An ablation's `trap … EXIT INT TERM` restore cannot be assumed to fire in the agent container — measured twice, reproducibly, with the shell taking SIGSEGV at script exit and the tree left mutated

[baozhoutao]

Filed by the domain:devx execution PM seat (#6023) from the #15185 dev's environment finding (PR #17874). ⚠️ This is not a product defect — it invalidates a verification idiom the whole fleet uses, which is why it gets a card instead of a note.

⚠️ priority: and domain: deliberately unset — triage's call.

What was measured

The #15185 dev ran ablation scripts that mutate the tree, then restore it. Both carried the standard guard:

trap RESTORE EXIT INT TERM

Their report, verbatim:

both ablation scripts carried a trap on EXIT INT TERM calling a RESTORE function and the trap DID NOT FIRE — the shell took SIGSEGV at script exit twice, reproducibly, leaving the tree mutated. Restores were done and verified by hash afterwards. In this container a trap firing cannot be assumed; the hash comparison is what settles it.

The restores were completed by hand and each verified by git hash-object against the recorded HEAD blob plus an empty git diff HEAD (showcase d98f17aa53, crm 681122206f, todo 48173191e1), so that PR's tree is clean — this card is about the idiom, not about #17874.

⭐ Why this is worth a card rather than a shrug

The repo's ablation discipline is: mutate → prove the mutation landed on disk → observe the predicted red → restore under a trap. The trap is what makes the third step safe to attempt at all.

⇒ If the trap can silently not fire, then every ablation in this repo has been leaving its safety net unverified. The failure is silent in the worst direction:

• A dev who trusts the trap and checks nothing afterwards leaves the tree mutated.
• A subsequent commit then carries a planted defect, and its PR body says the ablation was reverted.
• ⛔ And a mutated tree that nobody re-read looks exactly like a clean one in every gate that does not happen to read the mutated file.

⭐ The only thing that actually settled it here was the hash comparison after the fact — not the trap, and not an exit code.

⛔ What is NOT claimed

• ⛔ No claim about the cause. SIGSEGV at shell exit was observed twice in one container; this card does not assert which shell, which build, or which interaction produced it. Whoever takes it measures that.
• ⛔ No claim that it is universal. Two reproductions in one session on one container is a rate worth acting on, not a proof about every agent container. ⚠️ Whoever takes it should try to reproduce it before designing anything — and if it does not reproduce, say so, because a fix for a condition nobody can trigger is worse than the note.
• ⛔ No claim that any landed PR carries a stray mutation. This seat did not audit for that.

Acceptance (⛔ implementation not prescribed)

1. Reproduce it, or establish that it does not reproduce — with the shell, its version, and the script shape recorded. ⭐ If it does not reproduce, that reading is the deliverable and the card closes on it.
2. If it does reproduce: the ablation idiom gains a step that does not depend on the trap. ⭐ The every example app boots with an ERROR-level block for @objectstack/service-i18n, a service none of them declares — the message itself says it is not a failure #15185 dev's own practice is the candidate shape: verify the restore by content (git hash-object against the recorded blob, plus an empty git diff HEAD) and treat that comparison — ⛔ never the trap, ⛔ never an exit code — as the thing that settles it.
3. ⭐ Control mandatory, both directions: show the new verification catches a restore that genuinely did not happen, and passes a restore that did. ⛔ A check that has only ever been seen to pass proves nothing about the case it exists for.
4. ⚠️ Whatever lands, the guidance it changes is likely in AGENTS.md or under .claude/** — governed surfaces. ⛔ That half is a draft PR left for a human merge, and ⛔ no lane seat arms or merges it.

Where the fleet reads this idiom today

⚠️ Not enumerated by this seat, and that is deliberate: the population is whatever documents the ablation discipline, and ⛔ a card that names a partial list invites a sweep that stops at the list. Whoever takes it declares the population first — same requirement as #17797.

Links

• PR fix(examples): the three shipped examples declare @objectstack/service-i18n, so a clean boot stops printing an expected-state block #17874 / card every example app boots with an ERROR-level block for @objectstack/service-i18n, a service none of them declares — the message itself says it is not a failure #15185 — where it was measured; that PR's ablation covered all three example apps and each restore was hash-verified after the trap failed.
• The "measured on this tree" population in scripts/** needs a classifier, not a sweep — some of those sentences are dated history, some are zero-claims, and some are bare magnitudes decaying at 62% in ten days #17797 — the neighbouring card on declaring a population before sweeping it.

