diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index 8acff66e..f4ae9efe 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -65,10 +65,13 @@ jobs:
       - uses: ./.gitea/actions/go-setup
       - name: prepare anonymous docker config
         run: mkdir -p "$DOCKER_CONFIG" && echo '{}' > "$DOCKER_CONFIG/config.json"
+      - name: windows vm cache key
+        id: windows-vm
+        run: echo "key=windows-vm-$(grep '^WINDOWS_TEST_IMAGE' Makefile | cat - scripts/test-windows.sh scripts/test-windows-setup.ps1 | sha256sum | cut -c1-16)" >> "$GITHUB_OUTPUT"
       - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/windows-vm
-          key: windows-vm
+          key: ${{ steps.windows-vm.outputs.key }}
       - name: test on windows
         id: test-windows
         run: WINDOWS_TEST_CACHE="$HOME/.cache/windows-vm" make test-windows
@@ -78,7 +81,7 @@ jobs:
         uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/windows-vm
-          key: windows-vm
+          key: ${{ steps.windows-vm.outputs.key }}
 
   e2e:
     name: gitea compatibility (${{ matrix.gitea_image }})
diff --git a/.golangci.yml b/.golangci.yml
index bd1d3281..37a044e4 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -39,6 +39,8 @@ linters:
           deny:
             - pkg: golang.org/x/exp
               desc: it's experimental and unreliable
+            - pkg: unsafe
+              desc: use typed APIs instead
         logging:
           files:
             - $all
diff --git a/README.md b/README.md
index e5b4c725..3a9386b5 100644
--- a/README.md
+++ b/README.md
@@ -164,7 +164,7 @@ ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest,macos:host
 
 [gitea/runner-images](https://gitea.com/gitea/runner-images) has suitable images. Jobs matching no label run in `runner.default_image`, or on the host when docker is unavailable.
 
-Host jobs still need a Docker daemon for Docker actions and `docker://` steps. Windows hosts do not support those, as on GitHub. On Windows, a step's background processes end with the job unless it opts out, see [host mode](docs/host-mode.md).
+Host jobs still need a Docker daemon for Docker actions and `docker://` steps. Windows hosts do not support those, as on GitHub. A step's background processes end with the job unless it opts out, see [host mode](docs/host-mode.md).
 
 #### Registration vs config labels
 
diff --git a/act/common/executor.go b/act/common/executor.go
index 2d46a9bd..882c55d7 100644
--- a/act/common/executor.go
+++ b/act/common/executor.go
@@ -7,7 +7,9 @@ package common
 import (
 	"context"
 	"fmt"
+	"math/rand/v2"
 	"runtime/debug"
+	"time"
 
 	"gitea.com/gitea/runner/act/common/logging"
 )
@@ -158,6 +160,28 @@ func (e Executor) IfBool(conditional bool) Executor {
 	})
 }
 
+// RetryBackoff is the wait between Retry's attempts, random between 1 and 10 seconds like GitHub's runner.
+var RetryBackoff = func() time.Duration { return time.Second + rand.N(9*time.Second) }
+
+// Retry runs the executor up to attempts times until it succeeds.
+func (e Executor) Retry(attempts int) Executor {
+	return func(ctx context.Context) error {
+		for attempt := 1; ; attempt++ {
+			err := e(ctx)
+			if err == nil || attempt == attempts || ctx.Err() != nil {
+				return err
+			}
+			backoff := RetryBackoff()
+			Logger(ctx).Warnf("%v, retrying in %s", err, backoff.Round(time.Second))
+			select {
+			case <-ctx.Done():
+				return err
+			case <-time.After(backoff):
+			}
+		}
+	}
+}
+
 // Finally adds an executor to run after other executor
 func (e Executor) Finally(finally Executor) Executor {
 	return func(ctx context.Context) error {
diff --git a/act/common/executor_test.go b/act/common/executor_test.go
index ec8ae115..39efb45e 100644
--- a/act/common/executor_test.go
+++ b/act/common/executor_test.go
@@ -11,6 +11,7 @@ import (
 	"sync"
 	"sync/atomic"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -134,6 +135,31 @@ func TestExecutorConditionalsAndFinally(t *testing.T) {
 	assert.Equal(t, []string{"if-true", "if-not", "if-bool", "main", "finally"}, calls)
 }
 
+func TestExecutorRetryStopsOnSuccessOrAfterAllAttempts(t *testing.T) {
+	backoff := RetryBackoff
+	RetryBackoff = func() time.Duration { return 0 }
+	t.Cleanup(func() { RetryBackoff = backoff })
+	transient := errors.New("transient")
+	for _, tc := range []struct {
+		failures, calls int
+		err             error
+	}{
+		{failures: 2, calls: 3},
+		{failures: 5, calls: 3, err: transient},
+	} {
+		var calls int
+		err := Executor(func(context.Context) error {
+			calls++
+			if calls <= tc.failures {
+				return transient
+			}
+			return nil
+		}).Retry(3)(t.Context())
+		require.Equal(t, tc.err, err)
+		require.Equal(t, tc.calls, calls)
+	}
+}
+
 func TestExecutorFinallyReturnsFinallyErrorWithOriginal(t *testing.T) {
 	finalErr := errors.New("cleanup failed")
 	for _, mainErr := range []error{context.Canceled, nil} {
diff --git a/act/container/docker_pull.go b/act/container/docker_pull.go
index 2f2b5ae4..87678a5a 100644
--- a/act/container/docker_pull.go
+++ b/act/container/docker_pull.go
@@ -22,7 +22,7 @@ import (
 
 // NewDockerPullExecutor function to create a run executor for the container
 func NewDockerPullExecutor(input NewDockerPullExecutorInput) common.Executor {
-	return func(ctx context.Context) error {
+	return common.Executor(func(ctx context.Context) error {
 		logger := common.Logger(ctx)
 		logger.Debugf("docker pull %v", input.Image)
 
@@ -83,7 +83,7 @@ func NewDockerPullExecutor(input NewDockerPullExecutorInput) common.Executor {
 			return nil
 		}
 		return fmt.Errorf("failed to pull image '%s' (%s): %w", imageRef, input.Platform, err)
-	}
+	}).Retry(3)
 }
 
 func getImagePullOptions(ctx context.Context, input NewDockerPullExecutorInput) (client.ImagePullOptions, error) {
diff --git a/act/container/host_environment.go b/act/container/host_environment.go
index bcde81de..5a59dffc 100644
--- a/act/container/host_environment.go
+++ b/act/container/host_environment.go
@@ -57,7 +57,7 @@ func (e *HostEnvironment) processGroup(ctx context.Context) *process.Group {
 	e.procGroupOnce.Do(func() {
 		group, err := process.NewGroup()
 		if err != nil {
-			common.Logger(ctx).Warnf("could not create the job's process group; processes a step leaves behind can only be reclaimed by the workspace scan: %v", err)
+			common.Logger(ctx).Warnf("could not create the job's process group, processes a step leaves behind may outlive the job: %v", err)
 			return
 		}
 		e.procGroup.Store(group)
@@ -415,46 +415,6 @@ func removePathWithRetry(ctx context.Context, path string) error {
 	return lastErr
 }
 
