Terminal lane: repairs of the post-merge GPT read of #563 (38 findings, 16 distinct, all repaired)

[seathatflowsinourveins]

Scope

• What this PR changes, in one or two sentences: the repairs of a GPT read of the merged Terminal lane post-merge read: 11 findings repaired (probes end by the signal, spawn guard observed, sweep coverage stated, tmux identity control) #563 repairs of the terminal lane's signal handling, tmux probes and controls. On 2026-10-01, at the user's instruction to keep going with the highest-quality GPT lane, six read-only jobs of the packaged Codex lane (three lenses, each on gpt-6.1-sol and on gpt-6-astra-ultra, effort max, through the local OmniRoute gateway) returned 38 findings (5 high, 31 medium, 2 low): 16 distinct issues and 22 duplicates. The coordinator reproduced each distinct issue (13 by execution, 3 by reading; no Claude verifier agent was started because the shared five-hour meter read 89%) and confirmed all 16. This PR repairs all 38: the probes' latch now stays installed to the end of the process, nothing is flushed before the final kill and the signal is unblocked, the Enter is written under a signal block, the sweep counts the client's creation (the guard is marked and its mutant must fail through that count), a truncated sweep record is reported and the stand-in killed, the tmux identity is an exact comparison with a fourth control and a cleanup control, the statements about shells name bash and dash and the condition measured, and the scripts that measured them are repaired. The second head also repairs the three findings that GitHub's Codex review bot left on the first push (07:27Z, P2; the repository's ruleset makes an unresolved review thread a merge gate): a SIGTERM that lands after the final snapshot of the latch was lost, a stuck stdout held the probe for good, and the tmux selftests left socket directories behind. The coordinator reproduced all three by execution (the output before the repairs is recorded/codex_bot_verification.txt). The handoff now ends the latch's life (block the handled signals, read the latch, die BY the first signal or give every handler back to the default action), nothing is written while the latch is installed (say and emit_report), the controls remove and count their socket directories and have a scope control, and the sweep covers the handoff and requires death BY SIGTERM.
• Base commit: b8dd81ddc04e723da3f9fb9d97d850d11820e491 (origin/main when this head was pushed; the hot files were rebuilt on it). The record pass ran on 5597f9fa plus these changes; the later commits of main touched docs/harness-defaults.md and manifests/evidence.json (and 170 other files), so the two were resolved by the hot-file protocol on the newest main (the 2 scoped rows and the 11 added rows re-applied, the receipt entry and the hashes of the changed files re-registered, 8 of 8 steps passing) and a carry check confirmed that no receipt, convergence record or files[] row of main was dropped or altered.
• Lane: lane:foundation
• Owned paths touched: evidence/artifacts/{terminal-experience-20260928,notification-types-20260929,terminal-lane-cross-family-review-20260930}/ (the two pty probes, the mutant runner, the two tmux probes, the rewritten shell and signal-order scripts, the new GPT-read and review-bot scripts and records, their READMEs, recorded/), evidence/receipts/cross-family-review-terminal-lane-20260930.json (rebuilt), docs/decisions/2026-09-28-terminal-experience.md, docs/harness-defaults.md (two rows scoped, eleven rows added), and manifests/evidence.json with the generated reports (hot-file protocol: main's copy, the receipt entry and the hashes of the changed files). No Gate A frozen file (settings, hooks, launcher, AGENTS.md, CLAUDE.md) is touched. The merge train's coordinator was told before this PR was merged.
• Outside git: nothing; the practice repository, ~/.claude, ~/.codex and the gateway are unchanged.
• Authorship: written by a Claude Sonnet 5.5 coordinator session, hence the commit trailer. The reviewers are gpt-6.1-sol and gpt-6-astra-ultra (a second GPT-6 model, not another vendor).