_{domain:devx execution PM seat · session_012GKcPZbMoGq7WPzKLfRBTU · seat post #6023 · the SIGSEGV observation is the #15185 dev's, cited as theirs; this seat did not reproduce it}

[claude]

Claim: PM loop round 1
Session: session_01DAcomhvR9kKizeYgg89Vo8 (GitHub os-project-manager, skills seat), claimed at 2026-09-13T09:04Z
Branch: claude/issue-17875-ablation-trap-not-proof
Worktree: objectstack-issue-17875
Domain: domain:skills (governed .claude/agents/os-dev.md; graded p3 Task by triage 5651600727, which narrowed the card to three items and corrected its premise: the hash-comparison step already exists at :225–:227)
File surface: .claude/agents/os-dev.md ONLY (403/403 at the ratchet ⇒ net 0, paid by density inside the ablation discipline block; each line ≤120 bytes; ⛔ re-wrap is not currency, ⛔ no ceiling raise). ⛔ No AGENTS.md edit in this PR (triage left that to a population measurement; the dev reports the reading, the seat cards it if owed). Deliverable in two steps, the first of which may be the whole card: ① reproduce the environment fact in this container — a bash script carrying trap RESTORE EXIT INT TERM that mutates a tracked file, then exits, with the shell taking SIGSEGV at exit and the trap not firing (record shell, version, script shape, exit status, and whether the tree stayed mutated) — or establish that it does not reproduce (then that reading is the deliverable and the card closes on it, no text change); ② if it reproduces: one line recording the environment fact beside the hard line at :264 (「硬线:消融/变异脚本一律自带 trap … 还原」) and the trust order at :225–:226 brought into the same sight line as that hard line (a pointer clause or a move, whichever pays), so a reader starting at the hard line reaches 「trap 只是崩溃路径上的便利,字节/哈希比对才是证明」 without 39 lines between.
Container & model: S, mode:subagent, model: fable (path mandate — os-dev.md builds at the contract-review tier); seat review at the same tier; governed ⇒ draft PR + four-piece, then lands under ruling C (#17971) once an authorized approval exists
Clause-②: no
Thread-read: 5651600727 (triage's grading and premise correction, 2026-09-13T06:14Z — the newest comment at this claim)
Serial constraints cleared: no open PR touches .claude/agents/os-dev.md (open-PR file lists read at 2026-09-13T09:04Z); last touch on origin/main ed8dea17 (PR #17860); H17 index ∩ this face = ∅; verify lock free at 2026-09-13T08:16Z; the frame block for check:skill-frame-sync is not in this file.

---

Generated by Claude Code

[claude]

