mentor: classify an empty-output handler kill (rc=137/143/offline) as transient, not a die

The improve-handler branch classified a failure transient only when the
captured output matched is_transient_claude_signature or
_fetch_stderr_is_offline. An empty-output non-zero exit — a `claude -p` handler
SIGKILLed/OOM-killed (rc=137/143) or cut mid-call by a quota/network blip —
produces an EMPTY $capture that matches neither TEXT signature, so it fell
through to die (exit 1). That marks garden-mentor.service Failed and fires
self-heal-run.sh into a diagnosis that fails identically in the same outage —
the observed 30-min FATAL loop on endolinbot (2026-07-05 18:20/18:50/19:20,
bare "FATAL: improve handler failed" with no preceding $out diagnostic).

Capture the handler's exit code immediately into $rc (under set +e, mirroring
gardener.sh:376-381) so it survives the later out="$(...)" substitution, and add
an empty-capture-transient branch mirroring gardener.sh:679-687: when the
capture is empty and is_transient_empty_failure "$rc" is true, WARN + exit 0
(markers unadvanced, retry next tick) rather than die. Reuses the same common.sh
helper the gardener relies on, keeping the two handlers' transient-vs-real
classification aligned. Reserves the die->self-heal path for a non-empty or
non-transient real defect.

Adds a regression subtest (rc=137 empty-output kill -> exit 0, markers
unadvanced) alongside the existing transient/real cases.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: endolinbot

scripts/jobs/mentor.sh

@@ -96,10 +96,36 @@ rm -f "$digest"   # the blob now lives in $DIR's object DB; the temp file is spe
 #    the die (exit 1 → self-heal) path for a genuine, non-transient handler
 #    failure. Mirrors gardener.sh's transient-vs-real classification.
 capture="$(mktemp "${TMPDIR:-/tmp}/garden-mentor-capture.XXXXXX")"
-if "$GARDEN_MENTOR_HANDLER" "$sha" "$DIR" >"$capture" 2>&1; then
+# Capture the handler's exit code IMMEDIATELY into $rc. A bare `if
+# "$HANDLER" …; then` would work for the success arm, but the failure arm below
+# needs $rc to classify an EMPTY-output kill (rc=137/143 SIGKILL/OOM/SIGTERM, or
+# the offline rc) — and `$?` there would already be clobbered by the `out="$(…)"`
+# substitution. Run the handler as a plain statement under `set +e` (mirroring
+# gardener.sh:376-381) so a non-zero exit is captured into $rc rather than
+# tripping `set -e` before the classifier below runs.
+set +e
+"$GARDEN_MENTOR_HANDLER" "$sha" "$DIR" >"$capture" 2>&1
+rc=$?
+set -e
+if [ "$rc" -eq 0 ]; then
   for f in "${new[@]}"; do printf '%s\n' "${f#"$DIR"/}" >> "$SEEN"; done
   date -u +%FT%TZ > "$JSINCE"
   rm -f "$capture"
+elif [ ! -s "$capture" ] && is_transient_empty_failure "$rc"; then
+  # EMPTY capture + a signal/offline rc — a `claude -p` handler SIGKILLed/
+  # OOM-killed (rc=137/143) or cut mid-call by a quota/network blip that flushed
+  # nothing to $capture — matches neither is_transient_claude_signature nor
+  # _fetch_stderr_is_offline (both need signature TEXT), so without this branch it
+  # would fall through to `die` and fire self-heal-run.sh into a diagnosis that
+  # fails identically in the SAME outage (the observed 30-min FATAL loop on
+  # endolinbot, 2026-07-05 18:20/18:50/19:20, bare "FATAL: improve handler failed"
+  # with no preceding $out diagnostic → empty output). Classify it transient,
+  # mirroring gardener.sh's empty-capture branch (gardener.sh:679-687) via the
+  # SAME common.sh helper so the two handlers stay aligned: WARN + exit 0, leaving
+  # $SEEN/$JSINCE unadvanced so the next tick retries.
+  rm -f "$capture"
+  log "WARN: improve handler killed with empty output (rc=$rc); leaving markers, retrying next tick"
+  exit 0
 else
   out="$(tail -c 65536 "$capture" 2>/dev/null || true)"
   rm -f "$capture"

scripts/jobs/test/run-test.sh

@@ -916,6 +916,22 @@ seen_after="$(wc -l < "$SEENF" 2>/dev/null || echo 0)"
 rrc=0; env GARDEN_MENTOR_HANDLER="$TR/mentor-real.sh" "$JOBS/mentor.sh" >/dev/null 2>&1 || rrc=$?
 [ "$rrc" -ne 0 ] && ok "genuine handler defect → non-zero exit (self-heal path)" \
   || bad "real defect did not die (rc=$rrc)"
+# An EMPTY-output SIGKILL/OOM (rc=137) — a `claude -p` handler killed mid-call
+# leaving nothing in $capture — matches no transient SIGNATURE (the capture is
+# empty), so before the empty-capture-transient branch it fell through to `die`
+# and fired self-heal into the same outage (the 2026-07-05 30-min FATAL loop on
+# endolinbot). It must be absorbed: WARN + exit 0, markers unadvanced.
+cat > "$TR/mentor-emptykill.sh" <<'EOF'
+#!/bin/bash
+exit 137
+EOF
+chmod +x "$TR/mentor-emptykill.sh"
+seen_before_k="$(wc -l < "$SEENF" 2>/dev/null || echo 0)"
+krc=0; env GARDEN_MENTOR_HANDLER="$TR/mentor-emptykill.sh" "$JOBS/mentor.sh" >/dev/null 2>&1 || krc=$?
+seen_after_k="$(wc -l < "$SEENF" 2>/dev/null || echo 0)"
+{ [ "$krc" -eq 0 ] && [ "$seen_after_k" -eq "$seen_before_k" ]; } \
+  && ok "empty-output kill (rc=137) → exit 0, markers unadvanced (retry next tick)" \
+  || bad "empty-output kill not absorbed (rc=$krc seen $seen_before_k→$seen_after_k)"
 
 # ============================================================================
 hr; echo "SUBTEST 12 — CURSORS: durable poll position survives a restart"; hr