claude/.claude/tasks/contracts/2026-09-29-effort-pins-low-1644.md

CONTRACT — effort-pins-low

• date: 2026-09-29 | flow: bugfix by hand (bugfix/* off develop) | branch: bugfix/effort-pins-low
• status: active

REQUEST (verbatim — IMMUTABLE)

fais les cinq low restants [the five LOW parked in TODO after the 2026-09-29 security re-gate of BDR-108: no signal trap on the mktemp sibling; T13 never reaches the post-write re-read branch; T14 fails under root; WORK="$(mktemp -d)" unguarded in the suite; install-plugins.sh err() uses echo -e on the rejected map line]

CLARIFICATIONS

• Pass A silent autofill (bugfix). Pass B: nothing visible or public opens; messages may change wording.
• LOW 1 (signal): _effort_pin_write installs an INT/TERM trap that removes $tmp and exits 130 for the duration of the cp/awk/mv chain, then restores the previous INT/TERM traps on every return path. NEVER an EXIT trap: install-plugins.sh runs a guarded-config EXIT trap the helper must not replace.
• LOW 2 (T13): the post-write re-read branch is unreachable through the file system once _effort_pin_closed has passed (the awk always inserts at the closing ---); it stays as a post-condition of the awk, its message drops the misleading "(CRLF …)" hint, and a unit test reaches it by stubbing _effort_pin_write to a no-op inside a subshell that sourced the lib. T13 keeps proving a CRLF file is rejected (renamed to what it proves).
• LOW 3 (root): T14 prints a visible SKIP and counts nothing when id -u is 0 (chmod bits are ignored as root).
• LOW 4: WORK="$(mktemp -d)" || exit 1 in the suite.
• LOW 5: the helper prints the rejected map line through printf '%q' so a caller's echo -e err() cannot interpret backslash escapes from map content; install-plugins.sh err() itself is untouched (other messages rely on -e).

ACCEPTANCE CRITERIA

1. Signal safety: a SIGINT delivered during the awk write leaves no SKILL.md.* sibling and the process exits 130; on a normal return the previous INT/TERM trap state is restored and no EXIT trap was set. Case T15-sigint-removes-temp + T15b-traps-restored. CHECK: out=$(make test suite=lib/tests/effort-pins.test.sh 2>&1); echo "$out" | grep -q 'effort-pins: [0-9]* pass, 0 fail' || { echo "$out" | grep FAIL; exit 1; }; for k in T15-sigint-removes-temp T15b-traps-restored; do echo "$out" | grep -q "PASS $k" || { echo "missing PASS $k"; exit 1; }; done; ! grep -qE 'trap [^#]*EXIT' lib/effort-pins.sh && echo SIGNAL_OK EXPECT: SIGNAL_OK EVIDENCE: MET exit=0 marker-found :: SIGNAL_OK
2. Re-read branch reached: a test stubs _effort_pin_write to a no-op and asserts _effort_pin_apply_one returns 1 with an err line naming the file; the message no longer mentions CRLF; T13 is renamed T13-crlf-file-rejected. CHECK: out=$(make test suite=lib/tests/effort-pins.test.sh 2>&1); for k in T13-crlf-file-rejected T13b-reread-mismatch-fails; do echo "$out" | grep -q "PASS $k" || { echo "missing PASS $k"; exit 1; }; done; ! grep -q 'CRLF or malformed' lib/effort-pins.sh && echo REREAD_OK EXPECT: REREAD_OK EVIDENCE: MET exit=0 marker-found :: REREAD_OK
3. Suite hardening: WORK guarded, T14 skips visibly under root (the skip path is exercised by faking id -u through a function override in a subshell run of the T14 block, or by an explicit EFFORT_PINS_TEST_FAKE_ROOT=1 hook read by the suite). CHECK: grep -q 'WORK="$(mktemp -d)" || exit 1' lib/tests/effort-pins.test.sh && out=$(EFFORT_PINS_TEST_FAKE_ROOT=1 make test suite=lib/tests/effort-pins.test.sh 2>&1) && echo "$out" | grep -q 'SKIP T14' && echo "$out" | grep -q 'effort-pins: [0-9]* pass, 0 fail' && echo SUITE_OK EXPECT: SUITE_OK EVIDENCE: MET exit=0 marker-found :: SUITE_OK
4. Escape-safe rejection message: a map line bad\tname high (literal backslash-t) is rejected and the err text carries the shell-quoted form (bad\\tname), so an echo -e caller prints it verbatim. Case T16-rejected-line-quoted. CHECK: out=$(make test suite=lib/tests/effort-pins.test.sh 2>&1); echo "$out" | grep -q 'PASS T16-rejected-line-quoted' && grep -q "printf '%q'" lib/effort-pins.sh && echo QUOTE_OK EXPECT: QUOTE_OK EVIDENCE: MET exit=0 marker-found :: QUOTE_OK
5. Everything else green: shellcheck on the helper and suite, effort-routing census, live tree idempotent (0 applied, 0 failed), doctrine-citers. CHECK: shellcheck lib/effort-pins.sh lib/tests/effort-pins.test.sh && make test suite=lib/tests/effort-routing.test.sh 2>&1 | grep -q 'census: [0-9]* pass, 0 fail' && bash lib/effort-pins.sh 2>&1 | grep -q ' 0 applied, [0-9]* already at level, 0 failed' && make test suite=lib/tests/no-vacuous-locks.test.sh >/dev/null 2>&1 && echo STABLE_OK EXPECT: STABLE_OK EVIDENCE: MET exit=0 marker-found :: STABLE_OK

FILE SCOPE

• lib/effort-pins.sh, lib/tests/effort-pins.test.sh
• .claude/tasks/TODO.md (parked LOW line ticked), CHANGELOG.md (Fixed line), this contract