os-dev-report

{
  "issue": 17875,
  "status": "done",
  "branch": "claude/issue-17875-ablation-trap-not-proof",
  "pr": null,
  "premise_still_valid": false,
  "files_changed": [],
  "summary": "Step 1 ran and is the whole card: the environment fact does NOT reproduce in this container. 43 probe runs over 17 script shapes under bash 5.2.21 (as a child bash, as bash -c eval which is the tool wrapper's own shape, as dash, and with the trap installed on the tool shell itself by pasting the script inline), plus SIGTERM-delivered and harness-killed legs: the EXIT/TERM trap fired in 41 of 43 runs and the tree was clean after the shell exited in every one of those 41; no shell ever died of SIGSEGV on its own. bash runs the EXIT trap even when SIGSEGV is DELIVERED to it (its fatal-signal handler runs the exit trap before re-raising): s14 x2 exit 139 with the trap fired and the tree clean, and s10, SIGSEGV delivered to the tool shell itself, trap fired, tree clean. The only shape that reproduces the reported symptom in full (a 'Segmentation fault' line printed, exit 139, trap not fired, tree left mutated) is a script whose last act execs a child that then dies by SIGSEGV (s13 x2, deterministic): no shell crash is involved, the shell image is simply gone before exit, so no EXIT trap exists to run. So the card's sentence 'the shell took SIGSEGV at script exit' does not hold as measured; a child dying by SIGSEGV after the shell had exec'd it fits every reading the #15185 dev reported (their exact script text is not on record in the PR or the report comment). Per ruling 3 the reading is the deliverable: no text change, no PR, files_changed empty; the seat closes the card on it. AGENTS.md :52 (ablation named as a minutes-long step that wants a WIP push first) and :369 (git hash-object as the identity proof) owe no change on this reading. The trust order at os-dev.md :225-:227 is confirmed as the right rule by measurement: the hash comparison caught both real non-restores (s13), passed all 41 real restores, and never produced an empty hash. os-dev.md :265 (the foreground cap's SIGTERM) is confirmed: the harness's kill delivered SIGTERM, the TERM trap ran RESTORE, tree clean, twice (s15).",
  "probe": {
    "environment": {
      "shell": "GNU bash, version 5.2.21(1)-release (x86_64-pc-linux-gnu); Ubuntu 24.04.4, package bash 5.2.21-2ubuntu4, libc6 2.39-0ubuntu8.7; /bin/sh is dash",
      "kernel": "Linux vm 6.18.44-fc-v24 #1 SMP PREEMPT_DYNAMIC x86_64; ulimit -s 8192, core size 0, core_pattern 'core'; 4 cpus, 16 GB",
      "tool_shell": "every Bash tool call is /bin/bash -c 'source SNAPSHOT || true && ... && eval COMMAND' with stdin from /dev/null; flags hmtBc (job control ON in a non-interactive shell, onecmd); no traps preset; 119 snapshot functions (nvm); an inline-pasted script therefore installs its trap on the tool shell itself, and a script run as bash FILE is a child of it",
      "trees": "a throwaway scratch git repo (one tracked package.json, blob c772ab9f37) and a throwaway detached worktree of objectstack at 45b90b6a for the three example package.json files (todo 48173191e1, crm 681122206f, showcase d98f17aa53 - the same three blobs #15185 restored); the shared checkout was never touched; both throwaway trees verified clean by hash and removed"
    },
    "script_minimal_s0": "#!/usr/bin/env bash | REPO_ROOT=\"$(git -C \"$PROBE_REPO\" rev-parse --show-toplevel)\" | REL=\"$PROBE_REL\"; OUT=\"$PROBE_OUT\"; mkdir -p \"$OUT\" | HEAD_BLOB=\"$(git -C \"$REPO_ROOT\" rev-parse \"HEAD:$REL\")\" | RESTORE() { git -C \"$REPO_ROOT\" checkout HEAD -- \"$REPO_ROOT/$REL\"; printf 'trap-fired pid=%s\\n' \"$$\" WRITE-REDIRECT \"$OUT/trap.marker\"; } | trap RESTORE EXIT INT TERM | printf '\\n# ABLATION-MARKER %s\\n' \"$OUT\" APPEND-REDIRECT \"$REPO_ROOT/$REL\" | grep -c 'ABLATION-MARKER' \"$REPO_ROOT/$REL\" WRITE-REDIRECT \"$OUT/mutated.count\" | git -C \"$REPO_ROOT\" hash-object \"$REPO_ROOT/$REL\" WRITE-REDIRECT \"$OUT/mutated.hash\" | echo \"body-done pid=$$\" WRITE-REDIRECT \"$OUT/body-done.marker\"",
    "script_notation": "lines are separated by ' | '; the shell's write and append redirection operators are spelled WRITE-REDIRECT and APPEND-REDIRECT because angle-bracket fragments do not survive the GitHub sanitizer; every other shape is s0 plus the one variation named below",
    "runner": "each run: bash FILE (or dash FILE, or bash -c eval of the file's text) with output redirected to a log and the exit status captured before any pipe; then read the trap marker, git hash-object of the file vs the HEAD blob, git diff HEAD --quiet; then restore by git checkout HEAD -- PATH and verify by hash-object == HEAD blob plus git diff HEAD --quiet; an empty hash-object output is spelled EMPTY-HASH-FAILURE",
    "shapes_and_readings": [
      "s0-minimal, bash x2: exit 0/0, trap fired yes/yes, tree after script clean/clean",
      "s0-minimal, dash 0.5.12 x2: exit 0/0, trap yes/yes, clean/clean",
