Function run_capped 

pub fn run_capped(
    command: Command,
    timeout: Option<Duration>,
    cap: usize,
) -> Result<CappedRun>

Runs command to completion under an optional wall-clock timeout, capturing stdout and stderr, and never hanging past a bounded margin of the child’s exit no matter what it spawned.

This is the Subprocess executor’s own wait_capped machinery made public for a caller that spawns its own child processes rather than going through the executor: it normally puts the child in its own process group (Unix), drains both pipes on their own threads into cap-bounded buffers, and — if timeout elapses — kills the whole group (reaching a grandchild the child spawned) with the same bounded drain, so a wedged process becomes a TimedOut result rather than an unbounded block.

The child’s stdio is overridden to captured pipes and, on Unix, its process group is set to itself regardless of ambient environment variables or how command was configured; everything else about command (program, args, env, working dir) is used as given. Pass cap = 0 to keep all output, or a byte bound (e.g. 64 KiB) to retain only the most recent bytes of each stream.

Errors

std::io::Error only for a genuine spawn or wait failure; a non-zero exit or a fatal signal is reported through CappedRun::Exited’s status, not as an error, and a timeout is CappedRun::TimedOut, not an error.