[morluto]

Summary

A caller abort arriving after an owned provider output-collection failure could relabel the physical failure as cancellation. Reverse-command observation now uses the owned command's recorded failure reason and retains the later caller cancellation separately.

Problem and expected behavior

An OwnedCommandFailure with reason process, a captured output prefix, and an EIO collection cause became an AnalysisCancelledError when the caller signal was aborted at delivery. The physical collection error should remain primary, with its exact cause chain and captured bytes available to the caller.

Change and scope

The cancellation classifier uses OwnedCommandFailure.reason when that producer owns the outcome. The application completion boundary attaches later caller cancellation through the shared error owner. Recorded producer cancellation continues to produce a cancellation error. This repair fits the existing standalone command observation contract and was found during the repository audit.

Contract and boundary impact

The owned process producer supplies the authoritative failure reason. The reverse application service preserves its classification through final delivery. Existing clients receive physical output errors plus the established secondary cancellation field. The captured snapshot, byte counts, and cause chain remain available.

• Read existing files or captured data.
• Launch or attach to a process.
• Inject instrumentation or run scripts/code.
• Change process memory, registers, files, or configuration.
• Contact network services.
• Recover protected code or work around protections.
• Documentation or usability only; no target interaction.
• Not sure yet; investigation or maintainer guidance needed.

The process-launch effect belongs to the existing objdump/rizin workflow. Validation injected outcomes at the owned runner boundary.

Evidence and regression coverage

The collection-failure test fails on base a6e02657 under late cancellation. The noncancelled physical-error control and producer-cancelled control pass before and after the repair. Final tests assert the physical error class, captured bytes, exact underlying failure objects, and exact caller cancellation reason.

Validation performed

All commands used Node.js 24.22.1 in the isolated branch worktree.

• npm run typecheck -- --incremental false passed.
• Direct source Vitest for the unknown-failure, admission, and command-port suites passed 25 tests.
• Scoped oxfmt --check, oxlint, and git diff --check passed. Lint retained existing size, complexity, and parameter-count warnings.

Compatibility, safety, and release

The repair uses existing output and secondary-error contracts. Tests use authored snapshots, controlled abort signals, and mocked runners. Real external commands, process termination, and native ownership controls were outside this verification.

Author readiness

Human owner:

• I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
• I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
• I declare this PR ready for initial maintainer review.

Before merge

• This PR addresses a concrete problem or an agreed enhancement.
• Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
• The PR has one focused outcome and the title follows type(scope): outcome.
• Related issue is linked, or the reason for not linking one is stated above.
• Tests cover changed observable behavior and meaningful failure paths.
• Owning docs, contracts, and generated metadata are updated where needed.
• User-visible CLI/MCP changes include representative output.
• I checked the final diff for secrets, unrelated cleanup, and unsupported claims.