Terminal lane final read: 37 findings repaired (signal latch with per-line sweep, tmux shutdown by identity, complete scan, landscape and colour readers)

[seathatflowsinourveins]

Scope

• What this PR changes, in one or two sentences: a third GPT-6 read of the terminal lane and its repairs. On 2026-09-30 six read-only jobs of the packaged Codex lane (three lenses, each on gpt-6.1-sol and on gpt-6-astra-ultra, effort max, through the local OmniRoute gateway) read the merged repairs of the earlier rounds (Terminal lane: repairs after the cross-family review (gpt-6.1-sol through the packaged Codex lane on OmniRoute), 46 findings checked, 39 repaired #532) and returned 37 findings; 21 were graded by independent Claude verifiers (17 confirmed, 4 partly, none refuted) and 16 are duplicates. This PR carries all 37 repairs: the pty probes' signal handling rebuilt around a latch and tested by a signal at every line of the resource lifecycle, the tmux probes' shutdown verified by the server's identity, the scan, the landscape comparison and the colour counter completed to follow their sources, documentation scoped to what each check proves, a private label file for the record builders, the sanitized record of the round, and the updated receipt.
• Base commit: 1f2cdce5 (origin/main after OSV: urllib3 2.8.0 and PyJWT 2.15.0 relock for the OpenHands lock; the frozen macOS lock's next exception scoped by the scanner itself (split scan), five advisories of 2026-09-30 #546, Gate A U1f: growth exponent for the child-usage linearity checks (validate-macos flaked on the per-doubling ratio) #556 and Codex CLI 0.159.2 pin with qualification receipt; Codex template default GPT-6.1 Sol/Ultra with Astra escalation (unit D4) #542; the branch was first built on 11227bfd, and when Codex CLI 0.159.2 pin with qualification receipt; Codex template default GPT-6.1 Sol/Ultra with Astra escalation (unit D4) #542 made manifests/evidence.json conflict it was replayed on 1f2cdce5 under the hot-file protocol of docs/lanes.md: main's copy of the manifest, this branch's four receipt entries and the hashes of its 59 changed files re-registered, the generated reports rebuilt, the validators re-run)
• Lane: lane:foundation
• Owned paths touched: evidence/artifacts/{notification-types-20260929,terminal-experience-20260928,login-shell-contract-20260929}/ (the repaired scripts and their READMEs), evidence/artifacts/terminal-lane-cross-family-review-20260930/ (the new scripts and records of the round; recorded/ regenerated), evidence/receipts/ (cross-family-review-terminal-lane-20260930 rebuilt; one limitation corrected in login-shell-contract-20260929), docs/decisions/2026-09-28-terminal-experience.md, docs/harness-defaults.md (four anti-pattern rows), recipes/claude-native-profile.md, tests/test_windows_terminal_defaults.py, and manifests/evidence.json with the generated reports (hot-file protocol: main's copy, the receipt entries and the hashes of the changed files). No Gate A frozen file (settings, hooks, launcher, AGENTS.md, CLAUDE.md) is touched.
• Outside git: the practice repository (no remote) got one commit (its doctor check now says that the probe's answer lines are not authenticated); nothing under ~/.claude, ~/.codex or the gateway changed.
• Authorship: written by a Claude Sonnet 5.5 coordinator session, hence the commit trailer. The reviewers are gpt-6.1-sol and gpt-6-astra-ultra (a second GPT-6 model, not another vendor); the verifiers are Claude Opus (effort max).