-func (e *HostEnvironment) terminateRunningProcesses(ctx context.Context) {
-	if runtime.GOOS != "windows" {
-		return
-	}
-
-	// Detached: exec.CommandContext won't start on a cancelled ctx, and a
-	// server cancel has already cancelled the parent ctx.
-	killCtx, killCancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer killCancel()
-
-	logger := common.Logger(ctx)
-
-	// Dirs we own; a process referencing one is a leftover. ToolCache is shared
-	// across jobs, and Workdir may be a caller-owned checkout.
-	owned := []string{e.Path, e.TmpDir}
-	if e.CleanWorkdir {
-		owned = append(owned, e.Workdir)
-	}
-	dirs := make([]string, 0, len(owned))
-	for _, d := range owned {
-		if d == "" {
-			continue
-		}
-		abs, err := filepath.Abs(d)
-		if err != nil {
-			continue
-		}
-		dirs = append(dirs, abs)
-	}
-	if len(dirs) == 0 {
-		return
-	}
-
-	if killed, err := process.KillProcessesWithPaths(killCtx, dirs, e.TrackingID); err != nil {
-		logger.Debugf("workspace process cleanup reported errors: %v", err)
-	} else if killed > 0 {
-		logger.Debugf("terminated %d leftover workspace process(es)", killed)
-	}
-}
-
 // hostCleanupTimeout bounds each teardown phase so one stalled delete cannot
 // wedge the runner slot. A var so tests can shrink it.
 var hostCleanupTimeout = 30 * time.Second
@@ -463,12 +423,15 @@ func (e *HostEnvironment) Remove() common.Executor {
 	return func(ctx context.Context) error {
 		logger := common.Logger(ctx)
 
-		// End lingering processes before removing the workspace; on Windows their
-		// file locks block cleanup. Closing the group is deterministic, the scan a net.
+		// End lingering processes before removing the workspace, on Windows their file locks block cleanup.
 		if err := e.procGroup.Load().Close(); err != nil {
 			logger.Debugf("closing the job's process group failed: %v", err)
 		}
-		e.terminateRunningProcesses(ctx)
+		if killed, err := process.KillTrackedProcesses(e.TrackingID); err != nil {
+			logger.Debugf("killing the job's leftover processes reported errors: %v", err)
+		} else if killed > 0 {
+			logger.Debugf("killed %d leftover process(es) of the job", killed)
+		}
 
 		// Detach: a cancelled ctx would skip removePathWithRetry's retries,
 		// which absorb Windows file-handle release lag after the kill above.
diff --git a/act/container/host_environment_windows_test.go b/act/container/host_environment_windows_test.go
index bf5b3f68..f8928452 100644
--- a/act/container/host_environment_windows_test.go
+++ b/act/container/host_environment_windows_test.go
@@ -4,18 +4,15 @@
 package container
 
 import (
-	"bufio"
 	"context"
 	"fmt"
 	"io"
 	"net"
 	"os"
 	"os/exec"
-	"path/filepath"
 	"strings"
 	"testing"
 	"time"
-	"unsafe"
 
 	"github.com/stretchr/testify/require"
 	"golang.org/x/sys/windows"
@@ -40,7 +37,6 @@ func TestHostEnvironmentTrackingCleanup(t *testing.T) {
 				}
 			}
 			env["GITEA_TRACKING_HELPER"] = "step"
-			env["GITEA_TRACKING_WORKSPACE"] = workspace
 			env["GITEA_TRACKING_ADDRESS"] = listener.Addr().String()
 			if tracking == "default" {
 				env["RUNNER_TRACKING_ID"] = environment.TrackingID
@@ -52,23 +48,6 @@ func TestHostEnvironmentTrackingCleanup(t *testing.T) {
 			go func() {
 				result <- environment.Exec([]string{os.Args[0], "-test.run=^TestHostTrackingHelper$"}, env, "", workspace)(ctx)
 			}()
-			step, err := listener.Accept()
-			require.NoError(t, err)
-			defer step.Close()
-			require.NoError(t, step.SetDeadline(time.Now().Add(20*time.Second)))
-			var stepPID int
-			_, err = fmt.Fscanln(step, &stepPID)
-			require.NoError(t, err)
-			stepHandle, err := windows.OpenProcess(windows.PROCESS_QUERY_LIMITED_INFORMATION, false, uint32(stepPID))
-			require.NoError(t, err)
-			defer func() { _ = windows.CloseHandle(stepHandle) }()
-			require.Eventually(t, func() bool {
-				var assigned int32
-				result, _, _ := windows.NewLazySystemDLL("kernel32.dll").NewProc("IsProcessInJob").Call(uintptr(stepHandle), 0, uintptr(unsafe.Pointer(&assigned)))
-				return result != 0 && assigned != 0
-			}, 5*time.Second, 10*time.Millisecond)
-			_, err = step.Write([]byte{1})
-			require.NoError(t, err)
 			var helpers []windows.Handle
 			for range 2 {
 				connection, err := listener.Accept()
@@ -114,23 +93,18 @@ func TestHostTrackingHelper(t *testing.T) {
 	if mode == "" {
 		return
 	}
+	if mode != "descendant" {
+		child := exec.Command(os.Args[0], "-test.run=^TestHostTrackingHelper$")
+		child.Env = append(os.Environ(), "GITEA_TRACKING_HELPER="+map[string]string{"step": "helper", "helper": "descendant"}[mode])
+		require.NoError(t, child.Start())
+		if mode == "step" {
+			os.Exit(0)
+		}
+	}
 	connection, err := net.Dial("tcp4", os.Getenv("GITEA_TRACKING_ADDRESS"))
 	require.NoError(t, err)
 	_, err = fmt.Fprintln(connection, os.Getpid())
 	require.NoError(t, err)
-	if mode == "step" {
-		_, err := bufio.NewReader(connection).ReadByte()
-		require.NoError(t, err)
-	}
-	if mode != "descendant" {
-		child := exec.Command(os.Args[0], "-test.run=^TestHostTrackingHelper$", filepath.Join(os.Getenv("GITEA_TRACKING_WORKSPACE"), "tracking-reference"))
-		child.Env = append(os.Environ(), "GITEA_TRACKING_HELPER="+map[string]string{"step": "helper", "helper": "descendant"}[mode])
-		require.NoError(t, child.Start())
-		if mode == "step" {
-			require.NoError(t, connection.Close())
-			os.Exit(0)
-		}
-	}
 	_, err = io.Copy(io.Discard, connection)
 	require.NoError(t, err)
 	require.NoError(t, connection.Close())
diff --git a/act/lookpath/lp_windows.go b/act/lookpath/lp_windows.go
index 9085f1ef..7e737a38 100644
--- a/act/lookpath/lp_windows.go
+++ b/act/lookpath/lp_windows.go
@@ -80,9 +80,6 @@ func lookPath(file string, env map[string]string) (string, error) {
 			return "", &Error{file, err}
 		}
 	}
-	if f, err := findExecutable(filepath.Join(".", file), exts); err == nil {
-		return f, nil
-	}
 	path := getenv(env, "path")
 	for _, dir := range filepath.SplitList(path) {
 		if f, err := findExecutable(filepath.Join(dir, file), exts); err == nil {
diff --git a/act/lookpath/lp_windows_test.go b/act/lookpath/lp_windows_test.go
new file mode 100644
index 00000000..219271ec
--- /dev/null
+++ b/act/lookpath/lp_windows_test.go
@@ -0,0 +1,20 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package lookpath
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestLookPath2IgnoresTheCurrentDirectory(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "tool.exe"), nil, 0o755))
+	t.Chdir(dir)
+	_, err := LookPath2("tool", map[string]string{"PATH": t.TempDir()})
+	require.EqualError(t, err, ErrNotFound.Error())
+}
diff --git a/act/runner/action.go b/act/runner/action.go
index 39cb9235..bf801b3a 100644
--- a/act/runner/action.go
+++ b/act/runner/action.go
@@ -339,34 +339,30 @@ func execAsDocker(ctx context.Context, step actionStep, actionName, actionDir, b
 
