fix(sandbox): bound web E2E evidence and service logs

CHANGELOG.md

@@ -47,10 +47,20 @@ Semantic Versioning where the repository publishes a release.
 
 ### Changed
 
+- Bound backend and frontend combined service logs plus E2E command output,
+  stop a service before running E2E when readiness evidence overflows, preserve
+  timeout and prior-failure precedence, and publish separate resource and
+  capture-finalization fields with bounded log tails.
+
 - Route sandboxed verification commands through the bounded subprocess layer,
   reject copied-tree symlinks that leave the sandbox, and publish distinct
   output-limit, unsupported-platform, missing/non-executable command, and
   path-boundary evidence without exposing host paths or uncaught tracebacks.
+- Classify missing or non-executable backend, frontend, and E2E commands with
+  stable exit codes and operator recovery actions while still cleaning up
+  services that started before the failure.
+- Reject non-HTTP readiness URLs during argument parsing with the exact option
+  to correct, instead of starting services and exposing a runtime traceback.
 
 - Emit completed repository pull-list requests as they finish in the five-minute
   agent-mention sweep, while retaining the four-worker ceiling, rotation, and

docs/doctoring/sandboxed-output-resource-bounds.md

@@ -54,14 +54,34 @@ POSIX file-size resource limits apply to every regular file written by the child
 
 A truncation marker is included inside, not in addition to, the declared retained byte budget. Reader errors and reader-join timeouts are explicit failures.
 
-## Deferred consumer integration
+## Long-running service boundary
 
 The second stack layer adopts the library in `sandboxed_verify.py` for
 short-lived verification commands. Long-running `sandboxed_web_e2e.py` service
 evidence remains a separate layer. Keeping those integrations separate prevents
 a shared process primitive, workspace symlink policy, and E2E result schema from
 becoming one monolithic review.
 
+The third stack layer adopts the same bounded drainer for each backend and
+frontend combined stdout/stderr pipe. A capture retains the final suffix in
+memory and writes only its bounded rendered form to the private sandbox log when
+the stream closes, so the evidence file cannot exceed its declared budget.
+
+Service overflow is checked during readiness, after E2E execution, and after
+service shutdown. It takes precedence over an otherwise successful command or
+readiness result, while a true E2E timeout remains `124`. A verbose but healthy
+service is intentionally stopped once it exceeds the default 4 MiB combined-log
+contract; projects that need more evidence must select an explicit supported
+budget. `tail_text()` reads no more than 65,536 bytes from the end of the already
+bounded file and keeps the truncation marker visible.
+
+The result separates `output_limited`, `output_limit_unsupported`, and
+`service_capture_failed`. A nonzero E2E or readiness code remains authoritative
+even when a late service overflow also sets `output_limited=true`; the Boolean
+retains the secondary resource evidence without erasing the original failure.
+If service finalization fails, the wrapper performs another best-effort group
+kill, bounded reap, and capture join before publishing failure evidence.
+
 The verification consumer maps an executable lookup failure to exit code `127`,
 publishes its normal machine-readable failed result, and tells the operator to
 install the executable or correct `PATH`. Provider and host path details do not
@@ -72,6 +92,15 @@ the consumer returns exit code `126` and tells the operator to select an
 executable file or correct its permissions. The stable failed result remains
 available without exposing the operating-system exception traceback.
 
+The web E2E consumer applies the same `126`/`127` machine-readable failure
+boundary to backend, frontend, and E2E command launch. Services that started
+before a later launch failure still pass through the ordinary bounded cleanup
+path.
+
+Backend and frontend readiness URLs are rejected during argument parsing unless
+they are empty or use `http://` or `https://`. The parser names the option the
+operator must correct before any workspace copy or service launch occurs.
+
 ## Security and availability properties
 
 - Parent retained memory is bounded independently for stdout and stderr.
@@ -103,13 +132,17 @@ Real subprocess tests exercise:
 - a real same-group descendant that inherits the pipes, outlives the direct
   child, and is prevented from writing a delayed sentinel;
 - final-suffix retention and one overflow callback;
+- bounded persisted service evidence;
+- service overflow before or during readiness/E2E, including a sentinel proof
+  that E2E never ran;
+- ordinary backend/frontend/E2E success and cleanup;
 - partial UTF-8 suffix decoding;
 - UTF-8 replacement expansion within the declared byte budget;
 - bounded file reads;
 - unsupported-platform failure;
 - invalid budgets;
 - reader exceptions, stuck-reader joins, a common finite join bound, and sibling finalization after the first failure;
-- deterministic return and timeout evidence.
+- deterministic result fields and exit-code precedence.
 
 The exact pull-request head must additionally pass the complete central test suite, 100% production statement and branch coverage for the changed surface, production docstrings, Secret Scan, CodeQL, Semgrep, Python Security, dependency and supply-chain checks, OpenCode, Noema, CodeRabbit, independent current-head approval, and branch protection.