wmic is gone, and Node's process trees on Windows 11 now come back empty

Promise.allSettled turns a rejection into a result somebody has to go and read, and the polling loop in question did not read it. So `spawn wmic ENOENT` arrived at the UI as an empty child list, with the range in `package.json` saying `^0.6.0` and the lockfile saying 0.6.0 ^[8]. The pane showed about 77 MB, roughly the PowerShell host on its own, with the coding agent inside it and the dev server that agent had started counted as nothing at all ^[2].

The version arithmetic is the part that will keep this alive. pidtree shipped the fix in 1.0.0, which still tries wmic first and falls back to `Get-CimInstance` when the binary is missing ^[6]. A caret range of `^0.6.0` never resolves to 1.0.0 ^[7], so the fix can be published, available, and completely absent from your tree while every dependency check comes back clean. The author's advice is to look at what you resolve rather than what you declared ^[15].

If you write the replacement yourself, the shape of the cost matters. One snapshot of `Win32_Process` returning 396 rows took 200 ms, while five per-PID filtered queries took 517 ms ^[9]. That works out to about 103 ms per filtered call, which puts the whole-machine snapshot below the price of two filters ^[1]. Swap five filters for one snapshot and an in-memory parent-to-children map and the same cycle drops by 317 ms, about 61 per cent ^[2], because the expense sits in starting the CIM call rather than in the rows it returns ^[10].

Why the tree has to be right is the second half of the source. Killing the root `cmd` left its `timeout` grandchild running, confirmed by the same count before and after ^[12]. `Stop-Process` and Node's `process.kill(pid)` each end exactly one process, since Windows has no POSIX process groups and no reparenting cleanup, and the descendants carry on holding their handles and their ports ^[11]. `taskkill /F /T` terminated four PIDs deepest first and then upward ^[13], and that ordering is the mechanism, not a detail: kill the root first and the links you needed to find the rest are gone, leaving orphans with nothing pointing at them ^[14].

Put the two halves together and a childless tree is not a lost metric. It is a kill routine that iterates over zero children, returns without complaint, and leaves the dev server bound to its port. The measurements come from one machine, Windows 11 Home build 26200 in August 2026, on work the author does on a project called NestMux ^[1], and pidtree is not an obscure dependency: it backs pkill-style behaviour across a lot of tooling and pulls millions of downloads a week ^[4]. As the author puts it, the failure does not look like a failure, it looks like a process with no children ^[16].