fix: retain child bounds after captured stream EOF

Author: Sunrisepeak

.agents/docs/2026-11-06-bmi-publication-and-compiler-cap-closeout.md

@@ -199,3 +199,25 @@ small synthetic compiler. The separate GCC mixed workload retains the real
 compiler cap, late failure, recovery, argv and no-op assertions. Selected-object
 controls establish causality; final qualification remains complete current-source
 CI and independent ecosystem review.
+
+### Addendum, 2026-11-06: the final child wait retains its bounds
+
+A final launcher control closes both captured streams before the child sleeps.
+The preceding correction still returned success after 2.002 seconds instead of
+observing the fifty-millisecond stop request: stream EOF had led to an unbounded
+child wait. The same boundary also bypassed an absolute deadline after EOF.
+
+One shared predicate now applies during output reads, remaining error reads and
+the final child wait. It retains the original absolute deadline and stop request;
+observed output retains its idle budget after EOF. Activity on a separately
+captured error stream renews that observed-output budget. Inherited and discarded
+streams retain no inferred idle observation. Child completion is checked during
+the final bounded wait, preserving already completed child statuses.
+
+A finite matrix covers all six stream modes, ordinary and signalled exits,
+completion with bounds configured, stop requests before and after one or both
+streams close, absolute deadlines after closure, captured idle expiry and live
+stderr after stdout closure. Its fifty-three cases pass, together with the
+original launcher tests and the direct EOF regression. Top-level signal behavior
+is additionally covered by the real-Ninja lifecycle control. No budget, compiler
+argument or output stream is changed to make a cancellation succeed.

CHANGELOG.md

@@ -27,7 +27,8 @@
   another generation starts. Stable kernel permits retain live ownership across
   immediate rebuilds; runtime generations leave no-op build identities unchanged.
 - Child stop predicates apply with inherited and discarded streams, including
-  executions without an absolute deadline.
+  executions without an absolute deadline. Captured stream EOF retains stop,
+  absolute and observed-output idle bounds until the child exits.
 - Queued downloads begin their progress budget when a worker starts them,
   rather than inheriting time spent waiting for a slot.
 - Provider progress timeouts identify the stalled download and source attempt,

src/run/run.cpp

@@ -241,6 +241,14 @@ Outcome launch(const Spec& s) {
     auto lastOutput = start;
     bool stop = false;
     const bool keepErr = s.out == Output::stdout_err_kept;
+    const bool captured = s.out == Output::merged || s.out == Output::stdout_only
+        || s.out == Output::stdout_err_shown || keepErr;
+    auto should_stop = [&] {
+        const auto now = clock::now();
+        return (s.total.count() > 0 && now - start >= s.total)
+            || (captured && s.idle.count() > 0 && now - lastOutput >= s.idle)
+            || (s.shouldStop && *s.shouldStop && (*s.shouldStop)());
+    };
     bool errDone = !keepErr;
     // The error stream, read as it arrives so that a program writing much of
     // it is never stopped on a full pipe while its output is read.
@@ -250,17 +258,15 @@ Outcome launch(const Spec& s) {
         if (!e) { errDone = true; return; }
         if (!e->has_value()) return;
         if ((*e)->empty()) { errDone = true; return; }
+        lastOutput = clock::now();
         out.error_output += **e;
     };
-    if (s.out == Output::merged || s.out == Output::stdout_only || s.out == Output::stdout_err_shown
-        || keepErr) {
+    if (captured) {
         std::string acc;
         std::optional<clock::time_point> endedAt;
         for (;;) {
             const auto now = clock::now();
-            if ((s.total.count() > 0 && now - start >= s.total)
-                || (s.idle.count() > 0 && now - lastOutput >= s.idle)
-                || (s.shouldStop && *s.shouldStop && (*s.shouldStop)())) {
+            if (should_stop()) {
                 stop = true;
                 break;
             }
@@ -290,7 +296,7 @@ Outcome launch(const Spec& s) {
         // bounds allow.
         while (!stop && !errDone) {
             const auto now = clock::now();
-            if (s.total.count() > 0 && now - start >= s.total) { stop = true; break; }
+            if (should_stop()) { stop = true; break; }
             if (!endedAt) {
                 if (auto w = p->try_wait(); w && w->has_value()) endedAt = now;
             } else if (now - *endedAt > std::chrono::milliseconds(500)) {
@@ -299,22 +305,16 @@ Outcome launch(const Spec& s) {
             }
             drain_error(std::chrono::milliseconds(100));
         }
-    } else if (s.shouldStop && *s.shouldStop) {
-        // Inherited/discarded streams have no read loop. Cancellation still
-        // belongs to the invocation, so poll the child without changing its
-        // streams or waiting for a separate absolute deadline.
+    }
+    if (!stop && (s.total.count() > 0 || (captured && s.idle.count() > 0)
+                  || (s.shouldStop && *s.shouldStop))) {
+        // Stream EOF is independent of child completion. Keep the same bounds
+        // through the final wait, including inherited and discarded streams.
         for (;;) {
-            if ((*s.shouldStop)()
-                || (s.total.count() > 0 && clock::now() - start >= s.total)) {
-                stop = true;
-                break;
-            }
             auto waited = p->wait_for(std::chrono::milliseconds(20));
             if (!waited || waited->has_value()) break;
+            if (should_stop()) { stop = true; break; }
         }
-    } else if (s.total.count() > 0) {
-        auto w = p->wait_for(s.total);
-        if (w && !w->has_value()) stop = true;
     }
     if (stop) {
         p->end_unit();

