[EmilienM]

Summary

Three silent-failure paths in the sandbox, all found by reading the code: a managed-children registration leaks after a poisoned registry lock, the orphan reaper goes inert on kernels without CONFIG_PROC_CHILDREN because every missing children file reads as a vanished task, and a panicking job kills the workload launcher thread while is_alive() keeps reporting healthy.

Related Issue

Closes #5186

Changes

• managed_children::unregister recovers from a poisoned registry lock like its sibling accessors, so a registration can no longer leak after a waiter panics while holding the lock
• direct_child_pids classifies a missing children file per task (vanished task vs missing support), only concludes missing support when no task in the scan listed one, and reports it once per process with a warning and an OCSF detection finding
• The workload launcher runs each job under catch_unwind, like the network broker's handler panics: the panic is logged, the thread leaves its job loop, and is_alive() turns false so later spawns fail fast

Release Notes

When no task under /proc/self/task exposes a children file (kernel built without CONFIG_PROC_CHILDREN, or restricted procfs), the sandbox now reports the inert orphan reaper once instead of failing silently. A panicking workload-launcher job now stops the launcher with a clear error instead of leaving it reporting healthy.

Testing

• Checks appropriate to the affected code and behavior pass

• Unit tests added/updated (if applicable)

• E2E tests added/updated (if applicable)

• cargo test -p openshell-sandbox --lib: 293 passed, including regression tests for each path (poisoned-lock unregister, children-file classification and reporting, panicking launcher job; the suite also passes with RUST_BACKTRACE=1)

• cargo clippy --workspace --all-targets -- -D warnings, the perf-harness variant, and cargo fmt --all -- --check pass

• No local e2e run: this host has no docker daemon and the k8s lane needs a full image build. The changed paths are failure paths not reachable on healthy kernels, and the launcher's normal spawn path is covered by tests that spawn real children through the filtered thread. CI lanes cover the rest.

• uv-based checks (python format, license headers) skipped locally due to a host uv config break (2026-11-03 RPM update); this diff touches no manifests or Python files

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.