test(harness): same-handle gate proof, live fault fixtures, launcher receipts

[chaliy]

What changed

Test-only, one file: threat_model_tests.rs. Closes the completion review on #2685 without touching #2681 distinct run_bounded_probe helper:

• join_finished returns the unfinished handle, so the paused-after-send proof releases and joins THAT SAME thread through the actual gate primitive (bounded readiness, release, finite join cleanup, elapsed watchdog). No twin thread, no detached-while-asserting-cleanup.
• Poll-fault fixture uses a direct-exec sleeper: the shell replaces itself, so killing closes the pipes at once with no orphan and no 30s descendant.
• reap_never keeps the real bounded OS cleanup while only the observation is discarded for the verdict: no zombies by construction, no invented exit/reap success.
• Retained-pipe fixture runs under the fail-closed launcher; because incomplete pipe capture precludes the stderr readback by design, the effective bounds are proven through a per-process receipt file the fixture shell writes before parking the sleeper (removed afterwards). Existing fixture reused and strengthened, never duplicated.
• Prior review debt acknowledged: test(harness): join completion gate, fault seams, launcher-bound selftests #2684 merged on formal reviews alone while the completion comment was unresolved; this followup resolves it before any merge.

Before / After

Before: twin-thread gate proof; forked sleeper orphan in the poll fixture; reap skipped under fault; no launcher proof on the retained fixture.
After: threat_model 222 passed (only pre-existing macOS nesting abort skipped, identical on unmodified code); error 14, partial_parse 11 green; fmt plus clippy -D warnings clean.

Risk

• Test-only change. No production code touched.

Checklist

• Tests added or updated
• Backward compatibility considered (internal test harness)

Update: readiness gating, reaped receipt, launcher receipts

Follow-up commits on the same branch add:

• fail_poll fires only after a readiness file proves the victim truly live under bounds (direct-exec sleeper, no orphan); readiness itself is asserted alongside the reaped receipt, cap readback, and elapsed bound.
• BoundedRun gains a reaped receipt: OS termination accounted for, orthogonal to exit_code and to injected observation faults (which discard the observation, never the cleanup). reap_never asserts real cleanup ran alongside its discarded verdict.
• Retained-pipe fixture runs under the fail-closed launcher; because incomplete pipe capture precludes the stderr readback by design, the effective stack/cpu bounds are proven through a per-process receipt file the fixture shell writes before parking the sleeper (removed afterwards).

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	a73d8ed	Commit Preview URL Branch Preview URL	Oct 11 2026, 02:07 PM

[chaliy]

Review of PR2686 exact head7e549fdfbb6ac997a862497f4a8987eb77300af1. The same-handle Unfinished return/release/join now fixes the disconnected twin proof; preserve it. Direct-exec poll fixture and launcher-routed reap fixture are useful progress. This is not a claim of a reproduced hang or a new production defect.

Two requirements from full2685 review6108848597 remain unresolved before merge:

1. bounded_helper_flags_retained_pipes still launches sleep30 in the background and returns in7s without terminating/observing that owned descendant or the retained reader threads. The new receipt proves effective CPU/stack for the fixture, but not controlled cleanup. Keep the existing incomplete verdict and same-runner test. Retain the descendant identity and original reader handles through a test-scoped cleanup mechanism (or equivalent controlled fixture), terminate and finitely observe completion of those actual owned resources after asserting the negative verdict, with cleanup receipts and total elapsed bound. Do not replace the negative flags with success or merely wait for the30s self-expiry. This does not require a universal portable process-tree reaper in production; it requires the test to clean up the resources it intentionally creates.

2. The fail_poll flag fires on the first poll immediately after spawn, before any launcher readiness receipt is required. Therefore exec sleep30 may not yet have run, and this case still has no effective CPU/stack assertion or actual OS reap receipt separate from exit_code=None. Synchronize against a bounded fixture readiness/limit receipt for a truly live bounded victim, then inject the poll failure; assert the intended parent failure plus independently observed termination/reap. The reap_never test similarly must assert actual OS cleanup separately from its deliberately discarded observation. Preserve truthful None/incomplete/timed_out verdicts; no fake success.

Remove stale comments claiming retained fixture runs direct and forked poll sleeper remains orphaned. Local cargo|tail receipts are pipeline exits, not raw cargo exits;222filtered threat passes with misconfig skipped remain partial, not a Linux full-gate waiver. Read this entire issue comment and all formal/inline review threads, keep unchanged full Linux CI, execute foreground CI waits instead of ending with a no-tool Waiting-for-CI final, and obtain fresh exact-merge producer/assertion/build/root-report proof before finding closure. No forcepush, queue/DB/runtime edits, weaker tests or duplicate agents.