test(harness): fail-closed lifecycle for bounded probe runner

[chaliy]

What changed

Test-only, one file: threat_model_tests.rs (+211/-33). Reworks the shared run_command_bounded lifecycle per the review on #2680:

• Retention truncated BEFORE extending: the sample buffer never passes the 8192 cap (was: extend-then-truncate kept a chunk over).
• Interrupted reads retried; real reader errors end capture with partial bytes kept and a new read_error flag — never relabeled as clean EOF.
• Exact-cap-then-EOF is not oversize; only real excess sets the flag.
• Reaping bounded inside a finite 5s grace; no unconditional wait() past the cleanup deadline (targeted allow documents why the lint suggestion would reintroduce the hang).
• timed_out retained as recorded, never recomputed; drain 2s + reap 5s graces documented against the execution deadline.
• TM-DOS-136 regression gains !read_error and the corrected 8192-byte cap text.
• Bounded selftests: exact-cap, cap+1, scripted Interrupted/error pipes, timeout kill+reap (~2s), overflow flag.

Does not touch #2681 distinct run_bounded_probe helper.

Before / After

Before: reader errors read as clean EOF; retention could exceed the cap by a chunk; kill-path wait() unbounded; no lifecycle selftests.
After: threat_model 219 passed (only pre-existing macOS nesting abort skipped, identical on unmodified code); error 14, partial_parse 11 green; fmt plus clippy -D warnings clean.

Risk

• Test-only change. No production code touched.

Checklist

• Tests added or updated
• Backward compatibility considered (internal test harness)

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	1221b7f	Commit Preview URL Branch Preview URL	Oct 11 2026, 09:00 AM

[chaliy]

Review of exact candidate 1221b7f against the full post-merge lifecycle review (6106968187).

The cap-before-copy, exact-cap EOF distinction, Interrupted retry, real-read-error flag and bounded try_wait reaping address the prior concrete implementation defects. The documented execution deadline plus 2-second drain and 5-second reap grace is honest; keep that distinction in the evidence.

Remaining proof required before declaring the lifecycle review resolved:

1. Add the retained-pipe negative case explicitly requested in the previous review. A direct child exiting while a bounded descendant holds stdout/stderr must return a failed/incomplete result within the documented total budget. Keep the descendant and its cleanup under an outer deadline and prove cleanup, rather than leaving a sleeper or reader indefinitely alive. Preserve a passing direct-child timeout/reap case. Cover the unavailable/failed reap verdict through a deterministic safe seam if real OS failure cannot be induced safely.
2. The successful-capture path still calls reader.join() without a completion guard. Receipt of the final channel message is not itself proof the thread is terminal. Use a bounded completion check before joining, marking incomplete if the join cannot be established safe within the stated lifecycle budget; avoid replacing this with another unconditional wait. Add an elapsed-total assertion to the timeout and retained-pipe tests, not just result flags.
3. The new child selftests invoke run_command_bounded directly, bypassing the CPU/stack limit launcher. In particular the builtin busy loop currently has only a wall watchdog. Apply and verify finite CPU/stack bounds to these child probes while retaining the cap and wall/cleanup limits. The scripted in-memory reader tests are useful, but also demonstrate that a real reader error becomes an incomplete failure at the parent boundary.

These are test-harness lifecycle/proof requirements, not a request to reopen any independently closed product finding. Keep the current branch and additive history; no force-push, test weakening, duplicate PR or CI waiver. Read full issue comments, formal reviews and inline threads. The skipped macOS misconfiguration case remains partial local evidence, not a full-gate waiver. Final proof still needs green required checks for the final head, actual squash merge SHA/ancestry, exact-merged producers and successful assertion exits with durable file logs.