 		if !correctArchExists || rc.Config.ForceRebuild {
 			logger.Debugf("image '%s' for architecture '%s' will be built from context '%s", image, rc.Config.ContainerArchitecture, contextDir)
-			var buildContext io.ReadCloser
-			if localAction {
-				buildContext, err = rc.JobContainer.GetContainerArchive(ctx, contextDir+"/.")
-				if err != nil {
-					return err
+			prepImage = common.Executor(func(ctx context.Context) error {
+				input := container.NewDockerBuildExecutorInput{
+					ContextDir: contextDir,
+					Dockerfile: fileName,
+					ImageTag:   image,
+					Platform:   rc.Config.ContainerArchitecture,
+					BuildArgs:  rc.proxyBuildArgs(),
 				}
-				defer buildContext.Close()
-			}
-			prepImage = ContainerNewDockerBuildExecutor(container.NewDockerBuildExecutorInput{
-				ContextDir:   contextDir,
-				Dockerfile:   fileName,
-				ImageTag:     image,
-				BuildContext: buildContext,
-				Platform:     rc.Config.ContainerArchitecture,
-				BuildArgs:    rc.proxyBuildArgs(),
-			})
-			if buildContext == nil {
-				// Held across the whole build: the daemon drains contextDir lazily.
-				inner := prepImage
-				prepImage = func(ctx context.Context) error {
-					unlock, err := git.AcquireCloneLock(ctx, actionDir)
+				if localAction {
+					buildContext, err := rc.JobContainer.GetContainerArchive(ctx, contextDir+"/.")
+					if err != nil {
+						return err
+					}
+					defer buildContext.Close()
+					input.BuildContext = buildContext
+				} else {
+					unlock, err := git.AcquireCloneLock(ctx, actionDir) // held across the whole build, the daemon drains contextDir lazily
 					if err != nil {
 						return err
 					}
 					defer unlock()
-					return inner(ctx)
 				}
-			}
+				return ContainerNewDockerBuildExecutor(input)(ctx)
+			}).Retry(3)
 		} else {
 			logger.Debugf("image '%s' for architecture '%s' already exists", image, rc.Config.ContainerArchitecture)
 		}
diff --git a/act/runner/step_factory.go b/act/runner/step_factory.go
index 5461ae0e..1c93b9d4 100644
--- a/act/runner/step_factory.go
+++ b/act/runner/step_factory.go
@@ -22,7 +22,7 @@ type stepFactoryImpl struct{}
 func (sf *stepFactoryImpl) newStep(stepModel *model.Step, rc *RunContext) (step, error) {
 	switch stepModel.Type() {
 	case model.StepTypeInvalid:
-		return nil, fmt.Errorf("invalid run/uses syntax for job:%s step:%+v", rc.Run, stepModel)
+		return nil, fmt.Errorf("invalid run/uses syntax for job:%s step:%+v", rc.Name, stepModel)
 	case model.StepTypeRun:
 		return &stepRun{
 			Step:       stepModel,
@@ -40,7 +40,7 @@ func (sf *stepFactoryImpl) newStep(stepModel *model.Step, rc *RunContext) (step,
 			run, ok := builtinActions[name]
 			if !ok {
 				return nil, fmt.Errorf("unknown built-in action %q (known: %v) for job:%s step:%+v",
-					name, slices.Sorted(maps.Keys(builtinActions)), rc.Run, stepModel)
+					name, slices.Sorted(maps.Keys(builtinActions)), rc.Name, stepModel)
 			}
 			return &stepActionBuiltin{
 				Step:       stepModel,
@@ -61,5 +61,5 @@ func (sf *stepFactoryImpl) newStep(stepModel *model.Step, rc *RunContext) (step,
 		}, nil
 	}
 
-	return nil, fmt.Errorf("unable to determine how to run job:%s step:%+v", rc.Run, stepModel)
+	return nil, fmt.Errorf("unable to determine how to run job:%s step:%+v", rc.Name, stepModel)
 }
diff --git a/act/runner/step_factory_test.go b/act/runner/step_factory_test.go
index 21e3cdc9..50ff9c3e 100644
--- a/act/runner/step_factory_test.go
+++ b/act/runner/step_factory_test.go
@@ -37,7 +37,7 @@ func TestStepFactoryInvalidStep(t *testing.T) {
 		{Uses: "remote/action@v1", Run: "cmd"},
 		{Uses: "builtin:unknown"},
 	} {
-		_, err := (&stepFactoryImpl{}).newStep(stepModel, &RunContext{})
-		assert.Error(t, err, stepModel.Uses)
+		_, err := (&stepFactoryImpl{}).newStep(stepModel, &RunContext{Name: "build"})
+		assert.ErrorContains(t, err, "job:build ", stepModel.Uses)
 	}
 }
diff --git a/docs/host-mode.md b/docs/host-mode.md
index d431caae..8c8d194d 100644
--- a/docs/host-mode.md
+++ b/docs/host-mode.md
@@ -1,6 +1,6 @@
-# Host-mode background processes on Windows
+# Host-mode background processes
 
-Windows host jobs clean up background step processes at job completion. A step can opt out:
+Host jobs clean up background step processes at job completion. A step can opt out:
 
 ```yaml
 steps:
@@ -10,8 +10,8 @@ steps:
     run: Start-Process vendor-helper.exe
 ```
 