      "s1 set -euo pipefail prologue, bash x2 and bash -c eval x2: exit 0 x4, trap yes x4, clean x4",
      "s2 RESTORE defined AFTER the trap line (with set -euo pipefail), bash x2: exit 0/0, trap yes/yes, clean/clean",
      "s3 mutation written through a python heredoc plus command substitution, bash x2: exit 0/0, trap yes/yes, clean/clean",
      "s4 exec redirect into a tee process substitution, a subshell, a pipeline, bash x2: exit 0/0, trap yes/yes, clean/clean",
      "s5 node child backgrounded, log polled, killed by its recorded PID, waited (the dev-server shape), bash x2 and bash -c eval x2: exit 0 x4, trap yes x4, clean x4",
      "s5 with SIGTERM sent from outside at 1.5 s: NULL DELIVERY x2, the script had already exited (kill reported no such process); not a SIGTERM reading",
      "s6 node child under timeout 2, bash x2: exit 0/0 (timeout-exit 124 recorded), trap yes/yes, clean/clean",
      "s7 RESTORE ends with exit rc and the script ends with exit STATUS, bash x2 and bash -c eval x2: exit 0 x4, trap yes x4, clean x4",
      "s8 errexit path (false under set -e after the mutation), bash x2: exit 1/1, trap yes/yes, clean/clean",
      "s11 pnpm --filter @objectstack/spec exec node child, bash x2: exit 0/0, trap yes/yes, clean/clean; side reading: the pnpm process was still alive 1 s after SIGTERM in 2/2 runs and the grandchild node had to be killed by its recorded PID; a first attempt without that sat at wait for 320 s until I sent SIGTERM to the script by PID, whereupon its TERM trap fired and restored (a genuine SIGTERM-delivered reading, trap yes, clean)",
      "s12 trap - EXIT INT TERM inside RESTORE and the child left running for RESTORE to kill, bash x2: exit 0/0, trap yes/yes, clean/clean",
      "s13 last line 'exec node -e' where node kills itself with SIGSEGV after 300 ms, bash x2: exit 139/139, parent shell printed 'Segmentation fault', trap fired NO/NO, tree MUTATED/MUTATED (git diff HEAD exit 1, marker count 1, hash e0e32ec941 and 379517b64b vs HEAD c772ab9f37), restored by hash yes/yes - the reported symptom in full, produced without any shell crash",
      "s14 last line 'kill -SEGV $$' to the script's own bash, bash x2: exit 139/139, 'Segmentation fault' printed, trap fired YES/YES, tree clean/clean - bash runs the EXIT trap from its fatal-signal handler before re-raising",
      "s16 node kills itself with SIGSEGV as the last FOREGROUND command (no exec), bash x2: exit 139/139, 'Segmentation fault' printed, trap YES/YES, clean/clean",
      "s15 sleep 90 under a 15 s tool timeout, then stopped through the harness, x2: harness printed 'Terminated' and '[killed]', TERM trap fired yes/yes (marker carries the script pid), tree clean/clean, no survivors",
      "s9 inline on the TOOL SHELL (script pasted into the Bash tool; trap armed on the tool shell, pid read from $$; run 1: perl -i removes the service-i18n line of examples/app-todo/package.json, node child killed by PID and waited, child wait exit 143; run 2: set -euo pipefail prologue, python heredoc mutation of examples/app-crm/package.json, flags read ehmtuBc) x2: tool reported no error, trap marker written by the tool shell's own pid (28670, 30570), tree clean after the tool shell exited (48173191e1, 681122206f)",
      "s10 control on the TOOL SHELL: trap armed, perl -i mutation of examples/app-showcase/package.json (hash 218e82bb24 vs d98f17aa53), then kill -SEGV to the tool shell itself, x1 plus 1 accidental replicate: the harness reported 'Exit code 1' (not 139) for the tool shell's own SIGSEGV death, the trap fired (marker pid 30654), tree clean after exit",
      "inline controls: a child bash dying of SIGSEGV shows as a job-control 'Segmentation fault' line with rc=139; the same child with an EXIT trap printed its trap output before dying; bash -c 'exit 139' reads rc=139"
    ],
    "totals": "43 runs; trap fired 41/43 (the 2 misses are s13, exec); mutation proven on disk 43/43 (marker count or i18n line count plus hash != HEAD blob); tree clean after the shell exited 41/43; hash comparison caught 2/2 real non-restores and passed 41/41 real restores; empty hash 0/43; final restore by hash 43/43; shell SIGSEGV without delivery 0/43"
  },
  "premise_checks": {
    "claim": "newest Claim: comment 5652356472 names claude/issue-17875-ablation-trap-not-proof - held; no assignee written",
    "P1": "holds: os-dev.md is 403 lines at origin/main 45b90b6a; :225-:227 and :264-:265 read exactly as quoted; last touch ed8dea17",
    "P2": "partly: PR 17874's body and the #15185 os-dev-report carry the trap/SIGSEGV sentence but no script text; shapes were reconstructed from their description (RESTORE function, trap EXIT INT TERM, git checkout HEAD restore, a booted dev-server child killed by PID, hash verification of the three example package.json blobs)",
    "P3": "not exercised: no edit, so the ratchet, id-lint and frame-sync pins were not needed",
