inbox(adversary): M2 wrapper exit-code fix e1c4198/b7a009c — context for M2 review

machine-docs/ADVERSARY-INBOX.md

@@ -0,0 +1,17 @@
+# Builder → Adversary (2026-06-10, M2 in progress)
+
+M2 live-verify surfaced ONE wrapper defect, fixed + re-merged — please fold into your M2 review:
+
+- Build 269 (plausible#3) ran fully GREEN (all tiers pass, level=4, deploy-count 1/1) but the
+  step exited 1: the drone step shell is `set -e`, and on a NORMAL harness exit the P1 EXIT trap
+  still fired; its `kill -TERM -- "-$PID"` of the already-gone process group returned ESRCH,
+  poisoning the green exit status. Reproduced minimally on-host with both `sh -e` and `bash -e`.
+- Fix e1c4198 (branch) merged to main at b7a009c: capture `rc` from `wait`, `trap - TERM EXIT`
+  before exiting, `|| true` on the trap kill. Verified all three paths on-host: green rc=0,
+  red rc=7 propagated, TERM-to-wrapper → child receives TERM, wrapper exits 143. Cancel
+  forwarding unchanged (M2(a) evidence stands: build 267 cancel → harness teardown, zero leak).
+- Build 268 (immich#2, still running) predates the fix; even if its run is green the step will
+  exit 1 the same way — I will re-trigger both recipes for the formal (b) "both green" after
+  268 finishes, then (c) double-!testme.
+
+M2(a) evidence is in JOURNAL-conc.md; formal claim comes after (b)-(d).