The execve waiter lets go of every stream it holds

⚠️⚠️ A replacement leaves ONE image; this composition leaves two, and the one
that remains still held every file description the caller had --- including the
write end of a pipe it had just placed at the started program's standard output.
A pipe reports the end of input when the LAST writer lets go, so the reader on
the other side saw a stream that was still open, from a program that had ended.

⭐ Measured through a consumer: an MCP server that exits mid-request should be
reported as "Connection closed" and was reported as "Timed out after 1000ms".
The server was gone, nobody was writing, and the pipe stayed open because of a
waiter neither side knew existed.

⚠️ THIS IS THE 0.10 DEFECT'S THIRD FACE. `kal_process_spawn_bound' was added
because a SIGNAL reached the middle image; this is the middle image holding a
RESOURCE. Same fact, same fix: make that image as invisible as it claims to be.

Author: Sunrisepeak

port/src/okm.h

@@ -161,6 +161,11 @@ void okm_unlock(void);
 /* The table. */
 int  okm_fd_alloc(int from);                     /* the lowest free descriptor */
 void okm_fd_release(int fd);
+
+/* Every stream this image holds, released. The one caller is the `execve'
+ * composition, whose waiting image must not keep a pipe open on behalf of a
+ * program that has already ended --- see the definition. */
+void __okm_close_all_for_exec(void);
 struct okm_desc* okm_desc_of(int fd);
 int  okm_fd_bind(int fd, int kind, kal_uintptr stream,
                  struct kal_file file, struct kal_dir dir, int flags);

port/src/okm_fd.c

@@ -521,3 +521,25 @@ int okm_absolute(int dirfd, const char* path, char* out, size_t cap)
 	if (d->path_slot < 0 || !g_dirpath[d->path_slot][0]) return -ENOENT;
 	return join(g_dirpath[d->path_slot], path, out, cap);
 }
+
+/* Every stream this image holds, released --- used by the one place that has an
+ * image with nothing left to do.
+ *
+ * ⚠️⚠️ IT EXISTS BECAUSE `execve' HERE LEAVES AN IMAGE BEHIND. A replacement
+ * leaves one image; this library composes it as start, wait, end, which leaves
+ * two --- and the second still holds every file description the caller had. A pipe
+ * reports the end of input when the LAST writer lets go, so a waiter holding the
+ * write end kept a reader on the other side waiting for a program that had
+ * already ended. Measured through a consumer: a server that exits mid-request was
+ * reported as a timeout rather than as a closed connection.
+ *
+ * ⚠️ NOT A GENERAL `close everything'. The standard streams are released too,
+ * which is right HERE and wrong anywhere else: this image writes nothing more.
+ * The one caller is the `execve' composition, immediately before it waits. */
+void __okm_close_all_for_exec(void)
+{
+	okm_lock();
+	for (int fd = 0; fd < OKM_MAX_FD; fd++)
+		if (g_fd[fd].desc >= 0) okm_fd_release(fd);
+	okm_unlock();
+}

port/src/okm_syscall.c

@@ -1869,6 +1869,37 @@ syscall_arg_t __okm_syscall(syscall_arg_t n, syscall_arg_t a1, syscall_arg_t a2,
 		const int e = __okm_spawn_common(&child, (const char*)a1, 0, 0,
 		                                 (char* const*)a2, (char* const*)a3, 1);
 		if (e) return -e;
+
+		/* ⚠️⚠️ THE WAITER LETS GO OF EVERY STREAM IT HOLDS, AND WITHOUT THIS THE
+		 * FAR END OF A PIPE NEVER SAW THE END OF INPUT.
+		 *
+		 * A replacement leaves ONE image. This composition leaves two, and the
+		 * one that remains still holds every file description the caller had ---
+		 * including the write end of a pipe it had just placed at the started
+		 * program's standard output. A pipe reports the end of input when the
+		 * LAST writer lets go, so as long as this waiter sat there, the reader on
+		 * the other side saw a stream that was still open, from a program that
+		 * had already ended.
+		 *
+		 * ⭐ Measured through a consumer: an MCP server that exits while a
+		 * request is in flight should be reported as "Connection closed", and was
+		 * reported as "Timed out after 1000ms" --- the client waited its full
+		 * deadline for an end of input that this image was holding shut. The
+		 * server was long gone; nobody was writing; the pipe stayed open because
+		 * of a waiter neither side knew existed.
+		 *
+		 * ⚠️ THIS IS THE 0.10 DEFECT'S THIRD FACE. `kal_process_spawn_bound' was
+		 * added because a SIGNAL reached the middle image; this is the middle
+		 * image holding a RESOURCE. Both come from the same fact --- the
+		 * composition has an image the interface never told anyone about --- and
+		 * both are fixed by making that image as invisible as it claims to be.
+		 *
+		 * ⇒ Safe because this image does exactly two things afterwards: wait, and
+		 * end with a status. The started program received what it needed at the
+		 * spawn; the descriptors here are this image's own references and nothing
+		 * reads them again. */
+		__okm_close_all_for_exec();
+
 		int st = 0;
 		if (do_wait4((int)child, &st, 0, 0) < 0) kal_exit(127);
 		/* The status the started program ended with, in the form this library