SOTA sources

• The packaged GPT-6 lane of this repository (tools/sota-convergence/landscape-sweep: build_args.stage_lane_home, codex_call.sh, codex_job.py), not a self-written runner; Codex CLI 0.159.3 (each of the six job records names it; the earlier reads ran on 0.159.2), OmniRoute cx/gpt-6.1-sol and cx/gpt-6-astra-ultra on the local gateway; the prompts derive from this lane's own build_final_prompts.py.
• Martin Cracauer, "Proper handling of SIGINT/SIGQUIT" (cons.org/cracauer/sigint.html, fetched 2026-09-30): a program that caught SIGINT must reset it and send it to itself, and the wait-and-cooperative-exit shells stop their loop only when they received the SIGINT themselves; measured here for bash and dash in shell_loop_control.py.
• Python signal documentation (docs.python.org/3/library/signal.html, fetched 2026-09-30): SIGINT becomes KeyboardInterrupt "if the parent process has not changed it" (an inherited SIG_IGN stays ignored); signal.pthread_sigmask blocks the handled signals around the Enter; CPython v3.13.0 Modules/signalmodule.c, _PyErr_CheckSignalsTstate, loops for (int i = 1; i < Py_NSIG; i++) (read 2026-10-01), and signal(7) (man7.org, read 2026-10-01): "If multiple standard signals are pending for a process, the order in which the signals are delivered is unspecified".
• PEP 475 (peps.python.org/pep-0475, status Final, Python 3.5, fetched 2026-10-01): "If the signal handler returns successfully, the Python wrapper retries the system call automatically", which is why a write to a stuck stdout cannot be released by a handler that only returns; and signal(7) (man7.org, fetched 2026-10-01): "A signal may be blocked, which means that it will not be delivered until it is later unblocked. Between the time when it is generated and when it is delivered a signal is said to be pending", which the handoff relies on (a signal that arrives while the handled signals are blocked stays pending and meets the default action once the handlers are given back). Both findings of the review bot that concern signals were checked against them.
• tmux 3.4 and the Linux /proc interface (the server's command name is tmux: server and its argv keeps -S <socket> as started; measured).
• No code was written where a maintained upstream exists: the repaired files are this repository's own probes and checks; the lane, the gateway and the merge tool are the existing ones.

Evidence-class table

Claim	Evidence class	Command / receipt
Six jobs of the packaged lane (three on gpt-6.1-sol, three on gpt-6-astra-ultra, effort max) returned 38 findings (5 high, 31 medium, 2 low; each with a reviewer-run command); 27.69M input tokens, 96.1% cache reads, 0.36M output, 47 min, pool 30 to 67 of 100 points (other sessions' jobs ran in between)	native_proven (the runner's own records)	receipt cross-family-review-terminal-lane-20260930 data.post_gpt_read; postgpt-results.json
16 distinct issues, all confirmed by the coordinator (13 by execution on the merged code, 3 by reading), 22 duplicates, all 38 repaired; no verifier agent	local_integration (reproductions) plus source_review	recorded/post_gpt_verification.txt, postgpt-verification.json, postgpt-findings.json
The two pty probes pass 10 end-to-end cases and 10 in-process tests each (53 and 53 passes; the probe ends BY the signal, a closed or full stdout and a blocked signal do not keep it from ending by the signal, a second signal after the cleanups does not replace the first; the sweep reaches 122 of 184 lines with code for the alert probe and 135 of 210 for the push probe, now including the handoff and the output after it, 45 and 50 of them up to the spawn guard, where no client was created, and requires death BY SIGTERM) and 50 mutant runs (25 per probe: the unmutated probe and 24 mutants, each failing exactly its cases; the spawn mutant fails through the client-start observation and the print-before-handoff mutant through the full-pipe child)	local_integration (negative controls)	recorded/alert_probe_selftest.txt, recorded/push_notification_probe_selftest.txt, recorded/pty_probe_mutants_alert.txt, recorded/pty_probe_mutants_push.txt
The tmux probes' selftests have four shutdown-failure controls, a cleanup control and a scope control (11 checks for the bell probe); each of five mutants (the comparison removed, a substring, the servers of a failing control not stopped, their socket directories not removed, the removal not scoped) is caught by its named control	local_integration (private tmux server, mutants)	recorded/tmux_bell_probe_selftest.txt, recorded/tmux_sync_probe_selftest.txt, recorded/tmux_identity_mutant_bell.txt, recorded/tmux_identity_mutant_sync.txt
bash and dash behave as the documents now say (SIGINT to the group and to the child only), the wrong-signal control is rejected; both handlers ran in ascending signal number and the selftest rejects two broken recorders	native_proven (bash, dash, CPython, controls)	recorded/shell_loop_control.txt, recorded/signal_order_probe.txt, recorded/signal_order_probe_selftest.txt
One read-only Opus reader's nine findings on the repairs (four high, one medium, four low) were each verified and repaired; the sweep and its final-window mutant could not see the window before the repair (the mutant failed 0 of 12 cases), and the flush case failed for the unmutated probe under PYTHONUNBUFFERED=1	local_integration (reproductions by execution) plus source_review	second-head-read.json; the repaired runner's full run in recorded/
The three findings of GitHub's Codex review bot reproduce on the pushed first head (final window: child exit 0; full pipe: still running after 6 s; each tmux selftest: two directories left) and no longer on the repaired code (-15 four times, none left)	local_integration (reproductions by execution)	recorded/codex_bot_verification.txt, recorded/codex_bot_verification_after.txt, codex-bot-read.json
260 unit tests in the five affected modules pass	local_integration	recorded/unit_tests.txt

