number(stdout.slice(0, newline).trim());
+			if (Number.isInteger(pid) && pid > 0) orphanPid = pid;
+		}
+	});
+	const exited = new Promise((resolve) => runner.once('exit', resolve));
+	let closed = null;
+	runner.once('close', (code, signal) => { closed = { code, signal }; });
+
+	assert.equal(await exited, 3, 'the runner exits with its own code');
+	assert.ok(await until(() => orphanPid !== null, 5000), 'the orphan never reported its pid');
+	assert.ok(alive(orphanPid), 'the orphan should outlive the runner');
+	assert.equal(await until(() => closed !== null, 1000), false, 'close must not come while the orphan holds the pipes');
+
+	// What main.js does when the grace runs out.
+	killTreeByPid(runner.pid, 'SIGKILL', { groupOnly: true });
+	for (const stream of [runner.stdout, runner.stderr, runner.stdin]) stream.destroy();
+
+	assert.ok(await until(() => closed !== null, 5000), 'destroying the pipes did not deliver close');
+	assert.deepEqual(closed, { code: 3, signal: null }, 'close carries the code the runner exited with');
+	assert.ok(await until(() => !alive(orphanPid), 5000), 'the group signal by pid did not end the orphan');
+});