-- Set the `RUNNER_TRACKING_ID` override in the step's `env` before it starts. Any value different from the job's ID opts out, including an empty string.
-- Opted-out processes and descendants that inherit the override survive normal job cleanup, including workspace process sweeps and expired output waits. Detach helper output because the runner closes leftover output pipes after a bounded wait.
+- Set the `RUNNER_TRACKING_ID` override in the step's `env` before it starts. Any value different from the job's ID opts out, including an empty string. On Linux and macOS a script can also set it before starting a process.
+- Opted-out processes and descendants that inherit the override survive normal job cleanup and expired output waits. Detach helper output because the runner closes leftover output pipes after a bounded wait.
 - Cancelling or timing out an active step still terminates its process tree.
 - The override does not preserve workspace or temporary files. Store persistent helper files outside those directories and arrange the helper's eventual shutdown.
 
diff --git a/internal/pkg/process/group_windows.go b/internal/pkg/process/group_windows.go
index 5f5bf232..8199739c 100644
--- a/internal/pkg/process/group_windows.go
+++ b/internal/pkg/process/group_windows.go
@@ -4,9 +4,9 @@
 package process
 
 import (
+	"errors"
 	"os"
 	"sync"
-	"unsafe"
 
 	"golang.org/x/sys/windows"
 )
@@ -24,22 +24,6 @@ func NewGroup() (*Group, error) {
 	if err != nil {
 		return nil, err
 	}
-
-	info := windows.JOBOBJECT_EXTENDED_LIMIT_INFORMATION{
-		BasicLimitInformation: windows.JOBOBJECT_BASIC_LIMIT_INFORMATION{
-			LimitFlags: windows.JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE,
-		},
-	}
-	if _, err := windows.SetInformationJobObject(
-		job,
-		windows.JobObjectExtendedLimitInformation,
-		uintptr(unsafe.Pointer(&info)),
-		uint32(unsafe.Sizeof(info)),
-	); err != nil {
-		_ = windows.CloseHandle(job)
-		return nil, err
-	}
-
 	return &Group{job: job}, nil
 }
 
@@ -65,8 +49,7 @@ func (g *Group) Assign(p *os.Process) error {
 	return windows.AssignProcessToJobObject(g.job, h)
 }
 
-// Close drops the job handle, terminating every process still assigned to it.
-// Nil-safe and idempotent.
+// Close terminates every process still assigned to the job and drops its handle, nil-safe and idempotent.
 func (g *Group) Close() error {
 	if g == nil {
 		return nil
@@ -80,5 +63,5 @@ func (g *Group) Close() error {
 
 	h := g.job
 	g.job = 0
-	return windows.CloseHandle(h)
+	return errors.Join(windows.TerminateJobObject(h, 1), windows.CloseHandle(h))
 }
diff --git a/internal/pkg/process/killer_windows.go b/internal/pkg/process/killer_windows.go
index 7d9b44bc..e9b643b6 100644
--- a/internal/pkg/process/killer_windows.go
+++ b/internal/pkg/process/killer_windows.go
@@ -5,6 +5,7 @@ package process
 
 import (
 	"os"
+	"sync"
 
 	"golang.org/x/sys/windows"
 )
@@ -23,6 +24,7 @@ import (
 // on cancellation (TerminateJobObject), which also closes the inherited pipe
 // handles so cmd.Wait() can return.
 type Killer struct {
+	mu  sync.Mutex
 	job windows.Handle
 }
 
@@ -55,7 +57,12 @@ func NewKiller(p *os.Process) (*Killer, error) {
 // Kill terminates every process currently assigned to the job (the process and
 // all of its descendants).
 func (k *Killer) Kill() error {
-	if k == nil || k.job == 0 {
+	if k == nil {
+		return nil
+	}
+	k.mu.Lock()
+	defer k.mu.Unlock()
+	if k.job == 0 {
 		return nil
 	}
 	return windows.TerminateJobObject(k.job, 1)
@@ -63,7 +70,12 @@ func (k *Killer) Kill() error {
 
