fix(issue-36): the legacy shell loop and lib.sh's submit helpers pass prompts by file

The two remaining exec points that carried a prompt as one argv string
(capped at 131,072 bytes):

- run_loop.sh (MAM_LOOP_PY=0): delegate_job_safe, which all eleven shell
  delegations go through, turns `--prompt <text>` into `--prompt-file` under
  the control root's .mam/ and removes the file once the wrapper returns. Its
  failure lines go to stderr: callers capture stdout, and under set -e a
  failed submit ends the loop at that line with the wrapper's code, so the
  cause was being swallowed.
- lib.sh delegate_submit_job and its legacy twin (create_session's onboarding
  and --submit-job): the prompt is written under .mam/ and handed on as
  --prompt-file; lib_py.delegation.cli submit accepts --prompt-file and
  forwards it to the registry. --prompt keeps working everywhere.

S6/S6b push a 140,000-byte prompt through the CLI and both helpers; S7 runs
the real run_loop.sh with a 140,000-byte plan and a 150,000-byte diff; S7b
fixes a nonzero exit when the implementation or compliance job cannot be
registered. All six fail on 14d11bf.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_issue36_prompt_transport.py

@@ -303,19 +303,22 @@ def test_s4b_an_exec_error_on_the_busy_retry_is_reported_not_raised(runner, tmp_
 # ---------------------------------------------------------------------------
 
 FAKE_AGENT = r"""
-import json, sys
+import json, os, sys
 from pathlib import Path
 args = sys.argv[3:]  # argv[1] = kind to refuse, argv[2] = "submit"
 opts = dict(zip(args[::2], args[1::2]))
 prompt = Path(opts["--prompt-file"]).read_text(encoding="utf-8")
 refuse = sys.argv[1]
-jobs = Path(opts["--registry-dir"])
+jobs = Path(opts.get("--registry-dir", ".mam/jobs"))  # the shell loop passes none
 jobs.mkdir(parents=True, exist_ok=True)
 kind = ("comply" if "재심 결과 기각" in prompt else
         "adjudication" if "re-adjudication" in prompt else
         "arbitration" if "재정(arbitration)" in prompt else
         "correction" if "[이의제기 채널]" in prompt else
         opts["--role"])
+review = "Self-Review" if "Self-Review" in prompt else kind
+with open(".mam/calls.log", "a", encoding="utf-8") as log:  # what reached the agent, in bytes
+    log.write("%s\t%d\n" % (review, len(prompt.encode("utf-8"))))
 if kind == refuse:
     print(kind + " registration refused", file=sys.stderr)
     sys.exit(2)
@@ -328,13 +331,16 @@ elif kind == "correction":
 elif kind == "Reviewer" and "Self-Review" in prompt:
     report = "ok\n\n[VERDICT: PASS]\n"
 elif kind == "Reviewer":  # the first cross review objects, every later one passes
-    counter = Path.cwd() / "review-count"
+    counter = Path(".mam/review-count")
     n = int(counter.read_text()) + 1 if counter.exists() else 1
     counter.write_text(str(n))
     report = "line 3 is wrong\n\n[VERDICT: NOT PASS]\n" if n == 1 else "ok\n\n[VERDICT: PASS]\n"
 elif kind == "Planner":
-    report = "# plan\n\ndo it\n"
+    report = "# plan\n\n" + "p" * int(os.environ.get("FAKE_PLAN_BYTES", "5")) + "\n"
 else:
+    grow = int(os.environ.get("FAKE_GROW_BYTES", "0"))
+    if grow and kind == "Worker":  # the implementation: one big new file in the tree
+        Path("big.txt").write_text(("g" * 63 + "\n") * (grow // 64), encoding="utf-8")
     report = "done\n"
 jid = "j%d" % len(list(jobs.glob("*.json")))
 (jobs / (jid + ".json")).write_text(json.dumps({"job_id": jid, "status": "completed"}))
@@ -409,3 +415,125 @@ def test_s5_a_diff_in_the_former_blind_spot_is_delivered_whole(tmp_path):
 
