test(native): isolate fallback descriptor scan after fork

[FeathBow]

Summary

This fixes an existing native-runner test race that can fail the parallel workspace suite with EBADF.

• Run the fallback descriptor scan from Command::pre_exec, matching its production post-fork execution context instead of mutating the shared parent test process.
• Keep deterministic fallback coverage rather than allowing Linux's close_range fast path to bypass it.
• Reuse the existing controlled helper to prove the high non-CLOEXEC descriptor is closed after exec.
• Verify the parent's descriptor remains live with its original flags, so the test cannot alter descriptors owned by sibling tests.

No production function, error policy, public API, or runtime behavior changes.

Validation

cargo fmt --all -- --check
umask 002 && cargo test --workspace --all-features --locked --quiet
cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
cargo check --workspace --all-targets --all-features --locked --target x86_64-unknown-linux-musl
git diff --check origin/main...HEAD

Safety

• Test-only change; production descriptor handling is unchanged.
• No impact on discovery, safety classification, path or symlink validation, staging, purge, undo, filesystem boundaries, quota, or reclaimability claims.
• The fallback still runs and fails closed in the forked child; the test does not add retries, sleeps, or global serialization.
• The parent descriptor assertion proves the regression test no longer mutates the shared test-harness descriptor table.

Summary by CodeRabbit

• Tests
  • Improved coverage for descriptor-policy fallback behavior.
  • Added verification that child-process execution succeeds while the parent descriptor state remains unchanged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a3582764-7b58-48de-a512-000922eae7e7

📥 Commits

Reviewing files that changed from the base of the PR and between a4b7675 and 50db0af.

📒 Files selected for processing (1)

• crates/degu/src/native/runner.rs

Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The descriptor-policy fallback test now runs mark_nonstdio_cloexec_fallback in the forked child through pre_exec. It checks child execution success and confirms that the parent descriptor remains open without FD_CLOEXEC.

Changes

Descriptor policy fallback test

Layer / File(s)	Summary
Child fallback validation crates/degu/src/native/runner.rs	The test moves fallback execution into the child’s pre_exec context, validates successful child execution, and verifies the parent descriptor remains non-CLOEXEC.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 50db0

This test-only change isolates fallback descriptor scanning without changing production behavior, so no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main test change: isolating the fallback descriptor scan after fork.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/native-fallback-test-isolation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}