fix(mcp): bound cleanup of CLI descendants on cancellation and timeout #206

What happened

Stability audit finding F07 / P2 (2026-09-27). Priority is an audit recommendation, not a claim of a production incident.

Adapter.invoke starts the CLI without a separately owned process group and terminates/kills only the immediate parent on cancellation or timeout.

A synthetic CLI forked a sleeping descendant with isolated stdio. Cancelling the MCP invocation returned while that descendant remained alive. Two independent runs reproduced the result; no real session message was sent.

What you expected

Use platform-appropriate owned process-tree tracking and bounded cleanup without terminating unrelated processes. Preserve cancellation propagation and the existing outcome_unknown / no-automatic-retry contract.

Environment

• Baseline: published session-peer v1.0.1, commit 55168c3bea5a49e81916fdead57d3634def6b1d6.
• Reproduction: isolated source/tag fixtures; no live message/ACK tests or production mutation.
• Audit environments: macOS arm64, Python 3.14.7; Control tests use Node 22.14.0. Linux evidence is explicitly identified above where applicable.
• Discovery output: not applicable to this fixture; no real session identifiers or credentials are included.

Source evidence

• session_peer_mcp.py#L70

Acceptance criteria

• Add cancellation and timeout fixtures with a descendant that outlives its parent.
• Require bounded return and zero remaining owned processes, including forced termination paths.
• Verify normal completion and error handling; document supported-platform cleanup behavior.
• Do not claim remote submission is undone by local process termination.

Scope and limitations

Separate failure mechanism from wake's incomplete process-group escalation.

Target: v1.0.2 stability work. This issue does not authorize a release or operating-service changes. Offline reproduction establishes the failure mechanism, not attribution of historical #161 incidents.

Checked

• Searched existing issues for duplicates.
• Removed credentials, conversation contents, private paths and real device/session identifiers.
• Used isolated fixtures without weakening inbound permissions.