From af264b84846029171f3242b0b0efc34ccacccf08 Mon Sep 17 00:00:00 2001
From: Garry Tan <garrytan@gmail.com>
Date: Sat, 29 Aug 2026 05:42:57 +0000
Subject: [PATCH] fix(sandbox-doctor): loud on git-shim patch drift; document
 the retry-contract override
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- The /conductor/bin/git patch was a silent no-op if the shim's bytes drift
  from the exact pattern — now warns that laundering is NOT fixed.
- The bashrc block documents why GSTACK_FREE_RETRY_FLAKY=1 deliberately
  overrides the runner's default-OFF contract on this sandbox, and how to
  undo it.
- Test pins the guarded shm form (missing /dev/shm must not abort set -eu).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 scripts/sandbox-doctor.sh         | 11 +++++++++++
 test/sandbox-doctor-shell.test.ts |  1 +
 2 files changed, 12 insertions(+)

diff --git a/scripts/sandbox-doctor.sh b/scripts/sandbox-doctor.sh
index 846dae64f..f2f1f1f83 100755
--- a/scripts/sandbox-doctor.sh
+++ b/scripts/sandbox-doctor.sh
@@ -73,6 +73,12 @@ new = 'exit 0\nelse\n\tstatus=$?\nfi'
 if old in src:
     open('/conductor/bin/git', 'w').write(src.replace(old, new))
     print('sandbox-doctor: patched /conductor/bin/git exit-code laundering')
+elif 'else\n\tstatus=$?\nfi' not in src:
+    # Loud on format drift: the outer guard matched but the byte-exact patch
+    # pattern did not — silence here would read as "fixed" while phantom git
+    # successes persist.
+    print('sandbox-doctor: WARNING /conductor/bin/git matched the laundering guard '
+          'but not the patch pattern — exit-code laundering NOT fixed; patch it by hand')
 EOF
 fi
 
@@ -81,6 +87,11 @@ if ! grep -q 'GSTACK sandbox test env' "$HOME/.bashrc" 2>/dev/null; then
   cat >> "$HOME/.bashrc" <<'EOF'
 
 # GSTACK sandbox test env (written by scripts/sandbox-doctor.sh)
+# NOTE: GSTACK_FREE_RETRY_FLAKY=1 deliberately overrides the runner's
+# default-OFF contract ("dev boxes should see flakes, not absorb them") —
+# this sandbox's seccomp supervisor injects spurious one-off failures under
+# load, which the serial retry absorbs while still failing on reproducible
+# breakage. Delete this block from ~/.bashrc to restore the default.
 export TMPDIR="$HOME/tmp"
 export GSTACK_FREE_JOBS=2
 export GSTACK_FREE_RETRY_FLAKY=1
diff --git a/test/sandbox-doctor-shell.test.ts b/test/sandbox-doctor-shell.test.ts
index ee350a93f..39d4193da 100644
--- a/test/sandbox-doctor-shell.test.ts
+++ b/test/sandbox-doctor-shell.test.ts
@@ -28,5 +28,6 @@ describe('sandbox-doctor.sh', () => {
     expect(src).toContain('git config --global user.name >/dev/null 2>&1 ||'); // never clobber identity
     expect(src).toContain("grep -q 'GSTACK sandbox test env'");      // bashrc seeded once
     expect(src).toContain('command -v Xvfb >/dev/null 2>&1 ||');     // install only if absent
+    expect(src).toContain('[ "${shm_kb:-0}" -gt 0 ]');               // missing /dev/shm: skip, not a set -eu abort
   });
 });