Processes

Every process your Windows account owns. Services is this list filtered down to the ones holding a socket.

What it can see

Processes owned by your account, and nothing else. LocalDocks never elevates and never requests SeDebugPrivilege, so system processes and other users’ processes are outside its reach. A note above the table says so, and the status bar carries a standing unelevated marker.

Columns

Column	Meaning
NAME	The executable name. A process that also appears in Services is marked with an `svc` chip and rendered in the primary text colour.
PID / PPID	Process identifier and parent process identifier.
CPU	Derived from the change in cumulative kernel and user time over the interval, divided by elapsed time and logical core count.
MEMORY	Working set.
THREADS	Current thread count.
UPTIME	Time since creation.

Filter chips are All, Services and Other, with free-text matching on name, PID and parent PID.

Process identity

A bare PID is not an identity. Windows recycles process identifiers, so a row that was true a moment ago can describe a completely different process now.

LocalDocks identifies a process by its PID and its creation time together. That pairing is what makes a row safe to act on, and it is the key every detail lookup and every destructive command is addressed by.

The detail panel

The LocalDocks detail panel showing endpoints, classification with its reason, CPU, memory, uptime, threads, executable path, command line, working directory, parent PID and start time.

The process block — executable path, command line, working directory, parent PID and start time — is fetched when the panel opens, never on the scan loop. That keeps each tick cheap.

Fields LocalDocks was refused render as denied, and fields it cannot read at all render as unavailable. Neither renders as an empty string, because a blank looks like a value that happens to be missing.

Working directory always reads Unavailable in V1: reading it requires walking the process environment block, which V1 does not do.

Terminating a process

The LocalDocks terminate confirmation dialog naming the process, PID and start time, and explaining that creation time is re-verified before terminating.

Three things are true of every termination:

Identity is re-verified. The backend re-opens the PID, reads its creation time, and refuses if it does not match the row you clicked. A recycled PID cannot be killed by a stale row.
It is a force terminate. Windows has no graceful equivalent of SIGTERM. The process gets no chance to clean up and unsaved work is lost. The dialog says so rather than implying a clean shutdown.
The confirmation cannot be disabled. There is no “don’t ask again”, because a safety confirmation you can switch off is not one.

Focus opens on Cancel, not on the destructive button, so a stray Enter cannot terminate anything.

What can come back

Result	Meaning
Terminated	The process is gone. It disappears from the next snapshot, and the panel closes with it.
Stale	The creation time no longer matches. Nothing was terminated — the PID now belongs to a different process.
Denied	Windows refused the operation for this process.
Failed	Something else went wrong; the message names it.