The CI workflow failed in pkg/testutil because CaptureStderr did not restore os.Stderr before returning, violating the helper’s expected contract and failing TestSpec_PublicAPI_CaptureStderr_RestoresAfterCapture.

• Root cause

  • CaptureStderr restored os.Stderr via t.Cleanup, which runs at test cleanup time rather than when CaptureStderr returns.

• Behavioral fix in pkg/testutil/tempdir.go

  • Restore os.Stderr with a function-scoped defer, guaranteeing restoration at helper return.
  • Keep pipe lifecycle explicit:
    • fail fast if writer close fails
    • close reader after ReadFrom completes

• Resulting contract

  • CaptureStderr now captures writes during fn and returns with os.Stderr already restored, matching the public API spec test.

origStderr := os.Stderr
os.Stderr = w
defer func() { os.Stderr = origStderr }()

fn()

if err = w.Close(); err != nil {
    t.Fatalf("CaptureStderr: failed to close writer pipe: %v", err)
}
if _, err = buf.ReadFrom(r); err != nil {
    t.Fatalf("CaptureStderr: failed to read pipe: %v", err)
}
if err = r.Close(); err != nil {
    t.Logf("Warning: failed to close stderr capture reader: %v", err)
}