     # the collector cap itself is unchanged: over it, the diff is still truncated and marked
     assert TRUNCATED.encode() in _collect(repo, base, head, {"MAM_DIFF_MAX_BYTES": "100000"})
+
+
+# ---------------------------------------------------------------------------
+# S6 - lib.sh's submit helper (create_session's onboarding and --submit-job)
+# and the delegation CLI behind it take a prompt over the cap by file
+# ---------------------------------------------------------------------------
+
+LIB_SH = SKILLS / "lib.sh"
+
+
+def _helper_env(root: Path, extra=None) -> dict:
+    return _env(root, extra={"MAM_JOBS_DIR": root / "reg", **(extra or {})})
+
+
+def test_s6_delegation_cli_submit_takes_a_prompt_file(tmp_path):
+    text = _big_text()
+    pf = tmp_path / "p.md"
+    pf.write_text(text, encoding="utf-8")
+    res = subprocess.run([sys.executable, "-m", "lib_py.delegation.cli", "submit", "--prompt-file", str(pf),
+                          "--agent", "claude-code", "--agent-session", "herdr:x"],
+                         capture_output=True, text=True, env=_helper_env(tmp_path), cwd=str(tmp_path), timeout=60)
+    assert res.returncode == 0, res.stderr
+    jid = res.stdout.strip().splitlines()[-1]
+    assert json.loads((tmp_path / "reg" / f"{jid}.json").read_text(encoding="utf-8"))["prompt"] == text
+
+    both = subprocess.run([sys.executable, "-m", "lib_py.delegation.cli", "submit", "--prompt", "x",
+                           "--prompt-file", str(pf)],
+                          capture_output=True, text=True, env=_helper_env(tmp_path), cwd=str(tmp_path), timeout=60)
+    assert both.returncode == 2 and "not allowed with argument" in both.stderr
+
+
+@pytest.mark.parametrize("delegation_py", ["1", "0"])  # the Python helper and its legacy twin
+def test_s6b_delegate_submit_job_passes_a_prompt_over_the_cap(tmp_path, delegation_py):
+    text = _big_text()
+    pf = tmp_path / "p.md"
+    pf.write_text(text, encoding="utf-8")
+    # The prompt reaches the shell function as a bash argument (no exec, no cap),
+    # exactly as create_session.sh hands it over.
+    res = subprocess.run(["bash", "-c", 'source "$1" && delegate_submit_job "$(cat "$2")" claude-code herdr:x',
+                          "_", str(LIB_SH), str(pf)],
+                         capture_output=True, text=True, cwd=str(tmp_path), timeout=60,
+                         env=_helper_env(tmp_path, {"MAM_DELEGATION_PY": delegation_py}))
+    assert res.returncode == 0, res.stderr
+    jid = res.stdout.strip().splitlines()[-1]
+    assert json.loads((tmp_path / "reg" / f"{jid}.json").read_text(encoding="utf-8"))["prompt"] == text
+    assert sorted(p.name for p in (tmp_path / ".mam").glob("prompt-*")) == []
+
+
+# ---------------------------------------------------------------------------
+# S7 - the legacy shell loop (MAM_LOOP_PY=0): the real run_loop.sh hands every
+# prompt over by file, and a registration failure never ends it with rc 0.
+# run_loop.sh always runs the wrapper next to itself, so the skills tree is
+# copied under tmp_path (as the mam_sandbox fixture does) and only that copy's
+# wrapper is replaced by the agent simulator.
+# ---------------------------------------------------------------------------
+
+def _shell_ctl(tmp_path: Path, refuse: str) -> Path:
+    import shutil
+    ctl = tmp_path / "ctl"
+    shutil.copytree(SKILLS, ctl / ".agents" / "skills", ignore=shutil.ignore_patterns("__pycache__"))