SOTA sources

• The packaged GPT-6 lane of this repository (tools/sota-convergence/landscape-sweep: build_args.stage_lane_home, codex_call.sh, codex_job.py), not a self-written runner; Codex CLI 0.159.2 (openai/codex rust-v0.159.2), OmniRoute cx/gpt-6.1-sol and cx/gpt-6-astra-ultra on the local gateway (decision docs/decisions/2026-09-27-omniroute-account-pool.md).
• Python signal module documentation (docs.python.org/3/library/signal.html, fetched 2026-09-30): an exception raised by a handler "may be raised after any bytecode instruction", so the handler only latches the first signal; PEP 475 (a call interrupted by a handler that returns is retried, so the loops poll the latch); signal(7) and pthread_sigmask (a blocked mask survives exec, measured on a sleep child: SigBlk 0x4003, hence no mask around the spawn).
• Windows Terminal, microsoft/terminal at v1.24.11911.0: src/terminal/adapter/adaptDispatchGraphics.cpp (SGR parameters: MAX_PARAMETER_VALUE 65535, a missing component is 0, colour components within a byte, the colon RGB form applied only with an empty colour-space field), src/terminal/parser/stateMachine.cpp (C1 characters ignored while AcceptC1 is off), src/cascadia/TerminalSettingsModel/CascadiaSettingsSerialization.cpp and IInheritable.h (own value, then profiles.defaults, then a fragment's profile), src/cascadia/TerminalApp/Tab.cpp (the bell indicator's 2000 ms timer on the focused tab).
• tmux 3.4 (measured on the installed server: display-message -p '#{pid}', the server process keeps the command line it was started with, a nonzero kill-server status does not tell a stopped server from a missing one) and tty-features.c (the sync terminal feature).
• bash(1) INVOCATION and the $BASH_EXECUTION_STRING variable (a startup file can replay the -c string, so the nonce keeps ordinary output from passing for the record and does not authenticate stdout; measured); openai/codex codex-rs/config/src/types.rs at rust-v0.157.1 and rust-v0.159.2 (the notification definitions, every Default and Display impl, the Tui fields; checked on the real files).
• No code was written where a maintained upstream exists: the repaired files are this repository's own checks and probes; the lane, the gateway, the verifier workflow and the merge tool are the existing ones.

Evidence-class table

Claim	Evidence class	Command / receipt
Six jobs of the packaged lane (three on gpt-6.1-sol, three on gpt-6-astra-ultra, effort max) returned 37 findings (1 high, 30 medium, 6 low; each with a reviewer-run command); 26.26M input tokens, 95.7% cache reads, 0.33M output, 50 min, pool 36 to 52 points	native_proven (the runner's own records)	receipt cross-family-review-terminal-lane-20260930 data.final_review; final-results.json
21 findings graded by independent Claude verifiers (17 confirmed, 4 partly, none refuted), 16 duplicates, all 37 repaired	native_proven (Claude Workflow, stack-verifier, four units) plus source_review	final-verification.json, final-findings.json, final_dispositions.json
The probes' signal handling: each of the two pty probes passes 8 end-to-end cases and 6 in-process latch tests (one and two SIGTERMs, two SIGINTs, SIGTERM then SIGINT, a SIGTERM at every line of the resource lifecycle, the exit status, two negative controls; no stand-in inherited a blocked signal), and 14 mutants (seven per probe) each fail exactly their cases	local_integration (negative controls)	recorded/alert_probe_selftest.txt, recorded/push_notification_probe_selftest.txt, recorded/pty_probe_mutants_alert.txt, recorded/pty_probe_mutants_push.txt
The tmux probes verify their server is gone by its identity before the socket directory is removed; two shutdown-failure controls each (a wrapper that refuses kill-server, and one that also lies about the pid)	local_integration (private tmux server)	recorded/tmux_bell_probe_selftest.txt (9 checks), recorded/tmux_sync_probe_selftest.txt, recorded/tmux_bell_probe.txt, recorded/tmux_sync_probe.txt
The readers follow their sources: the scan (12 tests, 11 mutants; the three installed releases give 17 types each), the landscape comparison (28 checks; the real rust-v0.157.1 and rust-v0.159.2 files), the colour counter (28 cases)	local_integration plus source_review	recorded/scan_reader_mutants.txt, recorded/notification_types_scan_*.json, recorded/landscape_refresh_selftest.txt, recorded/color_capture_selftest.txt
Native reruns: the colour counter matches the counts of 2026-09-28; the scrub probe on the native client compared 19 real-home names (none changed, none unmeasured); the PATH digest gives 13 entries	native_proven (claude --bare in a pty with a dummy key; throwaway homes)	recorded/color_capture.txt, recorded/scrub_placeholder_probe.txt, recorded/login_path_digest.txt
242 unit tests in the five affected modules pass	local_integration	recorded/unit_tests.txt
The login-shell scripts' nonce does not authenticate the shell's stdout; the digest-prefix and real-/tmp statements were corrected	source_review (measured on a startup file that replays the -c string)	decision record, "The final read of the repairs"

