[roodboi]

Root cause

invokeNativeRuntime (src/backends/native-runtime-client.ts) stopped reading a bounded request's stdout and stderr 250 ms after the child's observed exit (drainTimer = setTimeout(() => drain.abort(), 250)). The native runtime writes its closed error code before it exits, so the bytes are already in the pipe, but on a heavily oversubscribed host the stderr reader can be scheduled after that window. The reader was cancelled with a partial or empty buffer, the structured code was lost, and the caller saw the generic Native runtime request failed; inspect owned state before retrying. instead of (code). This affects every bound drain: status, logs, exec, one-off, read (plan/inspect) and recovery. #396 fixed the sibling in the foreground graph owner (src/backends/native-project-process.ts, HACK-1350).

Fix

• NATIVE_EXIT_DRAIN_BOUND_MS (5 s, measured from the observed exit, never from spawn) now lives in native-runtime-client.ts and is shared with the graph owner, which imports it instead of defining its own copy. The doc comment covers both call sites and both tickets.
• The runtime client drains to EOF: a child with no other writer closes its pipes at exit, so EOF ends the drain at once. The bound only ends a drain that EOF cannot end, i.e. a descendant that inherited a pipe and keeps it open. Abort and request timeout still end the drain immediately, as before.
• Both boundaries take an optional exitDrainBoundMs test seam (validated as a positive safe integer) that defaults to the constant. Production callers do not pass it.

Tests

tests/native-runtime-client.test.ts

• New authored %s keeps a closed code written after the reported exit for status, read, logs and exec: the stand-in spawns a detached writer that inherits only stderr, exits, and the writer emits the closed code 1 s after the test has seen the stand-in reaped. The code is kept and the message stays closed. The case injects a wide named bound (LATE_WRITER_DRAIN_BOUND_MS, 25 s) so host load cannot push the delayed write past it; it proves EOF, not a fixed window, ends the drain.
• The existing held-descendant cases (read/selection/cleanup, exit and abort) now assert settlement within NATIVE_EXIT_DRAIN_BOUND_MS + DRAIN_SETTLE_MARGIN_MS with the production bound; they prove the bound still ends a drain a descendant holds open.

tests/native-project-process.test.ts (hardening #396's late-reader case, which failed once in ~80 iterations under load)

• closed code written after the reported exit is kept regardless of a late reader injects LATE_WRITER_DRAIN_BOUND_MS instead of relying on the 1 s delay landing inside the 5 s production bound on a loaded host.
  tests/native-authored-project-logs.test.ts, tests/native-authored-project-exec.test.ts (second commit)

• The two "inherited pipe refuses output" cases spawned a keeper that slept 800 ms: longer than the old 250 ms window but inside the shared 5 s bound, so after the fix its EOF settled the output and the requests resolved instead of refusing (did not settle). The first full-suite run caught this (1 real failure in each file; the other 17 + 7 failures in those files were the suites' "prior lifetime unconfirmed" cascade). The keeper now holds the inherited streams until the test releases it after the refusal (self-capped at 60 s), so only the bound can end the drain, and the case budgets derive from NATIVE_EXIT_DRAIN_BOUND_MS.

• Named budgets replace the literal 10 s / 20 s / 30 s / 60 s windows: HANDSHAKE_BUDGET_MS (20 s, pid handshakes), STARTUP_TIMEOUT_MS (60 s), DESCENDANT_CAP_MS (60 s), CASE_TIMEOUT_MS. The held-descendant cases keep the production bound.

Mutation proofs

Mutation	Result
runtime client: fixed 250 window instead of the bound	only the 4 late-writer cases fail (26 pass)
runtime client: no drain timer (unbounded)	only the 3 held-descendant exit cases (read/selection/cleanup) fail at the 30 s request timeout (27 pass); the abort cases still settle through cancellation
graph owner: fixed 250 window	only the late-reader case fails: the code is dropped and the refusal has no (graph_budget) (10 pass)
graph owner: no drain timer (unbounded)	only the 2 held-descendant cases (ready / early failure) fail their settlement bound (9 pass)

Load run

20/20 consecutive passes of tests/native-runtime-client.test.ts + tests/native-project-process.test.ts (41 tests each run, 44–46 s per run) on this 18-core Mac with 12 extra yes loops on top of the existing load; load average 17–35 during the run. The loops are owned by the runner script and stopped by its EXIT/INT/TERM/HUP trap (0 yes processes afterwards). Logs: scratchpad G65/load-run-*.log.

Evidence

• Bun 1.4.2 via mise x bun@1.4.2; bun install --frozen-lockfile; no bun.lock change.
• bun run --cwd packages/cli typecheck: 0 errors. Root bun run check (includes privacy:check): 0 errors; the 35 warnings are pre-existing and none is in this unit's files (the new ?? default was moved into a helper so invokeNativeRuntime stays at complexity 20).
• gitleaks 8.30.1 over origin/next..HEAD: no leaks.
• Focused: bun test tests/native-runtime-client.test.ts tests/native-project-process.test.ts --timeout 150000 with private HOME/HACK_HOME/DOCKER_CONFIG and HACK_SECRETS_DISABLE_KEYCHAIN_FALLBACK=1: 41 pass, 0 fail.
• Full suite (local, this loaded Mac, private HOME): at 8dca82e: Ran 8188 tests across 569 files in 53 min, 8029 pass / 126 skip / 33 fail. 26 of the failures were this unit's own regression in the logs/exec keeper fixtures, fixed in e4be689 (see Tests). The other 7 (tests/bun-crash-loop.test.ts, tests/mcp-publication-readiness.test.ts, tests/test-config-compiler.test.ts, tests/e2e/run-dependency-cache.test.ts) were an artifact of my runner's PATH: their bun subprocesses resolved to the system Bun 1.3.14 and refused the 1.4.2 pin. All four files pass on a serial rerun with --timeout 60000 and the mise bun on PATH (25/6/39/5 pass, 0 fail).
• Full suite at e4be689: running (this body is updated when it finishes).
• No CLI surface, consumer guidance, package.json scripts or pinned toolchain files changed, so no reference, plugin or catalog regeneration applies.

Gaps

• Stacked on fix(native): keep the closed exit code when the graph owner's pipes drain late #396 (HACK-1350): that PR is still open, so this branch carries its commit (cherry-picked with -x) as the parent of the fix commit, and the diff against next currently includes it. Once fix(native): keep the closed exit code when the graph owner's pipes drain late #396 merges, this branch rebases onto next and keeps fix(native): keep the closed exit code when the graph owner's pipes drain late #396's behaviour; the shared constant then moves from native-project-process.ts to native-runtime-client.ts in this PR only.
• The M3 runner was not used: it has 55.1 GiB free, already below the 58 GiB floor the unit must keep, and a worktree plus dependency install would push it lower. The full suite ran on this (loaded) Mac instead.
• Stub engines only. The drop was reproduced with a stand-in runtime that writes the code late, not with a real native runtime under oversubscription.
• exitDrainBoundMs is a test seam on two internal boundaries; no production caller sets it. The Bun.spawn child's exit observation is still the bound's origin, so a child that never exits stays governed by the request timeout, unchanged.

Refs HACK-1387

🤖 Generated with Claude Code

[linear-code]

HACK-1387