tests/unit/test_process_run_exec.cpp

@@ -19,6 +19,69 @@ namespace process = mcpp::run;
 // change mcpp's own environment — that mutation is exactly what leaked into
 // /bin/sh and crashed it on newer-glibc hosts. The addition is the started
 // program's alone; this invocation's statement is what it was.
+TEST(RunExec, StreamCompletionAndChildWaitKeepTheirBounds) {
+    struct Case {
+        const char* name;
+        const char* command;
+        int total = 0;
+        int idle = 0;
+        bool stop = false;
+        int exit = -1;
+    };
+    const std::vector<Case> cases{
+        {"exit", "exit 7", 0, 0, false, 7},
+        {"signal", "kill -TERM $$", 0, 0, false, 143},
+        {"already-exited-bounded", "exit 7", 3000, 0, true, 7},
+        {"open-stop", "sleep 2", 0, 0, true},
+        {"both-EOF-stop", "exec 1>&- 2>&-; sleep 2", 0, 0, true},
+        {"stdout-EOF-stop", "exec 1>&-; sleep 2", 0, 0, true},
+        {"both-EOF-total", "exec 1>&- 2>&-; sleep 2", 50},
+        {"stdout-EOF-total", "exec 1>&-; sleep 2", 50},
+    };
+    auto exercise = [](process::Streams streams, const Case& test) {
+        SCOPED_TRACE(std::format("stream={} case={}", static_cast<int>(streams), test.name));
+        const auto started = std::chrono::steady_clock::now();
+        process::Options options;
+        options.streams = streams;
+        options.total = std::chrono::milliseconds(test.total);
+        options.idle = std::chrono::milliseconds(test.idle);
+        if (test.stop) options.should_stop = [&] {
+            return std::chrono::steady_clock::now() - started > std::chrono::milliseconds(50);
+        };
+        const auto result = process::execute({"/bin/sh", "-c", test.command}, options);
+        if (test.exit >= 0) {
+            EXPECT_EQ(result.exit_code, test.exit);
+            EXPECT_FALSE(result.timed_out);
+        } else {
+            EXPECT_NE(result.exit_code, 0);
+            EXPECT_TRUE(result.timed_out);
+        }
+        EXPECT_LT(std::chrono::steady_clock::now() - started, std::chrono::seconds(1));
+    };
+    for (const auto streams : {process::Streams::inherit, process::Streams::discard,
+            process::Streams::merged, process::Streams::output,
+            process::Streams::output_error_shown, process::Streams::output_error_kept}) {
+        for (const auto& test : cases) exercise(streams, test);
+        if (streams != process::Streams::inherit && streams != process::Streams::discard)
+            exercise(streams, {"both-EOF-idle", "exec 1>&- 2>&-; sleep 2", 0, 50});
+    }
+    exercise(process::Streams::output_error_kept,
+        {"stderr-activity", "exec 1>&-; for i in 1 2 3 4 5 6 7 8; do printf x >&2; sleep .03; done; exit 7",
+         0, 100, false, 7});
+}
+
+TEST(RunExec, StopPredicateAppliesAfterCapturedStreamsClose) {
+    const auto started = std::chrono::steady_clock::now();
+    const auto result = process::execute({"/bin/sh", "-c", "exec 1>&- 2>&-; sleep 2"}, {
+        .streams = process::Streams::merged,
+        .should_stop = [&] {
+            return std::chrono::steady_clock::now() - started > std::chrono::milliseconds(50);
+        }});
+    EXPECT_TRUE(result.timed_out);
+    EXPECT_NE(result.exit_code, 0);
+    EXPECT_LT(std::chrono::steady_clock::now() - started, std::chrono::seconds(1));
+}
+
 TEST(RunExec, StopPredicateAppliesWithoutCapturedStreams) {
     for (const auto streams : {process::Streams::inherit, process::Streams::discard}) {
         const auto started = std::chrono::steady_clock::now();