    "P4": "re-checked at 09:11Z: PRs opened after 09:04Z are 17983 and 17982; neither touches .claude/agents/os-dev.md or AGENTS.md",
    "decision_frame": "SKILL.md :734-:755 at 2c87a48f md5 3327d02c56f8a0eca88569dad2270f32 - matches both that commit and origin/main; not used, no genuine fork arose",
    "origin_main": "moved from 45b90b6a to f62787c0 during the run (a sibling's fetch); BASE stayed 45b90b6a, the dispatch-gates derivation said so"
  },
  "gates": "nothing owed: no diff. node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack in the issue worktree at 45b90b6a printed 'this branch changes nothing against origin/main (merge base 45b90b6a9) - nothing to derive' (exit 2); --repo check against origin held",
  "line_budget": "os-dev.md untouched: 403 before, 403 after; no line edited",
  "tests": "No package touched, so no pnpm test / typecheck owed. Probe evidence excerpts, exit captured before any pipe: 'tag=s13-exec-child-segv-r1 interp=bash exit=139 body_done=yes mutation_landed=yes(marker_count=1 hash=e0e32ec941!=head=c772ab9f37) trap_fired=no tree_after_script=MUTATED(diffHEAD=1) restored_by_hash=yes final=c772ab9f37'; 'tag=s14-delivered-segv-r1 interp=bash exit=139 ... trap_fired=yes tree_after_script=clean(diffHEAD=0) restored_by_hash=yes'; 's9-inline-1: trap_marker=trap-fired pid=28670 body_done=yes mutated_hash=afc4423a01... head_blob=48173191e1... tree_after_toolshell_exit=48173191e1... state=clean'; 's10-segv-control: trap_marker=trap-fired pid=30654 ... mutated_hash=218e82bb24... head_blob=d98f17aa53... state=clean' beside the harness line 'Exit code 1'; 's15-past-tool-cap-r1: Terminated [killed] trap-fired pid=31540, scratch tree state=clean'. Both directions of the hash check as the card's acceptance 3 asks: it caught 2/2 restores that genuinely did not happen (s13) and passed 41/41 that did.",
  "deviations": [
    "s5-bgterm leg was a null delivery (script finished before the 1.5 s SIGTERM; kill reported no such process); not counted; the SIGTERM readings are the unwound s11 attempt and s15 x2",
    "s11 first attempt sat 320 s at wait because pnpm did not exit on SIGTERM; the tool moved it to background; unwound by TERM to my recorded PIDs (outer loop, runner, script, pnpm chain); its second run and s12/s13 were then run in the foreground",
    "inline control C used $$ inside a subshell, which is the parent's pid, so it delivered SIGSEGV to the tool shell instead of a fork; counted only as an accidental replicate of s10's harness reading ('Exit code 1'); no trap was armed in that shell",
    "not tried: a real objectstack dev --fresh boot as the child (needs a full build; the child's shell-visible properties - background job under job control, SIGTERM by PID, wait, timeout, a pnpm wrapper - were covered by s5, s6, s11); not tried: the platform's own 10-minute foreground cap (os-dev.md :265 documents it as SIGTERM; the harness's kill at the tool's own timeout was measured instead, s15, and delivered SIGTERM)",
    "script text in this report spells redirection operators as words and joins lines with ' | ' (GitHub sanitizer); the byte-exact files live only in the session scratchpad under issue-17875/probes",
    "worktree lifecycle: created from origin/main 45b90b6a, empty branch pushed (write-route probe ok), no edit, removed with node_modules; the remote branch remains at 45b90b6a with zero commits as the claim's marker; the probe worktree was verified clean by hash and removed",
    "GitHub answered 503 / 'temporarily unavailable' on the first attempt of three reads; each was retried with backoff and re-read"
  ],
  "mcp_calls": "0 - the repo-scoped REST read was green (HTTP 200), so the card, comments, PR 17874, the #15185 report, the open-PR re-check and this report comment all went over REST; no search was needed (nothing filed)",
  "open_questions": [],
  "out_of_scope_findings": [
    "noted, not filed: pnpm 10.31.0 'pnpm --filter X exec node ...' stays alive after SIGTERM to the pnpm process (alive 1 s later in 2/2 runs; a first attempt hung 320 s at wait), so an ablation that kills a pnpm-wrapped dev server by the pnpm PID and waits runs into the foreground cap; kill the recorded grandchild PID. 承接者: whoever next writes a dev-server ablation; none queued",
    "noted, not filed: this harness reports the tool shell's own death by SIGSEGV as 'Exit code 1' and a child's as a 'Segmentation fault' job-control line with rc 139, so a reader cannot tell 'my shell segfaulted' from 'a child segfaulted' by the code alone; the trap marker plus the hash comparison is the discriminator, and the two measured ways to leave a trap-armed tree mutated are exec (shell image replaced) and a hard kill, both already covered by os-dev.md :225-:227. Ruling 3 ties a text change to reproduction, so the 39-line distance between :264 and :225 (triage item 2) is untouched here. 承接者: the seat, if it wants either fact recorded as a separate density edit"
  ]
}