 // Close releases the job handle. It does not terminate the processes.
 func (k *Killer) Close() error {
-	if k == nil || k.job == 0 {
+	if k == nil {
+		return nil
+	}
+	k.mu.Lock()
+	defer k.mu.Unlock()
+	if k.job == 0 {
 		return nil
 	}
 	h := k.job
diff --git a/internal/pkg/process/leftover.go b/internal/pkg/process/leftover.go
deleted file mode 100644
index ea4f9f58..00000000
--- a/internal/pkg/process/leftover.go
+++ /dev/null
@@ -1,21 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package process
-
-import (
-	"path/filepath"
-	"strings"
-)
-
-func dirContainsPath(dir, target string) bool {
-	dir = strings.ToLower(filepath.Clean(dir))
-	target = strings.ToLower(filepath.Clean(target))
-	if dir == "." || target == "." {
-		return false
-	}
-	if dir == target {
-		return true
-	}
-	return strings.HasPrefix(target, strings.TrimSuffix(dir, string(filepath.Separator))+string(filepath.Separator))
-}
diff --git a/internal/pkg/process/leftover_others.go b/internal/pkg/process/leftover_others.go
deleted file mode 100644
index 789e4189..00000000
--- a/internal/pkg/process/leftover_others.go
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !windows
-
-package process
-
-import "context"
-
-func KillProcessesWithPaths(_ctx context.Context, _dirs []string, _trackingID string) (int, error) {
-	return 0, nil
-}
diff --git a/internal/pkg/process/leftover_test.go b/internal/pkg/process/leftover_test.go
deleted file mode 100644
index c480a0bc..00000000
--- a/internal/pkg/process/leftover_test.go
+++ /dev/null
@@ -1,39 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package process
-
-import (
-	"path/filepath"
-	"testing"
-)
-
-func TestDirContainsPath(t *testing.T) {
-	base := filepath.Join("base", "job1")
-
-	cases := []struct {
-		name   string
-		dir    string
-		target string
-		want   bool
-	}{
-		{"same dir", base, base, true},
-		{"direct child", base, filepath.Join(base, "app.exe"), true},
-		{"deep child", base, filepath.Join(base, "sub", "sub", "app.exe"), true},
-		{"parent is not within child", filepath.Join(base, "sub"), base, false},
-		{"name-prefix sibling spared", base, filepath.Join("base", "job10", "app.exe"), false},
-		{"unrelated", base, filepath.Join("other", "app.exe"), false},
-		{"empty dir", "", base, false},
-		{"empty target", base, "", false},
-		{"dot dir", ".", base, false},
-		{"case-insensitive hit", base, filepath.Join("base", "JOB1", "app.exe"), true},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			got := dirContainsPath(tc.dir, tc.target)
-			if got != tc.want {
-				t.Fatalf("dirContainsPath(%q, %q) = %v, want %v", tc.dir, tc.target, got, tc.want)
-			}
-		})
-	}
-}
diff --git a/internal/pkg/process/leftover_windows.go b/internal/pkg/process/leftover_windows.go
deleted file mode 100644
index 9de40724..00000000
--- a/internal/pkg/process/leftover_windows.go
+++ /dev/null
@@ -1,263 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package process
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-	"strings"
-	"unsafe"
-
-	"golang.org/x/sys/windows"
-)
-
-func KillProcessesWithPaths(ctx context.Context, dirs []string, trackingID string) (int, error) {
-	if len(dirs) == 0 || trackingID == "" {
-		return 0, nil
-	}
-
-	pids, err := listProcessIDs()
-	if err != nil {
-		return 0, err
-	}
-
-	self := uint32(os.Getpid())
-	var ownSession uint32
-	if err := windows.ProcessIdToSessionId(self, &ownSession); err != nil {
-		return 0, fmt.Errorf("look up own session: %w", err)
-	}
-
-	var killed int
-	var errs []error
-	for _, pid := range pids {
-		if ctx.Err() != nil {
-			break
-		}
-		if pid == self || pid == 0 || pid == 4 {
-			continue
-		}
-		var session uint32
-		if err := windows.ProcessIdToSessionId(pid, &session); err != nil || session != ownSession {
-			continue
-		}
-		ok, err := terminateIfPathsMatch(pid, dirs, trackingID)
-		if err != nil {
-			errs = append(errs, err)
-			continue
-		}
-		if ok {
-			killed++
-		}
-	}
-
-	return killed, errors.Join(errs...)
-}
-
-func terminateIfPathsMatch(pid uint32, dirs []string, trackingID string) (bool, error) {
-	handle, err := windows.OpenProcess(windows.PROCESS_QUERY_INFORMATION|windows.PROCESS_VM_READ|windows.PROCESS_TERMINATE, false, pid)
-	if err != nil {
-		return false, nil
-	}
-	defer func() { _ = windows.CloseHandle(handle) }()
-
-	params, err := processParametersHandle(handle)
-	if err != nil {
-		return false, nil
-	}
-	matches := false
-fields:
-	for _, field := range []struct {
-		offset  uintptr
-		wow64   uintptr
-		command bool
-	}{
-		{unsafe.Offsetof(windows.RTL_USER_PROCESS_PARAMETERS{}.CurrentDirectory), 0x24, false},
-		{unsafe.Offsetof(windows.RTL_USER_PROCESS_PARAMETERS{}.ImagePathName), 0x38, false},
-		{unsafe.Offsetof(windows.RTL_USER_PROCESS_PARAMETERS{}.CommandLine), 0x40, true},
-	} {
-		value, err := params.unicodeString(handle, field.offset, field.wow64)
-		if err != nil {
-			continue
-		}
-		for _, dir := range dirs {
-			if !field.command && dirContainsPath(dir, value) || field.command && strings.Contains(strings.ToLower(value), strings.ToLower(strings.TrimRight(dir, `\/`)+`\`)) {
-				matches = true
-				break fields
-			}
-		}
-	}
-	if !matches {
-		return false, nil
-	}
-	value, err := params.environmentVariable(handle, "RUNNER_TRACKING_ID")
-	if err != nil || value != trackingID {
-		return false, nil
-	}
-	if err := windows.TerminateProcess(handle, 1); err != nil {
-		return false, fmt.Errorf("terminate pid %d: %w", pid, err)
-	}
-	return true, nil
-}
-
-// listProcessIDs returns the PIDs of every process in a Toolhelp snapshot.
-func listProcessIDs() ([]uint32, error) {
-	snap, err := windows.CreateToolhelp32Snapshot(windows.TH32CS_SNAPPROCESS, 0)
-	if err != nil {
-		return nil, err
-	}
-	defer func() { _ = windows.CloseHandle(snap) }()
-
-	var entry windows.ProcessEntry32
-	entry.Size = uint32(unsafe.Sizeof(entry))
-
-	pids := make([]uint32, 0, 256)
-	err = windows.Process32First(snap, &entry)
-	for err == nil {
-		pids = append(pids, entry.ProcessID)
-		err = windows.Process32Next(snap, &entry)
-	}
-	if !errors.Is(err, windows.ERROR_NO_MORE_FILES) {
-		return pids, err
-	}
-	return pids, nil
-}
-
-type remoteParameters struct {
-	address uintptr
-	wow64   bool
-}
-
-func processParametersHandle(handle windows.Handle) (remoteParameters, error) {
-	var pbi windows.PROCESS_BASIC_INFORMATION
-	var retLen uint32
-	if err := windows.NtQueryInformationProcess(handle, windows.ProcessBasicInformation, unsafe.Pointer(&pbi), uint32(unsafe.Sizeof(pbi)), &retLen); err != nil {
-		return remoteParameters{}, err
-	}
-	pebAddr := uintptr(unsafe.Pointer(pbi.PebBaseAddress))
-	wow64 := false
-	if unsafe.Sizeof(uintptr(0)) == 8 {
-		var peb32 uintptr
-		if err := windows.NtQueryInformationProcess(handle, windows.ProcessWow64Information, unsafe.Pointer(&peb32), uint32(unsafe.Sizeof(peb32)), &retLen); err != nil {
-			return remoteParameters{}, err
-		}
-		if peb32 != 0 {
-			pebAddr = peb32
-			wow64 = true
-		}
-	}
-	if pebAddr == 0 {
-		return remoteParameters{}, errors.New("nil PEB base address")
-	}
-	params := remoteParameters{wow64: wow64}
-	address, err := params.pointer(handle, pebAddr+params.offset(unsafe.Offsetof(windows.PEB{}.ProcessParameters), 0x10))
-	if err != nil {
-		return remoteParameters{}, err
-	}
-	if address == 0 {
-		return remoteParameters{}, errors.New("nil process parameters")
-	}
-	params.address = address
-	return params, nil
-}
-
-func (p remoteParameters) offset(native, wow64 uintptr) uintptr {
-	if p.wow64 {
-		return wow64
-	}
-	return native
-}
-
-func (p remoteParameters) pointer(handle windows.Handle, address uintptr) (uintptr, error) {
-	var value uintptr
-	size := unsafe.Sizeof(value)
-	if p.wow64 {
-		size = 4
-	}
-	var read uintptr
-	if err := windows.ReadProcessMemory(handle, address, (*byte)(unsafe.Pointer(&value)), size, &read); err != nil {
-		return 0, err
-	}
-	if read != size {
-		return 0, errors.New("short pointer read")
-	}
-	return value, nil
-}
-
-func (p remoteParameters) unicodeString(handle windows.Handle, native, wow64 uintptr) (string, error) {
-	address := p.address + p.offset(native, wow64)
-	length, err := readRemoteU16(handle, address)
-	if err != nil || length == 0 {
-		return "", err
-	}
-	buffer, err := p.pointer(handle, address+p.offset(unsafe.Offsetof(windows.NTUnicodeString{}.Buffer), 4))
-	if err != nil {
-		return "", err
-	}
-	value := make([]uint16, (int(length)+1)/2)
-	var read uintptr
-	if err := windows.ReadProcessMemory(handle, buffer, (*byte)(unsafe.Pointer(&value[0])), uintptr(length), &read); err != nil {
-		return "", err
-	}
-	if read != uintptr(length) {
-		return "", errors.New("short string read")
-	}
-	return windows.UTF16ToString(value), nil
-}
-
-func (p remoteParameters) environmentVariable(handle windows.Handle, name string) (string, error) {
-	address, err := p.pointer(handle, p.address+p.offset(unsafe.Offsetof(windows.RTL_USER_PROCESS_PARAMETERS{}.Environment), 0x48))
-	if err != nil || address == 0 {
-		return "", err
-	}
-	var entry []uint16
-	for consumed := uintptr(0); consumed < 32*1024*1024; {
-		var region windows.MemoryBasicInformation
-		if err := windows.VirtualQueryEx(handle, address+consumed, &region, unsafe.Sizeof(region)); err != nil {
-			return "", err
-		}
-		size := min(uintptr(4096), region.BaseAddress+region.RegionSize-address-consumed)
-		if size < 2 {
-			return "", errors.New("invalid environment region")
-		}
-		buffer := make([]uint16, size/2)
-		var read uintptr
-		if err := windows.ReadProcessMemory(handle, address+consumed, (*byte)(unsafe.Pointer(&buffer[0])), uintptr(len(buffer)*2), &read); err != nil {
-			return "", err
-		}
-		if read != uintptr(len(buffer)*2) {
-			return "", errors.New("short environment read")
-		}
-		for _, value := range buffer {
-			if value != 0 {
-				entry = append(entry, value)
-				continue
-			}
-			if len(entry) == 0 {
-				return "", nil
-			}
-			key, value, ok := strings.Cut(windows.UTF16ToString(entry), "=")
-			if ok && strings.EqualFold(key, name) {
-				return value, nil
-			}
-			entry = entry[:0]
-		}
-		consumed += read
-	}
-	return "", errors.New("environment exceeds read limit")
-}
-
-// readRemoteU16 reads a single uint16 from another process.
-func readRemoteU16(handle windows.Handle, addr uintptr) (uint16, error) {
-	var v uint16
-	var n uintptr
-	if err := windows.ReadProcessMemory(handle, addr, (*byte)(unsafe.Pointer(&v)), unsafe.Sizeof(v), &n); err != nil {
-		return 0, err
-	}
-	if n != unsafe.Sizeof(v) {
-		return 0, errors.New("short uint16 read")
-	}
-	return v, nil
-}
diff --git a/internal/pkg/process/leftover_windows_test.go b/internal/pkg/process/leftover_windows_test.go
deleted file mode 100644
index d9374a07..00000000
--- a/internal/pkg/process/leftover_windows_test.go
+++ /dev/null
@@ -1,106 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package process
-
-import (
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"syscall"
-	"testing"
-	"time"
-	"unsafe"
-
-	"github.com/stretchr/testify/require"
-	"golang.org/x/sys/windows"
-)
-
-func startSleeperIn(t *testing.T, system, dir, trackingID string) *exec.Cmd {
-	t.Helper()
-	cmd := exec.Command(filepath.Join(os.Getenv("SystemRoot"), system, "ping.exe"), "-n", "60", "127.0.0.1")
-	cmd.Dir = dir
-	cmd.Env = append(os.Environ(), "RUNNER_TRACKING_ID="+trackingID)
-	cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: true}
-	require.NoError(t, cmd.Start())
-	t.Cleanup(func() {
-		_ = cmd.Process.Kill()
-		_, _ = cmd.Process.Wait()
-	})
-	return cmd
-}
-
-func processCWD(pid uint32) (string, error) {
-	h, err := windows.OpenProcess(windows.PROCESS_QUERY_INFORMATION|windows.PROCESS_VM_READ, false, pid)
-	if err != nil {
-		return "", err
-	}
-	defer func() { _ = windows.CloseHandle(h) }()
-	params, err := processParametersHandle(h)
-	if err != nil {
-		return "", err
-	}
-	return params.unicodeString(h, unsafe.Offsetof(windows.RTL_USER_PROCESS_PARAMETERS{}.CurrentDirectory), 0x24)
-}
-
-func awaitCWD(t *testing.T, pid int) string {
-	t.Helper()
-	var cwd string
-	require.Eventually(t, func() bool {
-		var err error
-		cwd, err = processCWD(uint32(pid))
-		return err == nil && cwd != ""
-	}, 5*time.Second, 50*time.Millisecond, "process cwd should become readable")
-	return cwd
-}
-
-func TestKillProcessesWithPathsTracking(t *testing.T) {
-	for _, system := range []string{"System32", "SysWOW64"} {
-		for _, trackingID := range []string{"leftover-test", "", "another-job"} {
-			t.Run(system+"/tracking="+trackingID, func(t *testing.T) {
-				if system == "SysWOW64" {
-					if runtime.GOARCH != "amd64" && runtime.GOARCH != "arm64" {
-						t.Skip("needs a 64-bit runner")
-					}
-					if _, err := os.Stat(filepath.Join(os.Getenv("SystemRoot"), system, "ping.exe")); err != nil {
-						t.Skip("32-bit Windows tools unavailable")
-					}
-				}
-				dir := t.TempDir()
-				cmd := startSleeperIn(t, system, dir, trackingID)
-				require.True(t, dirContainsPath(dir, awaitCWD(t, cmd.Process.Pid)))
-				killed, err := KillProcessesWithPaths(t.Context(), []string{t.TempDir()}, "leftover-test")
-				require.NoError(t, err)
-				require.Zero(t, killed)
-				killed, err = KillProcessesWithPaths(t.Context(), []string{dir}, "leftover-test")
-				require.NoError(t, err)
-				if trackingID == "leftover-test" {
-					require.Equal(t, 1, killed)
-					require.Eventually(t, func() bool {
-						return !processAlive(cmd.Process.Pid)
-					}, 5*time.Second, 50*time.Millisecond)
-				} else {
-					require.Zero(t, killed)
-					require.True(t, processAlive(cmd.Process.Pid))
-				}
-			})
-		}
-	}
-}
-
-func TestKillProcessesWithPathsCommandLine(t *testing.T) {
-	workspace := t.TempDir()
-	cmd, ready := newTestProcess(t, "child", false)
-	cmd.Dir = t.TempDir()
-	cmd.Args = append(cmd.Args, filepath.Join(workspace, "reference"))
-	cmd.Env = append(cmd.Env, "RUNNER_TRACKING_ID=command-test")
-	require.NoError(t, cmd.Start())
-	ready()
-	killed, err := KillProcessesWithPaths(t.Context(), []string{workspace}, "command-test")
-	require.NoError(t, err)
-	require.Equal(t, 1, killed)
-	require.Eventually(t, func() bool {
-		return !processAlive(cmd.Process.Pid)
-	}, 5*time.Second, 50*time.Millisecond)
-}
diff --git a/internal/pkg/process/suspend_others.go b/internal/pkg/process/suspend_others.go
new file mode 100644
index 00000000..9f51a19d
--- /dev/null
+++ b/internal/pkg/process/suspend_others.go
@@ -0,0 +1,17 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+//go:build !windows
+
+package process
+
+import (
+	"os"
+	"os/exec"
+)
+
+func startSuspended(_cmd *exec.Cmd) {}
+
+func resume(_process *os.Process) error {
+	return nil
+}
diff --git a/internal/pkg/process/suspend_windows.go b/internal/pkg/process/suspend_windows.go
new file mode 100644
index 00000000..1fff81d4
--- /dev/null
+++ b/internal/pkg/process/suspend_windows.go
@@ -0,0 +1,36 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package process
+
+import (
+	"os"
+	"os/exec"
+	"syscall"
+
+	"golang.org/x/sys/windows"
+)
+
+var procNtResumeProcess = windows.NewLazySystemDLL("ntdll.dll").NewProc("NtResumeProcess")
+
+// startSuspended holds the process until Capture has assigned it to its job objects, so no child it starts escapes them.
+func startSuspended(cmd *exec.Cmd) {
+	if cmd.SysProcAttr == nil {
+		cmd.SysProcAttr = &syscall.SysProcAttr{}
+	}
+	cmd.SysProcAttr.CreationFlags |= windows.CREATE_SUSPENDED
+}
+
+func resume(process *os.Process) error {
+	var status windows.NTStatus
+	if err := process.WithHandle(func(handle uintptr) {
+		ret, _, _ := procNtResumeProcess.Call(handle)
+		status = windows.NTStatus(ret)
+	}); err != nil {
+		return err
+	}
+	if status == windows.STATUS_SUCCESS || status == windows.STATUS_PROCESS_IS_TERMINATING { // cancellation may have ended it already
+		return nil
+	}
+	return status
+}
diff --git a/internal/pkg/process/tracked.go b/internal/pkg/process/tracked.go
new file mode 100644
index 00000000..0e9a5e8e
--- /dev/null
+++ b/internal/pkg/process/tracked.go
@@ -0,0 +1,45 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+//go:build linux || darwin
+
+package process
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"os"
+	"slices"
+	"syscall"
+)
+
+// KillTrackedProcesses kills every process whose environment carries the job's RUNNER_TRACKING_ID, like GitHub's orphan cleanup.
+func KillTrackedProcesses(trackingID string) (int, error) {
+	if trackingID == "" {
+		return 0, nil
+	}
+	pids, err := listPIDs()
+	if err != nil {
+		return 0, err
+	}
+	marker := []byte("RUNNER_TRACKING_ID=" + trackingID)
+	self := os.Getpid()
+	var killed int
+	var errs []error
+	for _, pid := range pids {
+		if pid == self {
+			continue
+		}
+		env, err := environment(pid)
+		if err != nil || !slices.ContainsFunc(bytes.Split(env, []byte{0}), func(entry []byte) bool { return bytes.Equal(entry, marker) }) {
+			continue
+		}
+		if err := syscall.Kill(pid, syscall.SIGKILL); err != nil && !errors.Is(err, syscall.ESRCH) {
+			errs = append(errs, fmt.Errorf("kill pid %d: %w", pid, err))
+			continue
+		}
+		killed++
+	}
+	return killed, errors.Join(errs...)
+}
diff --git a/internal/pkg/process/tracked_darwin.go b/internal/pkg/process/tracked_darwin.go
new file mode 100644
index 00000000..5d5bd6b9
--- /dev/null
+++ b/internal/pkg/process/tracked_darwin.go
@@ -0,0 +1,41 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package process
+
+import (
+	"bytes"
+	"encoding/binary"
+	"errors"
+
+	"golang.org/x/sys/unix"
+)
+
+func listPIDs() ([]int, error) {
+	procs, err := unix.SysctlKinfoProcSlice("kern.proc.all")
+	if err != nil {
+		return nil, err
+	}
+	pids := make([]int, 0, len(procs))
+	for _, proc := range procs {
+		pids = append(pids, int(proc.Proc.P_pid))
+	}
+	return pids, nil
+}
+
+// environment skips kern.procargs2's argc, executable path and arguments to the NUL-separated environment.
+func environment(pid int) ([]byte, error) {
+	args, err := unix.SysctlRaw("kern.procargs2", pid)
+	if err != nil {
+		return nil, err
+	}
+	if len(args) < 4 {
+		return nil, errors.New("short kern.procargs2")
+	}
+	_, rest, _ := bytes.Cut(args[4:], []byte{0})
+	rest = bytes.TrimLeft(rest, "\x00")
+	for range binary.NativeEndian.Uint32(args) {
+		_, rest, _ = bytes.Cut(rest, []byte{0})
+	}
+	return rest, nil
+}
diff --git a/internal/pkg/process/tracked_linux.go b/internal/pkg/process/tracked_linux.go
new file mode 100644
index 00000000..74006127
--- /dev/null
+++ b/internal/pkg/process/tracked_linux.go
@@ -0,0 +1,27 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package process
+
+import (
+	"os"
+	"strconv"
+)
+
+func listPIDs() ([]int, error) {
+	entries, err := os.ReadDir("/proc")
+	if err != nil {
+		return nil, err
+	}
+	var pids []int
+	for _, entry := range entries {
+		if pid, err := strconv.Atoi(entry.Name()); err == nil {
+			pids = append(pids, pid)
+		}
+	}
+	return pids, nil
+}
+
+func environment(pid int) ([]byte, error) {
+	return os.ReadFile("/proc/" + strconv.Itoa(pid) + "/environ")
+}
diff --git a/internal/pkg/process/tracked_others.go b/internal/pkg/process/tracked_others.go
new file mode 100644
index 00000000..7485adf1
--- /dev/null
+++ b/internal/pkg/process/tracked_others.go
@@ -0,0 +1,11 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+//go:build !linux && !darwin
+
+package process
+
+// KillTrackedProcesses does nothing, Windows ends a job's processes through its job object.
+func KillTrackedProcesses(_trackingID string) (int, error) {
+	return 0, nil
+}
diff --git a/internal/pkg/process/tracked_test.go b/internal/pkg/process/tracked_test.go
new file mode 100644
index 00000000..e8d28aa1
--- /dev/null
+++ b/internal/pkg/process/tracked_test.go
@@ -0,0 +1,38 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+//go:build linux || darwin
+
+package process
+
+import (
+	"os"
+	"os/exec"
+	"strconv"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestKillTrackedProcessesKillsOnlyTheJobsProcesses(t *testing.T) {
+	trackingID := "gitea_test_" + strconv.FormatInt(time.Now().UnixNano(), 10)
+	start := func(id string) *exec.Cmd {
+		cmd := exec.Command("sleep", "60")
+		cmd.Env = append(os.Environ(), "RUNNER_TRACKING_ID="+id)
+		require.NoError(t, cmd.Start())
+		t.Cleanup(func() {
+			_ = cmd.Process.Kill()
+			_ = cmd.Wait()
+		})
+		return cmd
+	}
+	tracked, other := start(trackingID), start(trackingID+"_other")
+
+	killed, err := KillTrackedProcesses(trackingID)
+	require.NoError(t, err)
+	require.Equal(t, 1, killed)
+	require.ErrorContains(t, tracked.Wait(), "killed")
+	require.NoError(t, other.Process.Signal(syscall.Signal(0)))
+}
diff --git a/internal/pkg/process/treekill.go b/internal/pkg/process/treekill.go
index f1ec8d43..5cbe1d10 100644
--- a/internal/pkg/process/treekill.go
+++ b/internal/pkg/process/treekill.go
@@ -36,9 +36,9 @@ type TreeKill struct {
 	KeepLeftovers bool
 }
 
