fix #406: launcher session exit observation carries the real code + captures client stderr

GameWindow.Dispose() (via Program.cs's `using var window = ...`) runs
unconditionally even when invoked mid-unwind of an exception that escaped
Run()'s Silk.NET frame loop. Resource teardown itself can converge
cleanly regardless, so CompleteShutdown had no way to tell "normal Run()
return" from "a crash is propagating through me right now" and always
wrote the hardcoded exited{code:0,reason:"graceful"} — exactly the
symptom #406 observed against a real 0xE0434352 crash. Fixed by latching
_runFailure in Run()'s existing catch block (before the pre-existing
throw) and consulting it from a new ReportExited method, the one call
site for the terminal status write: crashed(1)/graceful(0)/
shutdown-incomplete(1) as appropriate. No wire-contract amendment needed
— §LA1 pins the exited event NAME, and reason is already free text that
StatusEventParser round-trips unchanged.

Sibling gap fixed in the same commit: the launcher discarded the child's
stdout/stderr entirely, which is why diagnosing this exact crash required
a manual console re-run. Added BoundedProcessOutputCapture, a 2 MiB-capped
sink mirroring SessionStatusWriter's open-append-flush-close-per-write
posture (a long-lived write handle is not actually concurrently readable
on Windows even with FileShare.Read — confirmed by isolated repro), wired
into both SystemChildProcess (ProcessStartInfo.RedirectStandardError;
Linux + Windows graphical children, i.e. this bug's own scenario) and
WindowsSystemChildProcess (a real native pipe via CreateChildOutputPipe,
mirroring the existing stdin pipe; Windows console-capable/Headless
children). Opt-in via LauncherProcessSpec.StderrLogPath (null = unchanged
behavior), threaded through SessionConfigComposer -> client.err.log
beside status.jsonl -> LauncherExecutableSet -> LauncherOrchestrator.

Tests: GameWindowCrashStatusTests (source-shape, matching the existing
GameWindow test pattern — the class cannot be constructed without a live
GPU/window), BoundedProcessOutputCaptureTests (10 unit tests), and three
new LauncherProcessSupervisorTests spawning real child processes through
both capture code paths.

Launcher.Core.Tests: 337/0 (was 324/0). Launcher.Tests: 67/0 (unchanged).
Full solution build green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/AcDream.Launcher.Core.Tests/Launching/BoundedProcessOutputCaptureTests.cs

