I agree with Vince that what I observe makes sense. However, since instance X does perform TCEXIT, in which it can report the value of _EXIT in a log, I'd like its value to be set to a value indicating that neither EXIT nor an external event, but a local REBOOT caused the termination. However, esp. in view of the restriction of using REBOOT in Vista and later, I think just changing the documentation would be sufficient.
On my systems I log the starting and stopping of each command processor instance, and also the calls to the REBOOT command. I do have the means to determine which (EXIT vs. REBOOT) invoked TCEXIT.
do any of REBOOT options /H, /K, /L or /W require elevated TCC in Vista et al.? Would not make sense to me... but then all I have is a PERSONAL COMPUTER, not a BOSSING ME AROUND COMPUTER.