fix(desktop): resolve bundled sidecar on cheap path and bound login-shell spawns - #6904

…ildren

## Why

Review found `output_with_timeout` could still hang indefinitely: it sent
only `SIGTERM` to the direct child (no-op on Windows, ignorable on Unix) and
then unconditionally joined the wait thread and both pipe-drain threads. A
child that traps `SIGTERM`, or a forked descendant that keeps the stdout/stderr
pipes open after the direct child exits, left a join blocked forever —
recreating the "Check again" spins-forever failure this work removes.

## What

Extract the helper into `discovery/bounded_command.rs` and rebuild it on the
repo's existing bounded-process pattern (the codex `--version` probe):

- Capture stdout/stderr to regular temp files instead of pipes. A regular file
  returns EOF at its write position regardless of who inherits the descriptor,
  so a pipe-retaining descendant can no longer block the post-exit read. There
  are no drain threads to join.
- Poll the child with `try_wait` against the deadline instead of a wait thread.
- On timeout, spawn the child in its own process group and tear the group down
  with `SIGTERM`, a bounded grace, then an escalating `SIGKILL` (Unix), or
  `Child::kill` (Windows) — guaranteed termination, not signal cooperation.

Extraction also returns `discovery.rs` (1438 -> 1380) and `discovery/tests.rs`
(1820 -> 1820) to within the file-size ratchet, which had been skipping the
Rust/unit/desktop-core/Windows CI lanes.

Adversarial tests (a `SIGTERM`-ignoring child and a descendant retaining the
output descriptors, each with an outer wall-clock bound) verify the hard
deadline; the sidecar cheap-path regression moves to the path-resolution suite.

Origin: Buzz channel harness-detection thread
(#5ef5d5bb-643f-4b87-bbf4-e8b64585ffeb).

Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
Co-authored-by: Will Pfleger <pfleger.will@gmail.com>

The bounded-command helper only tore down the process group on timeout or
spawn error. On a successful exit it reaped the leader and returned, leaving
any descendant the child had backgrounded (a login-shell rc worker, an auth
CLI daemon) alive with the captured-output descriptors and whatever it was
writing. Windows used a direct Child::kill that never touched descendants.

Kill the group/tree unconditionally after the leader exits, errors, or times
out, before reading captured output. The timeout path keeps its SIGTERM +
grace before the final SIGKILL; every other path goes straight to the forced
group kill. Windows delegates to taskkill_tree (taskkill /T /F), matching the
probe_node discipline already in the tree.

Strengthen the adversarial tests: each now runs the helper under an
independent wall-clock watchdog thread (a hung helper fails the test instead
of hanging it) and asserts the backgrounded descendant is dead after both
successful return and timeout.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

Two pass-3 review findings.

(1) Windows success-path tree leak. taskkill /T /PID is a live-root lookup:
once the direct child has exited (the success and post-SIGKILL paths), there
is no root for it to enumerate, so a backgrounded descendant orphaned. Take a
kill-on-close Job Object at spawn and hold it across the whole bounded
operation, mirroring the harness worker-reaping discipline in
process_lifecycle.rs. Closing the job reaps the tree even after the root
exits. Job assignment failure degrades to killing the direct child. The
spawn/wait/kill lifecycle is wrapped in a BoundedChild guard so both
platforms own the tree rather than looking it up after the fact.

(2) Vacuous descendant assertions. The Unix fixtures recorded $$ inside a
( ... ) subshell, which in /bin/sh is the invoking shell PID, not the
background child — so both tests asserted the already-reaped leader was dead,
not the descendant. Record the real background PID via $!. Verified
non-vacuous by mutation: neutering kill_tree now fails
reaps_backgrounded_descendant_on_success (descendant survives).

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

The Job Object was assigned after a runnable spawn, so a probe that
backgrounded a descendant and exited in the same tick escaped ownership,
and job-assignment failure ran the command unowned to the deadline with
only a direct-child kill at teardown — the module's hard-tree guarantee
was false on both paths.

Spawn the child CREATE_SUSPENDED, assign it to the kill-on-close job
while frozen, then resume it via a ToolHelp thread snapshot. No
descendant can exist until the job owns the root. Any failure to create,
assign, or resume is fail-closed: terminate + reap the child and return
None, which discovery treats as command-not-found. The degraded
job: None teardown branch is now unreachable by construction.

Add ignore-gated Windows tests covering the spawn/assign race (looped)
and the timeout path, asserting the recorded descendant PID is reaped.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

The shared runtime catalog is in-memory and starts cold every launch, so
the cheap discovery path reports every harness (not installed) until a
forced pass warms it. The create/edit picker and Agents > Agent defaults
surfaces derive their status straight from that cheap path, so during the
20-65s boot probe they presented the cold catalog as authoritative —
blessing all harnesses unavailable and blocking save — and, if the forced
warm failed, held that state indefinitely with no visible retry.