Local commands run

exit 0 <- python3 -B notification_types_scan.py <release 2.1.284 binary> <checkout>
exit 0 <- python3 -B notification_types_scan.py <release 2.1.285 binary> <checkout>
exit 0 <- python3 -B notification_types_scan.py <release 2.1.286 binary> <checkout>
exit 0 <- python3 -B scan_reader_mutants.py <checkout> <the three installed release binaries>
exit 0 <- python3 -B replace_bell_group_controls.py <checkout>
exit 0 <- python3 -B replace_bell_group_mutants.py <checkout>
exit 0 <- python3 -B tmux_bell_probe.py --selftest (four shutdown-failure controls, the cleanup control and the scope control)
exit 0 <- python3 -B tmux_bell_probe.py (tmux 3.4, private server)
exit 0 <- python3 -B tmux_sync_probe.py (tmux 3.4, private server)
exit 0 <- python3 -B tmux_sync_probe.py --selftest (four shutdown-failure controls, the cleanup control and the scope control)
exit 0 <- python3 -B verify_codex_bot_findings.py <checkout> r1, r2 and r3 (after the repairs: the three findings of the Codex review bot no longer reproduce)
exit 0 <- python3 -B push_notification_probe.py --selftest
exit 0 <- python3 -B alert_probe.py --selftest
exit 0 <- python3 -B color_capture.py --selftest
exit 0 <- python3 -B color_capture.py (native claude --bare in a pty, dummy key)
exit 0 <- python3 -B login_shell_check_controls.py --real-host
exit 0 <- python3 -B login_path_digest.py --selftest
exit 0 <- python3 -B scrub_placeholder_probe.py --selftest
exit 0 <- python3 -B scrub_placeholder_probe.py (native claude in throwaway homes with a dummy key; the real home is only lstat-compared)
exit 0 <- python3 -B login_path_digest.py (this host's login shell: entry count and digest prefix only)
exit 0 <- python3 -B landscape_refresh.py --selftest
exit 0 <- python3 -B codex_tui_strict_check.py --selftest
exit 0 <- python3 -B codex_tui_strict_check.py <checkout> (installed Codex, throwaway CODEX_HOME)
exit 0 <- python3 -B login_shell_bash_truth.py <checkout>
exit 0 <- python3 -B overlay_noop_check.py <checkout> (this host's user settings, booleans only)
exit 0 <- python3 -B -m unittest tests.test_adoption_status tests.test_windows_terminal_defaults tests.test_adoption_docs_consistency tests.test_render_config tests.test_apply_claude_settings
exit 0 <- python3 -B shell_loop_control.py (bash and dash loops, SIGINT to the process group and to the child only, and the rejecting control)
exit 0 <- python3 -B signal_order_probe.py
exit 0 <- python3 -B signal_order_probe.py --selftest
exit 0 <- python3 -B tmux_identity_mutant.py <checkout> bell (three mutants)
exit 0 <- python3 -B tmux_identity_mutant.py <checkout> sync (three mutants)
exit 0 <- python3 -V, tmux -V, claude --version and the base commit of the worktree
exit 0 <- python3 -B checks/check-terminal-profiles.py (practice repository)
exit 0 <- python3 -B checks/check-terminal-profiles-controls.py (practice repository)
exit 0 <- nativestack.login_shell_check() (practice repository)
exit 0 <- python3 -B pty_probe_mutants.py <checkout> alert
exit 0 <- python3 -B pty_probe_mutants.py <checkout> push
exit 0 <- python3 -B verify_post_gpt_findings.py <read-only checkout of 50bba7bb> flush handoff typing partial skips identity cleanup symlink delay wrongsignal order dash spawn (output before the GPT read's repairs: recorded/post_gpt_verification.txt)
exit 0 <- python3 -B verify_codex_bot_findings.py <detached worktree at the pushed first head 66283fe8> r1, r2 and r3 with --before (output before the bot's repairs: recorded/codex_bot_verification.txt)
exit 0 <- python3 -B -m unittest tests.test_adoption_status tests.test_windows_terminal_defaults tests.test_adoption_docs_consistency tests.test_render_config tests.test_apply_claude_settings (260 tests, OK (skipped=1) on the base the record pass ran on, 5597f9fa, plus these changes; run again, not recorded, on the rebased head: 262 tests, OK (skipped=1); the CI validate job runs the suite on each head)
exit 0 <- python3 -B check_receipt_hashes.py <checkout> cross-family-review-terminal-lane-20260930 (no mismatch, no unlisted script)
exit 0 <- python3 -B register_receipts.py <checkout> cross-family-review-terminal-lane-20260930 (hot-file protocol on main b8dd81dd: scripts/validate.py, validate_foundation.py, component_matrix.py --check, new_host_grand_list.py --check)
exit 0 <- python3 -B carry_check.py <checkout> origin/main cross-family-review-terminal-lane-20260930 (no receipt, convergence record or files[] row of main dropped or altered; every row of this unit carried)
exit 0 <- python3 -B shell_loop_control.py; python3 -B verify_codex_bot_findings.py <checkout> r1, r2 and r3 (re-run after a print-format fix removed the trailing spaces of their recorded outputs, which the Gate A owner's git diff --check had listed; recorded/shell_loop_control.txt and recorded/codex_bot_verification_after.txt are those re-runs)
exit 0 <- git diff --check origin/main HEAD (no finding)
exit 0 <- the pre-commit gitleaks scan of the commit (no leaks found)

