Thank you for the clarification. We understand that dropped notifications should be addressed by keeping the Endpoint Security client fast enough to handle incoming events. Our remaining concern is the failure window in which a Worker successfully forks a Child but terminates before communicating the Child's identity to its supervising Root process. Even assuming no notifications are dropped: We want to distinguish reliable event processing from guaranteed process containment and ownership.

Thank you for the clarification. We understand that dropped notifications should be addressed by keeping the Endpoint Security client fast enough to handle incoming events. Our remaining concern is the failure window in which a Worker successfully forks a Child but terminates before communicating the Child's identity to its supervising Root process. Even assuming no notifications are dropped: We want to distinguish reliable event processing from guaranteed process containment and ownership.