-// NewTreeKill sets cmd.Cancel and cmd.WaitDelay. Call it before cmd.Start, then
-// call Capture once after a successful Start.
+// NewTreeKill sets cmd.Cancel, cmd.WaitDelay and CREATE_SUSPENDED. Call it after setting cmd.SysProcAttr, and Capture once after a successful Start.
 func NewTreeKill(cmd *exec.Cmd) *TreeKill {
+	startSuspended(cmd)
 	t := &TreeKill{}
 	cmd.Cancel = func() error {
 		if k := t.killer.Load(); k != nil {
@@ -63,14 +63,17 @@ func NewTreeKill(cmd *exec.Cmd) *TreeKill {
 // Call it once after cmd.Start. On failure the command falls back to the default
 // single-process kill and the returned error is for logging only; WaitDelay
 // still bounds the wait. The returned Killer should be closed when the command
-// finishes (Close is nil-safe).
+// finishes (Close is nil-safe). It also resumes p.
 func (t *TreeKill) Capture(p *os.Process) (*Killer, error) {
 	k, err := NewKiller(p)
-	if err != nil {
-		return nil, err
+	if err == nil {
+		t.killer.Store(k)
 	}
-	t.killer.Store(k)
-	return k, nil
+	if resumeErr := resume(p); resumeErr != nil {
+		_ = p.Kill()
+		return nil, errors.Join(err, k.Close(), resumeErr)
+	}
+	return k, err
 }
 