Track the initial forced pass in module-level state (idle -> pending ->
settled/failed), deduped per launch so AppShell remounts never re-fire it.
useAcpRuntimesQuery overlays that gate: a cold catalog reads as loading
while pending and as a retryable error carrying the probe's real reason
when the warm failed, while a non-empty catalog always wins so a
revalidation or later failure never blanks a good list. The gate only
overlays once the warm has started, so onboarding (which renders before
AppShell fires it) is unaffected; any forced success settles it.

Covered by unit tests for the pure gate (pending/failed/idle/settled,
catalog-wins) and the startBootWarm failure->retry->settle lifecycle
including the no-re-fire guard.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

Command::creation_flags replaces rather than ORs, and BoundedChild::spawn
is the last writer before spawn, so the caller's earlier configure_no_window
(CREATE_NO_WINDOW) was wiped by the bare CREATE_SUSPENDED — Windows login-shell
and auth probes could flash a console window during GUI discovery.

Spawn with CREATE_SUSPENDED | CREATE_NO_WINDOW owned in one place
(BOUNDED_CREATION_FLAGS), drop the now-clobbered configure_no_window calls on
the two bounded callers, and add a compile-time guard asserting both bits are
always present so a future edit can't silently reopen either the console-flash
or the spawn-to-assign race.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

…ixtures

Two correctness gaps on the discovery bounded-command path, both scoped to
`bounded_command.rs`:

Capture was unbounded. `output_with_timeout` redirected login-shell and
auth-probe output into temp files with no ceiling, so a noisy or hostile probe
could fill the disk across its 10s window and `read_captured` then allocated the
whole payload at read time. The process lifetime was bounded but its resource
use was not. Enforce an aggregate 1 MiB `CAPTURE_LIMIT`: check the on-disk size
while the child runs (fail closed, kill the tree, return `None`) and again after
a within-deadline exit for a burst between polls, and cap `read_captured` with
`take` so the buffer can never balloon even if the file grew.

Windows ownership fixtures were self-racing. The success/timeout tests exited or
blocked the cmd root in the same tick the descendant was spawned, so the
kill-on-close job reaped the descendant mid-cold-start before PowerShell could
record its PID — the reap working instantly starved the test of its evidence
(the `descendant never recorded its PID` failure on a real Windows box). The
success test now blocks the root on a synchronous waiter until the PID file is
non-empty; both raise the deadline well above a PowerShell cold start. The
guarantee under test is unchanged — the descendant is still born inside the job
and must be reaped after the root exits.

Added Unix regressions for the capture bound (over-limit producer fails closed;
under-limit output returns in full).

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

…d catalog

`refreshAcpRuntimes` wrote the forced catalog with `setQueryData` and only then
cancelled the in-flight cheap query on the shared key. An in-flight cheap
request that resolves after the write clobbers the fresh forced catalog, and the
boot-warm gate then settles on that stale state. Cancel and await the shared
cheap query first so the forced `setQueryData` is the final write.

Add a regression that holds a real cheap observer fetching, runs the forced
refresh, then resolves the cheap request late; the shared cache must remain the
forced result and the gate must settle on it. Removing the `cancelQueries` call
fails the test, so the cancel is proven load-bearing.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

The capture ceiling was enforced by a 50ms metadata().len() poll of a
temp file — detection after overrun, bounded by throughput not by the
cap, and captured_len mapped a stat failure to 0, failing open. Replace
it with two pipe-drain threads that read into buffers capped by a shared
aggregate AtomicU64 budget: the moment a bounded read crosses the cap the
overflow flag is set, the poll loop kills the already-owned tree, and the
probe fails closed. Nothing over the ceiling is ever materialized, and a
read error fails closed rather than open.

Pipes were abandoned for temp files in an earlier round because a
descendant holding the write end could hang the read forever. The fix is
a strict kill-before-join ordering: the tree is torn down (Unix process
group / Windows kill-on-close Job Object) before any drain is joined, so
every writer is dead and each read hits EOF. The capture test now uses an
indefinite producer (cat /dev/zero) with timeout >> watchdog, proving the
cap — not the deadline — ends the probe. The Windows timeout fixture now
waits synchronously on the descendant PID file before its long block, so
the reap can never starve the assertion of the PID on a slow host.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

…eath

The round-8 drains read each pipe to EOF and were joined only after
kill_tree, on the premise that teardown kills every writer. On Unix
kill_tree is a killpg on the child's process group, so a descendant that
calls setsid()/setpgid() while retaining the inherited stdout survives
the kill, holds the write end open, and the blocking read never reaches
EOF — hanging the join and breaking the hard wall-clock bound (the exact
group-escape primitive Thufir reproduced).

