test(server): retire duplicated resolveShell darwin fallback row

The darwin row asserted the same two-arm fallback ternary and the same
value as the retained linux row through the same production path; any
regression it could catch also fails the linux row. Deletion is proven by
a production mutation control (fallback arm changed to /bin/bash makes
the retained row fail at its assertion) with byte-exact restoration.
Adds the audit receipt in doc/plans.

doc/plans/2026-10-17-workspace-runtime-resolveshell-test-audit.md

@@ -0,0 +1,80 @@
+# workspace-runtime resolveShell duplicate-row retirement — 2026-10-17
+
+One redundant registered execution is retired from
+`server/src/__tests__/workspace-runtime.test.ts`. No production file
+changes. No execution-time or CI-time benefit is claimed.
+
+Discovery base: `5555817c2b18a1a5ebc3a3b01883c1b12b86df5a` (master head).
+Applied skill: installed test-audit, SKILL.md sha256
+`d2569031196778bebb7fd623d87b4379ed1a0d372d1ea004b0b3d330b352d1d2`.
+
+## Change and keeper
+
+| Candidate | Decision | Contract | Keeper | Evidence |
+| --- | --- | --- | --- | --- |
+| `falls back to /bin/sh on darwin when SHELL is unset` (resolveShell describe) | Delete | Non-win32 fallback returns `/bin/sh`. | `falls back to /bin/sh on non-Windows when SHELL is unset` (linux row) | `resolveShell()` computes the fallback from a single two-arm ternary, `process.platform === "win32" ? "sh" : "/bin/sh"`. darwin and linux both evaluate the same non-win32 arm and assert the same value through the same production path, so the darwin row cannot fail while the linux row passes. Inputs and assertions are otherwise identical (unset SHELL, mocked platform, fallback value). |
+
+Retained siblings in the same describe: the win32 row (only observation of
+the `"sh"` arm), the empty-string and whitespace-only rows (missing versus
+invalid input; whitespace-only additionally pins trim-before-falsy-check),
+and the missing-absolute-path row (only observation of the `existsSync`
+guard). The non-Windows/linux row keeps the non-win32 arm pinned after this
+change, verified by control below.
+
+## Validation
+
+Focused owner runs, `pnpm --filter @paperclipai/server exec vitest run
+-t "shell fallback" src/__tests__/workspace-runtime.test.ts` (vitest 5.0.3,
+Node 25.9.0, isolated checkout with `pnpm install --filter @paperclipai/server...`):
+
+1. Baseline (before edit): 9/9 passed.
+2. Candidate (darwin row deleted): 8/8 passed.
+3. Control: temporarily changed the production fallback arm to
+   `"/bin/bash"`. The retained linux row failed at its exact assertion
+   (`expected '/bin/bash' to be '/bin/sh'`), proving the retained row
+   carries the deleted row's failure sensitivity. The non-win32 arm's
+   mutation also breaks nothing else in the selected run.
+4. Production restored byte-exact (sha256
+   `335fd5332b4242ab0ff2a565323e27db48a69ddfb7bbd8d913e5148f79ff961b`
+   before and after), rerun: 8/8 passed.
+
+The full `workspace-runtime.test.ts` owner and the repo-wide
+typecheck/test/build suite were not run locally in this session; this
+container cannot complete the git-fixture cases inside their 15-second
+budgets (three unrelated reconciliation cases time out at 15,000 ms here
+before and after this change, and the production-internal 8-second git scan
+budget also fires), so those runs are left to PR CI. The change is a
+six-line deletion inside one describe; no production file, lockfile,
+workflow, or shard manifest is touched.
+
+## Deferred candidate (evidence, not applied)
+
+`keeps forward reconciliation fail-closed for an unrelated task branch`
+(line ~3491) repeats `keeps forward reconciliation fail-closed for
+same-content rewritten history` (line ~3461): identical git topology (each
+branch one commit ahead of main), identical assertion union through
+`expectPersistedBranchMismatchRejected` (verdict `diverged`, reason
+`expected branch and current HEAD differ`), and the differing fixture bytes
+(file names, commit messages) are never read by
+`inspectGitWorktreeBranchIncoherence`, which decides on cleanliness, branch
+existence, ancestry, and worktree registration only. The third sibling
+(`live branch is behind`) is retained: its topology makes the actual branch
+an ancestor in the reverse direction, so it uniquely guards the ancestry
+comparison's direction. Deletion of the unrelated-task row is deferred
+because the local environment cannot produce a passing baseline for these
+git-fixture cases (15-second per-test timeout); it needs validation on a
+host where the fixtures complete, or via CI evidence.
+
+## Other examined-and-retained areas
+
+- `native-runner-input-boundary.test.ts` alias: retained per the 2026-10-13
+  execution-wrapper receipt; still the only entry point for the Runner
+  contract suite in the root default run. Historical weight 204 ms.
+- Repo-wide duplicate-title and near-identical-body scans over the top-30
+  duration-weighted server suites: all other matches protect distinct
+  contracts (different function, input class, platform arm, or boundary) and
+  are retained.
+
+Test source changes: −6 test lines, zero production lines, zero docs lines
+outside this receipt. One registration removed per complete-suite
+invocation. No measured wall-time saving is claimed.

server/src/__tests__/workspace-runtime.test.ts

@@ -5627,12 +5627,6 @@ describe("resolveShell (shell fallback)", () => {
     expect(resolveShell()).toBe("sh");
   });
 
-  it("falls back to /bin/sh on darwin when SHELL is unset", () => {
-    delete process.env.SHELL;
-    Object.defineProperty(process, "platform", { value: "darwin" });
-    expect(resolveShell()).toBe("/bin/sh");
-  });
-
   it("treats empty SHELL as unset and uses platform fallback", () => {
     process.env.SHELL = "";
     Object.defineProperty(process, "platform", { value: "linux" });