 // Wait is cmd.Wait, but like GitHub's runner a leftover holding a successful command's output does not fail it.
diff --git a/internal/pkg/process/treekill_test.go b/internal/pkg/process/treekill_test.go
index 97c1b1ca..e138e2c4 100644
--- a/internal/pkg/process/treekill_test.go
+++ b/internal/pkg/process/treekill_test.go
@@ -33,14 +33,13 @@ func TestTreeKillWaitWithLeftoverHoldingOutput(t *testing.T) {
 	}
 	for _, tc := range []struct {
 		name    string
-		timeout time.Duration
 		wantErr bool
 	}{
-		{name: "succeeds", timeout: time.Minute},
-		{name: "fails once the context is done", timeout: 10 * time.Millisecond, wantErr: true},
+		{name: "succeeds"},
+		{name: "fails once the context is done", wantErr: true},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
-			ctx, cancel := context.WithTimeout(t.Context(), tc.timeout)
+			ctx, cancel := context.WithCancel(t.Context())
 			defer cancel()
 			cmd := exec.CommandContext(ctx, "sh", "-c", "sleep 30 &")
 			cmd.Stdout = io.Discard
@@ -51,6 +50,9 @@ func TestTreeKillWaitWithLeftoverHoldingOutput(t *testing.T) {
 			killer, err := tk.Capture(cmd.Process)
 			require.NoError(t, err)
 			t.Cleanup(func() { _ = killer.Kill() })
+			if tc.wantErr {
+				cancel()
+			}
 
