Thank you for the clarification. We now understand that Endpoint Security events originate from the kernel and that Worker termination does not affect the delivery of events already generated. However, our application targets macOS 14+ and cannot depend on the restricted Endpoint Security entitlement. Our remaining requirement is to guarantee safe process identity and lifecycle supervision when a Worker creates a Child but terminates before handing its identity to Root, without risking PID reuse or leaving an unsupervised process. For this requirement, is there a supported public macOS 14+ mechanism that provides these guarantees without Endpoint Security, or should we redesign the architecture so that Root directly creates and supervises Child? If neither approach provides a complete guarantee, we would appreciate confirmation of that limitation so we can make the appropriate architectural decision. Thank you for your guidance.

Thank you for the clarification. We understand that dropped notifications should be addressed by keeping the Endpoint Security client fast enough to handle incoming events. Our remaining concern is the failure window in which a Worker successfully forks a Child but terminates before communicating the Child's identity to its supervising Root process. Even assuming no notifications are dropped: We want to distinguish reliable event processing from guaranteed process containment and ownership. Thank you.