fix(shell_exec): stream rather than fail when delayed_stream's timed wait fails

[max-sixty]

Problem

Cmd::delayed_stream waits out a delay threshold before it starts streaming a child's output. When that timed wait returned an error rather than a status, the function returned the error to the caller — but only after joining the two reader threads, and those sit in read_to_end until the child closes its pipes. So the caller waited out the child's full runtime and then got Failed to wait for command for a command that had already finished.

That arm became reachable in #3857. shared_child allocates a pipe and registers a SIGCHLD handler on every timed wait, where wait-timeout set its self-pipe up once per process. A sandbox or an fd limit that used to abort the process (#3856) now surfaces as an Err.

Change

Phase 1's Err falls through to streaming, which is what an exceeded threshold already does. Phase 2's blocking wait() is a bare waitid(WNOWAIT) loop with neither a pipe nor a signal registration, so whatever broke the timed wait cannot reach it and the real exit status still comes back. A command whose deadline machinery fails now streams its output instead of failing.

The two sites where the deadline bounds wall-clock, run_with_timeout_impl and the pager, fold Err into their teardown arm instead, because a wait they cannot observe bounds nothing. The threshold here only decides when output starts streaming, so it streams. The module docstring records that split.

Testing

test_cmd_delayed_stream_crosses_the_threshold is new, and it covers an arm nothing reached before. Of the thresholds the suite used, 0 streams without ever calling wait_timeout, -1 disables phase 1, and 5_000 against a fast child returns Ok(Some) — so Ok(None) never happened.

The child writes a line 450 ms after the threshold passes. That line is the discriminator: streaming sends it to stderr, so the error's buffer comes back empty, where a phase 1 that had returned a status would still have it buffered. Checked by raising the threshold above the child's runtime, which fails the assertion with left: "late". Elapsed time would not have distinguished the two, since the child runs the same wall-clock either way.

The Err arm itself stays untested: reaching it needs pipe or sigaction to fail inside the wait, and it shares every line with the fall-through the new test covers.

Also run: cargo run -- hook pre-merge --yes (4677 tests, lints, doctests) and both rustdoc variants with -D warnings.

This was written by Claude Code on behalf of max-sixty

[worktrunk-bot]

Two non-blocking notes; the change itself reads right, and the rewritten test that pins the switch by where the late output lands is a much stronger assertion than the elapsed-time one.

Cmd::delayed_stream's own docstring still glosses the progress message as printing "at the moment streaming starts (the delay threshold is crossed)". After this change a failed timed wait starts streaming too, so the parenthetical names one of two triggers — the module docstring above records the split, but the item docstring is what a caller reads. It's outside the diff, so no inline suggestion; happy to push the one-liner if you want it.