SW-206 — Finalize child output only after stdout and stderr streams close #388

Summary

The supervisor flushes pending line buffers on the child's exit event. Node can emit exit before stdio has delivered all buffered data. A final flush at exit can split a sensitive assignment across the flush boundary and defeat line-based redaction. Finalize each stream only after its end/close lifecycle is complete.

Workstream

• Workstream: WS-SECURITY
• Primary scope: src/dev/orchestrator.ts; tests/dev-orchestrator-startup-and-buffering.test.ts
• Protected surface: Yes — maintainer review required
• Priority: P0
• Difficulty: high
• Proposed points: 200

Acceptance Criteria

• Model process exit and stdio completion as separate events.
• Do not flush while a stream can still deliver data.
• A sensitive assignment split across chunks before and after exit is fully redacted.
• Final partial lines are emitted exactly once.
• Failure/shutdown paths cannot leave buffers pending indefinitely.

Dependencies

None unless noted above.

Out of Scope

• Unrelated architecture or public command-contract changes.
• New runtime dependencies without maintainer approval.
• Mainnet deployment or remote template execution.

Definition of Done

• Acceptance criteria have deterministic regression coverage.
• Security and compatibility boundaries remain intact.
• Supported-platform CI passes.

Labels

• Stellar Wave (do not apply until activation is explicitly authorized)
• type: security
• area: security
• priority: P0
• difficulty: high
• points: 200
• workstream: security

Sequencing and scope note

Sequencing: implement after SW-205 (#387) so stream decoding and buffer finalization share one tested lifecycle.