Make the Unix read ends nonblocking and add a shared stop flag that
teardown raises after kill_tree. A killed in-group writer's pipe still
reaches EOF and ends its drain; a group-escaping writer never will, so on
the next WouldBlock after stop the drain returns instead of parking on
it. The escaped writer is allowed to survive — bounded return no longer
depends on every inherited writer exiting. The aggregate fail-closed cap
is unchanged. Windows is unaffected: its kill-on-close Job Object is
created without breakaway, so no writer escapes and the blocking read to
job-close EOF stays sound; the stop flag is inert there.

Adds a Unix regression whose descendant setsid()s out of the group while
holding stdout; the helper must return within the watchdog and fail
closed, and the descendant is asserted alive afterward so the return is
proven to come from the stop path, not an incidental EOF. Corrects the
docs that overclaimed "every writer is dead" to the narrower group
contract already stated for BoundedChild.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

The round-9 drain consulted the stop flag only after a WouldBlock read.
A group-escaped descendant that keeps the pipe continuously readable
returns Ok(n) on every read, so the drain never reached that check and
the post-teardown join was unbounded again. The overflow branch made it
worse by deliberately reading on past the cap.

Bound the Ok(n) path directly: the moment a read crosses the aggregate
cap, set overflow and return from the drain immediately. A writer that
keeps the pipe continuously readable must outpace the drain and so crosses
the finite 1 MiB budget in bounded bytes; a writer that dribbles under the
drain rate produces WouldBlock, where the stop check already bounds it. A
normal child under the cap still drains to EOF untouched. Returning early
re-permits a writer blocking on a full pipe, which is fine only because
the poll loop then sees overflow and kills the tree — documented at the
return site so it is not "fixed" back into an unbounded drain. Adds a
deterministic seam regression: a continuously-ready Read impl with stop
preset must still complete via the overflow return, with no process or
scheduler dependence.

Windows fixtures: the inline `-Command` payloads were mangled crossing the
Rust-std → cmd.exe → powershell quoting gauntlet and never executed (root
exited without running its payload; both ignored tests passed vacuously on
a real host). Rewrite them to write each payload to a temp .ps1 invoked via
`powershell -ExecutionPolicy Bypass -File`, with a PowerShell root and a
`Start-Process -WindowStyle Hidden` descendant so no cmd tokenizer is
involved. Keep the PID-file evidence gating and make every assert dump the
PowerShell transcripts so a remote failure is self-diagnosing. Test-only;
the reaping guarantee under test is unchanged.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

…ws lifecycle tests

The outer test watchdog panicked inside recv_timeout with no access to the
PowerShell transcripts, so a post-timeout teardown/drain hang on the real
Windows box would return as a blind panic — the single failure mode these
--ignored lifecycle tests exist to diagnose.

Split the driver into run_watchdogged_raw returning
Result<Option<Output>, WatchdogTimeout> so each call site attaches its own
diagnostics; both Windows fixtures now fold dump_logs into their expiry panic.
A #[cfg(unix)] run_watchdogged wrapper keeps the Unix fixtures' ergonomics and
avoids a dead-code warning on Windows.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

A login-shell PATH probe drops the mutex before spawning and committed its
result unconditionally, so a slow pre-refresh probe could overwrite the fresh
PATH a post-refresh probe had already cached — recaching a false-negative and
reporting harnesses as not-installed until the next explicit refresh. Same-
generation cold callers could also let a timeout clobber a peer's success.

Add a monotonic generation to the cache: refresh_login_shell_path bumps it,
and a probe may only publish for the generation it started under. Within a
generation a failure/timeout never overwrites a committed success.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

The two race tests publish fixture PATH values into the process-global
login-shell cache. Without a trailing refresh the value survives the test and
refresh_login_shell_path_clears_cache reads it as its pre-refresh baseline,
failing when the fixture PATH differs from a real login-shell probe. Reset the
cache to Uninit on exit so sibling tests re-probe.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

The stale probe published None, which the same-generation success-retention
rule rejects independently of the generation comparison — so the test stayed
green even with the generation guard deleted (verified by mutation). Publish a
stale success (/stale/bin) instead: only the generation guard can reject it, so
deleting the guard now overwrites the fresh PATH and the test fails.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

login_shell_path() published its probe result but then returned its own
local value, so a caller whose probe timed out could return None while a
peer's success was already cached, and a generation-rejected probe could
return a stale value. Re-read the cache under the publish lock and return
the committed value; re-probe when a mid-probe refresh invalidated the
generation. Adds a cfg(test) probe seam and two return-value race tests.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

…tract

The BoundedChild header and the output_with_timeout bullet promised hard
whole-tree termination on every exit path unconditionally. On Unix a
descendant that setsid/setpgids out while holding a pipe can survive one
probe; it can never hang or unbound the helper (nonblocking drains + stop
flag) and the regression test asserts that survivor. Windows remains a
hard whole-tree guarantee (kill-on-close Job Object, no breakaway). State
the asymmetry as the adjudicated design. Comment/doc lines only.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>