@@ -0,0 +1,240 @@
+using System.Text;
+using AcDream.Launcher.Core.Launching;
+
+namespace AcDream.Launcher.Core.Tests.Launching;
+
+/// <summary>Fix #406 sibling gap: the launcher previously discarded a
+/// supervised child's stderr entirely, so diagnosing a crash (including
+/// exactly the #406 crash) required re-running the identical binary by
+/// hand. These tests cover <see cref="BoundedProcessOutputCapture"/> in
+/// isolation — the real-child-process end-to-end capture tests live in
+/// <c>LauncherProcessSupervisorTests</c> alongside the existing real-process
+/// coverage.</summary>
+public sealed class BoundedProcessOutputCaptureTests
+{
+    [Fact]
+    public void AppendLineWritesEachLineWithATrailingNewline()
+    {
+        string path = TempPath();
+        try
+        {
+            using var capture = new BoundedProcessOutputCapture(path);
+
+            capture.AppendLine("first");
+            capture.AppendLine("second");
+            capture.Dispose();
+
+            Assert.Equal("first\nsecond\n", File.ReadAllText(path));
+        }
+        finally
+        {
+            TryDelete(path);
+        }
+    }
+
+    [Fact]
+    public void ANullLineFromTheEndOfStreamSentinelIsANoOp()
+    {
+        string path = TempPath();
+        try
+        {
+            using var capture = new BoundedProcessOutputCapture(path);
+
+            capture.AppendLine("kept");
+            capture.AppendLine(null);
+            capture.Dispose();
+
+            Assert.Equal("kept\n", File.ReadAllText(path));
+        }
+        finally
+        {
+            TryDelete(path);
+        }
+    }
+
+    [Fact]
+    public void WritesBeyondTheCapAreDroppedAndAOneTimeTruncationMarkerIsAppended()
+    {
+        string path = TempPath();
+        try
+        {
+            using var capture = new BoundedProcessOutputCapture(path, maxBytes: 16);
+
+            capture.AppendLine("0123456789"); // 11 bytes incl. newline
+            capture.AppendLine("this line is dropped entirely");
+            capture.AppendLine("so is this one");
+
+            Assert.True(capture.IsDone);
+            string written = File.ReadAllText(path);
+            Assert.StartsWith("0123456789\n", written, StringComparison.Ordinal);
+            Assert.Contains("truncated at 16 bytes", written, StringComparison.Ordinal);
+            // The cap is a hard ceiling: nothing past it EVER lands on disk,
+            // even the marker's own text does not push the file arbitrarily
+            // far past the configured bound.
+            Assert.True(
+                written.Length < 200,
+                $"expected a small bounded file, got {written.Length} bytes");
+        }
+        finally
+        {
+            TryDelete(path);
+        }
+    }
+
+    [Fact]
+    public void ALogSpammingChildCannotGrowTheFileUnboundedly()
+    {
+        string path = TempPath();
+        try
+        {
+            using var capture = new BoundedProcessOutputCapture(
+                path,
+                maxBytes: BoundedProcessOutputCapture.DefaultMaxBytes);
+
+            // Far more than the 2 MiB default cap.
+            string spamLine = new('x', 4096);
+            for (int i = 0; i < 4096; i++)
+            {
+                capture.AppendLine(spamLine);
+                if (capture.IsDone)
+                {
+                    break;
+                }
+            }
+
+            Assert.True(capture.IsDone);
+            long fileLength = new FileInfo(path).Length;
+            Assert.True(
+                fileLength < BoundedProcessOutputCapture.DefaultMaxBytes + 256,
