fix(subprocess_adapter): set the stderr-truncation flag on the crossing chunk (#955)

The GLM precision review caught a boundary hole in 86d059f, the commit that
added the marker. Reproduced before fixing.

`retained` counts the whole chunk while only `chunk[:room]` is appended, so the
chunk that crosses the cap takes the retaining branch and leaves the flag alone
-- it was only ever set by a *later* read. When the crossing chunk is the last
one before EOF (total stderr between the cap and one 64 KiB read above it), the
loop exits with the flag still false and the dropped tail reads as a complete
error message. That is precisely the case the marker was added for, so the fix
was defeated in exactly its own boundary window.

The existing test writes 200 KB against a 1000-char cap, so several non-empty
chunks always followed the crossing one and the path never ran. The new test
writes 1500 chars, which arrive in a single read.

Refs #955

Author: frankbria

codeframe/core/adapters/subprocess_adapter.py

@@ -222,13 +222,19 @@ def _drain_stderr() -> None:
                     chunk = process.stderr.read(65536)
                     if not chunk:
                         break
+                    # Say so, like stdout does. Silently capped stderr reads as a
+                    # complete error message, so whoever is debugging a failed
+                    # run trusts a truncated one. The flag has to be set by the
+                    # chunk that *crosses* the cap, not only by a later one:
+                    # when the crossing chunk is the last before EOF the loop
+                    # ends and there is no later one. (#955 review)
                     if retained < MAX_RETAINED_STDERR_CHARS:
-                        stderr_chunks.append(chunk[: MAX_RETAINED_STDERR_CHARS - retained])
+                        room = MAX_RETAINED_STDERR_CHARS - retained
+                        stderr_chunks.append(chunk[:room])
                         retained += len(chunk)
+                        if len(chunk) > room:
+                            stderr_truncated = True
                     else:
-                        # Say so, like stdout does. Silently capped stderr reads
-                        # as a complete error message, so whoever is debugging a
-                        # failed run trusts a truncated one. (#955 review)
                         stderr_truncated = True
 
             stderr_thread = threading.Thread(target=_drain_stderr, daemon=True)

tests/core/adapters/test_subprocess_bounds_955.py

@@ -173,3 +173,28 @@ def test_uncapped_stderr_carries_no_marker(self, tmp_path, monkeypatch):
 
         assert "truncated" not in (result.error or "")
         assert "short failure" in (result.error or "")
+
+    def test_the_marker_survives_a_cap_crossed_on_the_final_chunk(
+        self, tmp_path, monkeypatch
+    ):
+        """The disclosure must not depend on more output arriving after the cap.
+
+        `retained` counts the *whole* chunk while only the part that fits is
+        appended, so the chunk that crosses the cap takes the retaining branch
+        and never sets the flag — only a *later* read does. When the crossing
+        chunk is the last one (total stderr between the cap and one 64 KiB read
+        above it), the loop exits with the flag still false and the dropped tail
+        reads as a complete error. Exactly the case the marker exists for.
+        (#955 review)
+        """
+        monkeypatch.setattr(sa, "MAX_RETAINED_STDERR_CHARS", 1000)
+        # 1500 chars arrive in a single read, so nothing follows the crossing.
+        script = (
+            "import sys\n"
+            "sys.stderr.write('E' * 1500); sys.stderr.flush()\n"
+            "sys.exit(1)\n"
+        )
+
+        result = _py_adapter(script, timeout_s=30).run("t", "go", tmp_path)
+
+        assert "[stderr truncated]" in (result.error or "")