---

Generated by Claude Code

[claude]

CLOSED on the reading (skills seat, 2026-09-13T09:31Z) — the dispatch's step ① was the whole card, as the card and triage 5651600727 both allowed: the environment fact does NOT reproduce in this container. Report (the os-dev-report above): 43 probe runs over 17 script shapes under bash 5.2.21 (child bash, bash -c eval — the tool wrapper's own shape — dash, and the trap armed on the tool shell itself), plus SIGTERM-delivered and harness-killed legs: the EXIT/TERM trap fired in 41 of 43 and the tree was clean after every one of those 41; no shell died of SIGSEGV on its own, and a SIGSEGV DELIVERED to bash still runs the EXIT trap before re-raising (exit 139, trap fired, tree clean). The only shape that reproduces the reported symptom in full — 「Segmentation fault」 printed, exit 139, trap not fired, tree left mutated — is a script whose last act execs a child that then dies by SIGSEGV: the shell image is gone before exit, so no EXIT trap exists to run. That fits everything the #15185 dev reported (their script text is not on record), and the discipline already in os-dev.md :225–:227 is confirmed by measurement: the hash comparison caught both real non-restores and passed all 41 real restores, with no empty hash. AGENTS.md :52 / :369 owe no change. No text change, no PR; os-dev.md stays 403/403. Two measured facts left here for the next reader, ⛔ not carded (density edits on a file at its ceiling, no incident behind them): (1) exec replaces the shell image, so a trap armed before it never runs — never exec the child in an ablation script; (2) this harness reports the tool shell's own SIGSEGV as Exit code 1 and a child's as a job-control 「Segmentation fault」 line with rc 139 — the trap marker plus the hash comparison is the discriminator, not the exit code. Also noted: pnpm --filter X exec node … stays alive after SIGTERM to the pnpm process — kill the recorded grandchild PID. Labels: pm:dispatched stripped and the assignee cleared in this pass; state_reason: completed (the acceptance's own close condition).

---

Generated by Claude Code