+                $"expected the file to stay near the {BoundedProcessOutputCapture.DefaultMaxBytes}-byte "
+                    + $"cap, got {fileLength} bytes");
+        }
+        finally
+        {
+            TryDelete(path);
+        }
+    }
+
+    [Fact]
+    public void AppendCreatesTheSessionDirectoryOnFirstWrite()
+    {
+        string directory = Path.Combine(
+            Path.GetTempPath(),
+            "acdream-406-capture-" + Guid.NewGuid().ToString("N"));
+        string path = Path.Combine(directory, "client.err.log");
+        Assert.False(Directory.Exists(directory));
+
+        try
+        {
+            using var capture = new BoundedProcessOutputCapture(path);
+            capture.AppendLine("hello");
+            capture.Dispose();
+
+            Assert.True(File.Exists(path));
+        }
+        finally
+        {
+            try
+            {
+                Directory.Delete(directory, recursive: true);
+            }
+            catch (IOException)
+            {
+            }
+        }
+    }
+
+    [Fact]
+    public void RawByteAppendsAreConcatenatedWithoutAnImpliedLineBoundary()
+    {
+        string path = TempPath();
+        try
+        {
+            using var capture = new BoundedProcessOutputCapture(path);
+
+            capture.Append(Encoding.UTF8.GetBytes("abc"));
+            capture.Append(Encoding.UTF8.GetBytes("def"));
+            capture.Dispose();
+
+            Assert.Equal("abcdef", File.ReadAllText(path));
+        }
+        finally
+        {
+            TryDelete(path);
+        }
+    }
+
+    [Fact]
+    public void EmptyAppendsAreNoOps()
+    {
+        string path = TempPath();
+        try
+        {
+            using var capture = new BoundedProcessOutputCapture(path);
+
+            capture.Append(ReadOnlySpan<byte>.Empty);
+            capture.AppendLine(string.Empty);
+            capture.Dispose();
+
+            // An empty string line still gets its trailing newline —
+            // only a genuinely zero-length byte span (or a null line) is
+            // a true no-op.
+            Assert.Equal("\n", File.ReadAllText(path));
+        }
+        finally
+        {
+            TryDelete(path);
+        }
+    }
+
+    [Fact]
+    public void AppendAfterDisposeIsASilentNoOp()
+    {
+        string path = TempPath();
+        try
+        {
+            var capture = new BoundedProcessOutputCapture(path);
+            capture.AppendLine("before");
+            capture.Dispose();
+
+            capture.AppendLine("after — must not throw or reopen the file");
+
+            Assert.Equal("before\n", File.ReadAllText(path));
+        }
+        finally
+        {
+            TryDelete(path);
+        }
+    }
+
+    [Fact]
+    public void ConstructorRejectsANonPositiveMaxBytes()
+    {
+        Assert.Throws<ArgumentOutOfRangeException>(
+            () => new BoundedProcessOutputCapture(TempPath(), maxBytes: 0));
+        Assert.Throws<ArgumentOutOfRangeException>(
+            () => new BoundedProcessOutputCapture(TempPath(), maxBytes: -1));
+    }
+
+    [Fact]
+    public void ConstructorRejectsANullOrBlankPath()
+    {
+        Assert.Throws<ArgumentException>(() => new BoundedProcessOutputCapture(""));
+        Assert.Throws<ArgumentException>(() => new BoundedProcessOutputCapture("   "));
+    }
+
+    private static string TempPath() => Path.Combine(
+        Path.GetTempPath(),
+        "acdream-406-capture-" + Guid.NewGuid().ToString("N") + ".log");
+
+    private static void TryDelete(string path)
+    {
+        try
+        {
+            File.Delete(path);
+        }
+        catch (IOException)
+        {
+        }
+    }
+}

