Problem
`DataStore::collect_data()` (src/core/services/data_store.cpp:205-241) tracks `forked_unseen_pids_` to count processes that lived entirely between polls (never seen in a snapshot). The cleanup that removes now-visible PIDs from that set (`erase_if(forked_unseen_pids_, current_pids...)`, line 237-238) runs after the event-draining loop that processes Exit events (line 226-233), not before.
If a PID was forked before the previous poll (still in `forked_unseen_pids_` from last tick), gets captured in this tick's poll (so it's in `current_pids`), and its Exit event is also drained in this same tick, the Exit branch still finds it in `forked_unseen_pids_` (not yet cleaned up) and increments `short_lived_exits` — even though the process WAS observed in a snapshot this tick.
Fix
Remove current-snapshot PIDs from `forked_unseen_pids_` before processing Exit events in the same tick, or have the Exit branch itself check that the exiting PID is absent from `current_pids`.
Cosmetic/stat-accuracy only (affects the "Churn" short-lived counter), not a crash.
Problem
`DataStore::collect_data()` (src/core/services/data_store.cpp:205-241) tracks `forked_unseen_pids_` to count processes that lived entirely between polls (never seen in a snapshot). The cleanup that removes now-visible PIDs from that set (`erase_if(forked_unseen_pids_, current_pids...)`, line 237-238) runs after the event-draining loop that processes Exit events (line 226-233), not before.
If a PID was forked before the previous poll (still in `forked_unseen_pids_` from last tick), gets captured in this tick's poll (so it's in `current_pids`), and its Exit event is also drained in this same tick, the Exit branch still finds it in `forked_unseen_pids_` (not yet cleaned up) and increments `short_lived_exits` — even though the process WAS observed in a snapshot this tick.
Fix
Remove current-snapshot PIDs from `forked_unseen_pids_` before processing Exit events in the same tick, or have the Exit branch itself check that the exiting PID is absent from `current_pids`.
Cosmetic/stat-accuracy only (affects the "Churn" short-lived counter), not a crash.