 			err = tk.Wait(ctx, cmd)
 			if tc.wantErr {
@@ -66,11 +68,11 @@ func TestTreeKillCaptureStoresKiller(t *testing.T) {
 	cmd, ready := newTestProcess(t, "child", false)
 	tk := NewTreeKill(cmd)
 	require.NoError(t, cmd.Start())
-	ready()
 
 	killer, err := tk.Capture(cmd.Process)
 	require.NoError(t, err)
 	require.NotNil(t, killer)
+	ready()
 	require.NoError(t, cmd.Cancel())
 	require.NoError(t, killer.Close())
 }
diff --git a/scripts/test-windows-setup.ps1 b/scripts/test-windows-setup.ps1
index ed1f4a3f..c6060e4b 100644
--- a/scripts/test-windows-setup.ps1
+++ b/scripts/test-windows-setup.ps1
@@ -4,6 +4,7 @@ $shared = '\\host.lan\Data'
 try {
     Write-Output '==> Setting up Windows'
     Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem LongPathsEnabled 1
+    Set-TimeZone -Id UTC # QEMU's clock is UTC, any other zone boots the cached install hours off and jumps when time syncs
     foreach ($tool in @(
             @('git.7z.exe', 'https://github.com/git-for-windows/git/releases/download/v2.56.0.windows.3/PortableGit-2.56.0.3-64-bit.7z.exe', '4fc27b779829a36df77911e3f4dea09c66c790dd6c5f7dfa3b6a5479f1fe354f'),
             @('node.zip', 'https://nodejs.org/dist/v24.22.1/node-v24.22.1-win-x64.zip', 'd2046d28c2c3dcd211ac5145c0bf30e2047ef9dfb306693c8c6e2eccd8b95fa5'),
diff --git a/scripts/test-windows.sh b/scripts/test-windows.sh
index bf06a7f2..231b9c26 100755
--- a/scripts/test-windows.sh
+++ b/scripts/test-windows.sh
@@ -81,6 +81,7 @@ call C:\run.bat
 EOF
 
 kvm=Y cores=max
+cpuFlags=-amx-tile,-amx-int8,-amx-bf16,-amx-fp16,-amx-complex # AMX overflows Go's exception handling into the heap, https://github.com/golang/go/issues/81238
 if ! docker run --rm --privileged --entrypoint sh "$image" -c 'test -w /dev/kvm'; then
   kvm=N cores=4 # more emulated vCPUs slow Windows down
   echo "==> The docker host has no usable /dev/kvm, Windows runs emulated and much slower"
@@ -102,7 +103,7 @@ fi
 deadline=$((SECONDS + timeout * 60))
 boot() {
   name="gitea-runner-windows-test-${work##*.}-$1" # a new name ends the log and monitor loops of the previous VM
-  docker create --rm --name "$name" --privileged -v "$volume:/storage" "${vm[@]}" -e KVM="$kvm" -e CPU_CORES="$cores" -e DISK_CACHE=unsafe -e DISK_IO=threads \
+  docker create --rm --name "$name" --privileged -v "$volume:/storage" "${vm[@]}" -e KVM="$kvm" -e CPU_CORES="$cores" -e CPU_FLAGS="$cpuFlags" -e DISK_CACHE=unsafe -e DISK_IO=threads \
     --entrypoint timeout "$image" "$(((deadline - SECONDS) / 60 + 10))m" /usr/bin/tini -s /run/entry.sh >/dev/null # the timeout stops the VM even when this script is killed before its cleanup runs
   if [ "$cached" = Y ]; then
     docker cp "$cache/storage/." "$name:/storage"