Decision record

docs/decisions/2026-09-28-terminal-experience.md: the new subsections "The post-merge GPT read" (what was found and repaired, the measured shell table, the residuals) and "The Codex review bot's read of the first push", seven decision rows (who verified the findings, how the sweep observes a client's creation, the read after the post-merge read, how long the latch lives, where the probes write, what the sweep accepts, how the tmux controls find what a run left), the evidence rows and the limits. docs/harness-defaults.md has eleven new anti-pattern rows (a fallible step before the essential action, extended by this round's recurrence; a check that a signal can overtake, extended likewise; an identity checked by substring; a measurement generalized to a class; a control that cannot tell an empty observation; a mutant that fails for an incidental reason; a latch that outlives its last safe point; a check that accepts an outcome the claim excludes; counting what a run left behind by a host-wide pattern; a signal test that inherits the state of its launcher; a test driver that repeats the code under test) and two rows scoped to bash.

Host evidence

This PR adds no file under evidence/hosts/.

• python3 scripts/host_receipts.py validate is part of scripts/validate.py, which passes.
• Independent review is recorded in this description (Review).
• No platform_status change is made from a host receipt alone.

Review

• The read: 38 findings from two GPT-6 models on three lenses; the three high ones were the tmux identity as a substring test, a flush that could keep the probe from ending by the signal, and a predictable temporary path (the coordinator's severities: medium, medium and low). Most findings were duplicates across the two models (22 of 38), which is also the strongest sign that the 16 distinct issues are real.
• Verified before repaired: each distinct issue was reproduced with verify_post_gpt_findings.py (its output on the merged code is recorded, from a read-only checkout of 50bba7bb whose artifact files equal those of the merge commit c99a482e; check out c99a482e to re-run it) or checked by reading; no verifier agent was used, so a flaw in a reproduction would not have been caught by a second reader.
• The review bot's read: GitHub's Codex review bot read the first push on its own and found three defects in the repairs of the GPT read (all three of the kind the earlier rounds had found: a check a signal can overtake, a fallible step before the essential action, a control without a check for its own claim); it is a third reader of these repairs; before this head was pushed one read-only Claude Opus reader (no shell) also read them and returned nine findings, each verified (five by execution) and repaired (second-head-read.json); and each of the bot's threads gets a reply on the pull request that names the reproduction and the check that fails without the repair, and is resolved there.
• Not read again: the repairs of the Opus reader's findings are checked by the new cases, 50 mutant runs and native reruns and were not read by a second reviewer; no further read is commissioned inside this PR (seven reads returned 46, 33, 37, 11, 38, 3 and 9 findings, the bounded-review rule is used up, and a read of the merged result is the user's call); a new bot thread on the second head would be a merge gate again.
• Residuals (recorded in the decision record): the lines after the prompt is typed remain unswept and the writes to the client's pty in measure are not bounded while the latch is installed; signals pending together are ordered by number, so the first signal wins one dispatch apart; a kill by pid after the identity check has a gap that pidfd_open would close; SIGHUP is covered in process only; the tmux probes install no signal handler; the tmux selftests must run one at a time (a parallel run of both failed the unmutated selftest); only bash and dash were measured; no Windows Terminal or interactive Claude Code session was run (the bell and focus reports remain unobserved).

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a version comment (no workflow is changed).
• New/changed workflows declare top-level permissions: contents: read (no workflow is changed).
• No secrets are printed, logged or committed; no new required secret was added. The added lines were scanned for user names, home paths, GUIDs, credential shapes and e-mail addresses: 1 hit, the placeholder /home/example in the hygiene instruction of a review prompt template (not a path of this host; the same sentence is in the earlier prompt builder); a planted control in a throwaway worktree (one line of each category) was detected 8 of 8 times, so the scan can see what it counts
• No new paid hosting, subscription or billing surface was introduced.
• Peer-owned untracked files and worktrees were preserved (not deleted, moved or overwritten).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-01T07:27:41.773094Z	5c48464	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5c484647d8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".