+    (ctl / ".gitignore").write_text(".mam/\n.agents/reports/\n")
+    agent = ctl / "fake-agent.py"
+    agent.write_text(FAKE_AGENT, encoding="utf-8")
+    _fake_wrapper(ctl, f'exec "{sys.executable}" "{agent}" {refuse} "$@"\n')
+    _repo(ctl)  # the base holds the copied tree, so the diff is only what the "Creator" writes
+    _git(ctl, "add", "-A")
+    _git(ctl, "commit", "-q", "-m", "skills")
+    (ctl / ".mam").mkdir()
+    (ctl / ".mam" / "agent-sessions.yaml").write_text(
+        "herdr_sessions:\n"
+        "- {name: c, agent: claude, role: creator, status: running}\n"
+        "- {name: r, agent: claude, role: reviewer, status: running}\n"
+        "- {name: p, agent: claude, role: planner, status: running}\n", encoding="utf-8")
+    return ctl
+
+
+def _run_shell_loop(ctl: Path, argv, extra=None) -> subprocess.CompletedProcess:
+    env = _env(ctl, extra={
+        "MAM_LOOP_PY": "0", "MAM_LOOP_NO_FREEZE": "1",  # no /tmp snapshot of the skills
+        "MAM_LOOP_MARKER": ctl / ".mam" / "loop-marker",
+        "AGENT_SESSIONS_YAML": ctl / ".mam" / "agent-sessions.yaml",
+        "WORKSPACE_ROOT": ctl, **(extra or {})},
+        drop=("MAM_LOOP_WORKTREE", "MAM_LOOP_BASE", "MAM_VERSION", "MAM_STATE_JSON"))
+    run_loop = ctl / ".agents" / "skills" / "multi-agent-mux-loop" / "scripts" / "run_loop.sh"
+    return subprocess.run(["bash", str(run_loop), "--creator", "c", "--task", "t36", "--reviewer", "r", *argv],
+                          capture_output=True, text=True, env=env, cwd=str(ctl), timeout=300)
+
+
+def _calls(ctl: Path) -> list:
+    return [tuple(line.split("\t")) for line in (ctl / ".mam" / "calls.log").read_text().splitlines()]
+
+
+def test_s7_shell_loop_hands_prompts_over_the_cap_to_the_wrapper(tmp_path):
+    ctl = _shell_ctl(tmp_path, "none")
+    # a 140,000-byte plan makes the execution prompt, and a 150,000-byte new
+    # file makes the collected diff (so the review prompt), exceed the cap
+    res = _run_shell_loop(ctl, ["--plan", "--plan-talk", "0", "--max-loop", "2"],
+                          {"FAKE_PLAN_BYTES": BIG, "FAKE_GROW_BYTES": 150_000})
+    assert res.returncode == 0, res.stdout + res.stderr
+    assert "Argument list too long" not in res.stderr
+    sizes = {}
+    for kind, n in _calls(ctl):
+        sizes.setdefault(kind, []).append(int(n))
+    assert max(sizes["Worker"]) > MAX_ARG_STRLEN      # execution prompt with the plan
+    assert max(sizes["Reviewer"]) > MAX_ARG_STRLEN    # cross review with the diff
+    assert sorted(p.name for p in (ctl / ".mam").glob("prompt-*")) == []
+
+
+@pytest.mark.parametrize("refuse, argv", [
+    ("Worker", ["--max-loop", "1"]),   # the implementation job
+    ("comply", ["--max-loop", "2"]),   # the compliance job after an overruled rebuttal; round 2 would pass
+])
+def test_s7b_shell_loop_ends_nonzero_when_a_job_cannot_be_registered(tmp_path, refuse, argv):
+    """The shell loop runs under set -e: a failed submit inside $(...) ends it
+    at that line with the wrapper's code, so the cause must reach stderr."""
+    ctl = _shell_ctl(tmp_path, refuse)
+    res = _run_shell_loop(ctl, argv)
+    out = res.stdout + res.stderr
+    assert res.returncode == 2, out
+    assert f"{refuse} registration refused" in res.stderr
+    assert "delegate_job_safe failed (exit 2)" in res.stderr
+    assert "100% PASS" not in out