Thank you, Quinn. One remaining clarification to help us distinguish a supported XPC design from a stricter fault model: Can an unprivileged app using only documented public macOS APIs obtain an identity-bound handle for its embedded XPC service before the service sends its first message, and use an independent observer to enforce and confirm termination within a deadline if the entire service or the still-living host is suspended? If not, what supported lifecycle guarantee should an embedded XPC design rely on, and which guarantees require a separate privileged owner or a narrower fault model? We understand your point that SIGSTOP is outside the XPC service model; we are not proposing to use it as part of normal operation. An explicit unsupported boundary would be a useful answer. We would keep connection interruption, process exit, and reaping as separate claims.