Local commands run

$ python3 scripts/validate.py
exit 0: {"components": 69, "hashed_files": 8559, "profiles": 4, "receipts": 177, "status": "passed"} (on the replayed head)
$ python3 scripts/validate_foundation.py ; python3 scripts/component_matrix.py --check ; python3 scripts/new_host_grand_list.py --check
exit 0, 0 and 0
$ python3 -B -m unittest tests.test_adoption_status tests.test_windows_terminal_defaults tests.test_adoption_docs_consistency tests.test_render_config tests.test_apply_claude_settings
Ran 242 tests ... OK (skipped=1)
$ the 30 commands of evidence/artifacts/terminal-lane-cross-family-review-20260930/recorded/exit_codes.txt
exit 0 each (the two signal-case mutant suites, 8 runs and 0 problems each, were run last and alone)
$ gitleaks git --pre-commit --staged --redact (the repository's pre-commit hook)
exit 0 on the commit below, after one reviewed false positive (a reviewer's prose "keys present, definitions_identical=True") had its punctuation changed in the record builder (see the artifact README)

Decision record

docs/decisions/2026-09-28-terminal-experience.md: "Update 2026-09-30", the new subsection "The final read of the repairs" (what was found, its residuals), three decision rows (signal handling, private labels, a further read) and the evidence row of the six jobs. docs/harness-defaults.md has four new anti-pattern rows (raising from a signal handler, judging a shutdown by an exit status, reading upstream syntax with a shorter rule than its grammar, naming a private string in the code that hides it).

Host evidence

This PR adds no file under evidence/hosts/.

• python3 scripts/host_receipts.py validate is part of scripts/validate.py, which passes.
• Independent review is recorded in this description (Review).
• No platform_status change is made from a host receipt alone.

Review

• The third read (the review this PR answers): six jobs, 37 findings; every finding was graded by a Claude verifier or is a duplicate of one that was, and the coordinator read each verifier's evidence before deciding. The largest theme is the re-check's own repairs: the signal handler that raised (Python may raise it after any bytecode instruction) could not be made safe by a mask or a spawn flag and was replaced by a latch; the tmux probes' kill-server status cannot tell a stopped server from a missing one; three readers (the scan, the landscape comparison, the colour counter) used a shorter rule than their sources' grammar.
• What the verifiers narrowed: four findings were narrower than claimed (the signal window is microseconds, a lost cancellation needed instrumentation, a missing precondition where the control worked as shipped, and a first fix that could not use kill-server's status); none was refuted.
• Not read again: the repairs of this round are checked by a sweep, mutants and native reruns but were not read again by a reviewer, and no fourth read is made inside this PR. Grounds: three reads returned 46, 33 and 37 findings, so the count does not converge and a fourth read would not by itself end the loop, and the bounded-review rule allows one review and one repair round (two further reads were made at the user's request). The shared Claude five-hour meter read 85% when the repairs were made (the peer terms: no new Claude agent at 60% or more); a headless probe on this host read 7% at 17:14Z after a host login change, but a headless probe reads the credential on disk, so whether this session's own requests count against that account is not established, and that reason is neither relied on nor dismissed here. A read of the merged commit is a separate bounded loop and the user's call.
• Recording note: recorded/unit_tests.txt was recorded at 16:35Z, before the last documentation, receipt-text and mutant-runner docstring edits; the five affected test modules were re-run on the replayed head (OK, skipped=1, not recorded) and validate.py passed on it. The mutant record was produced by a pty_probe_mutants.py that differs from the committed file only in its docstring (and the README row that repeats it).
• Residuals (recorded in the decision record): a settings save between the settings-swap tool's last comparison and the rename is still lost and is in neither file; the scan cannot resolve a name by scope or see a later .push; the login-shell scripts' answer lines are not authenticated against a startup file that replays the -c string; no Windows Terminal or interactive Claude Code session was run (the bell and focus reports remain unobserved).

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a version comment (no workflow is changed).
• New/changed workflows declare top-level permissions: contents: read (no workflow is changed).
• No secrets are printed, logged or committed; no new required secret was added. The added lines were scanned for user names, home paths, GUIDs, credential shapes and e-mail addresses: the only hits are five occurrences of /home/example (the allowed placeholder, the rule that keeps it the only one and its synthetic fixture).
• No new paid hosting, subscription or billing surface was introduced.
• Peer-owned untracked files and worktrees were preserved (not deleted, moved or overwritten).

🤖 Generated with Claude Code