tests/AcDream.Launcher.Core.Tests/Launching/LauncherProcessSupervisorTests.cs

@@ -543,6 +543,182 @@ public sealed class LauncherProcessSupervisorTests
         Assert.Equal(0, supervisor.ExitCode);
     }
 
+    [Fact]
+    public async Task RealChildStderrIsCapturedForTheProcessStartInfoPath()
+    {
+        // Fix #406 sibling gap: SystemChildProcess is used on Linux for
+        // EVERY child, and on Windows for graphical/non-console children —
+        // exactly #406's own App/GUI crash scenario
+        // (SupportsConsoleGracefulStop: false is the graphical shape;
+        // see LauncherExecutableSet.CreatePlaySpec). This proves the real
+        // child's stderr actually lands in the configured bounded file
+        // instead of being discarded, and that the real nonzero exit code
+        // is still observed independently of the capture.
+        string root = Path.Combine(
+            Path.GetTempPath(),
+            "acdream-406-stderr-psi",
+            Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(root);
+        string stderrPath = Path.Combine(root, "client.err.log");
+
+        try
+        {
+            using var supervisor = new LauncherProcessSupervisor();
+            var exited = new ManualResetEventSlim(false);
+            supervisor.StateChanged += (_, s) =>
+            {
+                if (s == LauncherSessionState.Exited)
+                    exited.Set();
+            };
+
+            supervisor.Start(
+                new LauncherProcessSpec(
+                    FindDotnetExecutable(),
+                    [GetConsoleFixturePath(), "write-stderr", "7", "3", "line-"],
+                    SupportsConsoleGracefulStop: false,
+                    StderrLogPath: stderrPath),
+                password: null);
+
+            Assert.True(
+                exited.Wait(TimeSpan.FromSeconds(30)),
+                "the write-stderr fixture did not exit within 30s");
+            Assert.Equal(7, supervisor.ExitCode);
+
+            string captured = await ReadFileEventuallyContainingAsync(
+                stderrPath, "line-2", TimeSpan.FromSeconds(5));
+            Assert.Contains("line-0", captured, StringComparison.Ordinal);
+            Assert.Contains("line-1", captured, StringComparison.Ordinal);
+            Assert.Contains("line-2", captured, StringComparison.Ordinal);
+        }
+        finally
+        {
+            try
+            {
+                Directory.Delete(root, recursive: true);
+            }
+            catch (IOException)
+            {
+            }
+        }
+    }
+
+    [Fact]
+    public async Task RealChildStderrIsCapturedForTheWindowsNativeConsolePath()
+    {
+        // Fix #406 sibling gap: on Windows, console-capable children
+        // (Headless) spawn through WindowsSystemChildProcess's native
+        // CreateProcessW path, a completely separate code path from
+        // SystemChildProcess above — WindowsProcessNative.StartCore
+        // creates a real pipe for stderr instead of the usual
+        // duplicate-or-NUL handle, and WindowsSystemChildProcess pumps it
+        // on a background thread. This proves that path end to end too.
+        if (!OperatingSystem.IsWindows())
+        {
+            return;
+        }
+
+        string root = Path.Combine(
+            Path.GetTempPath(),
+            "acdream-406-stderr-native",
+            Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(root);
+        string stderrPath = Path.Combine(root, "client.err.log");
+
+        try
+        {
+            using var supervisor = new LauncherProcessSupervisor();
+            var exited = new ManualResetEventSlim(false);
+            supervisor.StateChanged += (_, s) =>
+            {
+                if (s == LauncherSessionState.Exited)
+                    exited.Set();
+            };
+
+            supervisor.Start(
+                new LauncherProcessSpec(
+                    FindDotnetExecutable(),
+                    [GetConsoleFixturePath(), "write-stderr", "9", "3", "native-line-"],
+                    StderrLogPath: stderrPath),
+                password: null);
+
+            Assert.True(
+                exited.Wait(TimeSpan.FromSeconds(30)),
+                "the write-stderr fixture did not exit within 30s");
+            Assert.Equal(9, supervisor.ExitCode);
+
+            string captured = await ReadFileEventuallyContainingAsync(
+                stderrPath, "native-line-2", TimeSpan.FromSeconds(5));
+            Assert.Contains("native-line-0", captured, StringComparison.Ordinal);
+            Assert.Contains("native-line-1", captured, StringComparison.Ordinal);
+            Assert.Contains("native-line-2", captured, StringComparison.Ordinal);
+        }
+        finally
+        {
+            try
+            {
+                Directory.Delete(root, recursive: true);
+            }
+            catch (IOException)
+            {
+            }
+        }
+    }
+
+    [Fact]
+    public void ANullStderrLogPathBehavesExactlyAsBeforeForBothChildProcessKinds()
+    {
+        // The additive-diagnostics contract: a spec with no StderrLogPath
+        // must not change behavior at all (fix #406 sibling gap review
+        // guard against a regression that always redirects stderr).
+        string dotnet = FindDotnetExecutable();
+        using var supervisor = new LauncherProcessSupervisor();
+        var exited = new ManualResetEventSlim(false);
+        supervisor.StateChanged += (_, s) =>
+        {
+            if (s == LauncherSessionState.Exited)
+                exited.Set();
+        };
+
+        supervisor.Start(new LauncherProcessSpec(dotnet, ["--version"]), null);
+
+        Assert.True(exited.Wait(TimeSpan.FromSeconds(30)));
+        Assert.Equal(0, supervisor.ExitCode);
+    }
+
+    private static async Task<string> ReadFileEventuallyContainingAsync(
+        string path,
+        string expectedFragment,
+        TimeSpan timeout)
+    {
+        DateTime deadline = DateTime.UtcNow + timeout;
+        string last = string.Empty;
+        while (DateTime.UtcNow < deadline)
+        {
+            if (File.Exists(path))
+            {
+                try
+                {
+                    last = await File.ReadAllTextAsync(path);
+                    if (last.Contains(expectedFragment, StringComparison.Ordinal))
+                    {
+                        return last;
+                    }
+                }
+                catch (IOException)
+                {
+                    // The pump/writer may hold the file open for a
+                    // moment — retry within the deadline.
+                }
+            }
+
+            await Task.Delay(20);
+        }
+
+        throw new TimeoutException(
+            $"'{path}' never contained '{expectedFragment}' within {timeout}. "
+                + $"Last observed content: {last}");
+    }
+
     private static LauncherProcessSpec Spec() =>
         new("fake-host", ["--session-config", "session.json"]);