@@ -425,6 +425,31 @@ opens a fresh run. Upstream's fatal exit wedges a long-lived session —
 upstream; workers keep it. **Disposition:** Re-carryable — sits at the
 doom-loop fatal break in the main loop.
 
+## reactor-ts-doom-loop-trivial-shell-churn
+
+`reactor.ts` — Doom-loop batch signature normalizes trivial `run_shell`
+no-ops. `toolBatchSignature` maps each call through `canonicalCallIdentity`:
+a bare `echo`/`true` (or `/bin`/`/usr/bin` of those) with no shell
+metacharacters (chaining, piping, redirection, substitution, grouping,
+comments, newlines) collapses to `{ name: "run_shell", trivialNoopShell: true }`,
+so `echo churn-1`, `echo churn-2`, and `true whatever` count as the same
+consecutive loop instead of evading the guard via fresh payload strings.
+The marker is disjoint from any legal `(name, arguments)` pair — it is
+not a fake command string — so a real `trivial-noop-shell` invocation
+cannot trip with echo churn. Relative paths (`./true`, `scripts/echo`)
+are not the closed set and keep their exact signatures. Extra fields
+(`cwd`, `timeout`) drop from the marker and collapse among no-ops only.
+Anything that may do real work (`echo hi > file`, `npm test`, distinct
+commands) keeps its exact `(name, arguments)` signature and never
+collapses.
+
+**Disposition:** Promotion candidate. Guard-evasion fix — upstream's exact
+`(name, arguments)` identity lets a runaway model loop forever on
+ever-varying no-op shells. **Removal path:** Upstream PR normalizing
+trivial-shell signatures in the doom-loop accounting.
+**Re-carry:** sits on `toolBatchSignature`; re-verify the normalization
+after upstream changes to batch signatures or repeat counting.
+
 ## sse-ts-max-line-length
 
 `sse.ts` — `MAX_LINE_LENGTH` (16 MiB) caps the unterminated SSE line buffer
 
@@ -1399,6 +1399,239 @@ describe("createReactor — doom-loop detection", () => {
     expect(getEvent(events, "message.run.ended").data.status).toBe("completed");
   });
 
+  test("trips on trivial run_shell churn with fresh echo strings", async () => {
+    // A runaway model evading the guard by varying a no-op payload: every
+    // turn runs `echo` with a brand-new string, so argument-level identity
+    // never repeats. Each turn is still the same trivial shell no-op, so the
+    // default threshold of 3 must trip.
+    const { reactor, events, waitFor } = createTestReactor({
+      director: createBatchLoopDirector((turn) =>
+        turn < 8
+          ? [
+              {
+                id: `c${turn}`,
+                name: "run_shell",
+                arguments: { command: `echo churn-${turn}` },
+              },
+            ]
+          : null,
+      ),
+    });
+
+    reactor.start();
+    reactor.deliver(makeInboundMessage());
+    await waitFor("reactor.done");
+
+    const error = getEvent(events, "reactor.error");
+    expect(error.data.fatal).toBe(true);
+    expect(error.data.error).toContain("run_shell");
+    expect(getEvent(events, "message.run.ended").data.error?.kind).toBe(
+      "doom_loop",
+    );
+    expect(events.filter((e) => e.type === "tool.start").length).toBe(3);
+  });
+
+  test("collapses echo churn even when cwd and timeout differ", async () => {
+    // Extra fields drop from the no-op marker so they collapse among no-ops,
+    // but the marker has no `arguments` key so it cannot share identity with
+    // a real run_shell call that happens to carry the same cwd/timeout.
+    const { reactor, events, waitFor } = createTestReactor({
+      director: createBatchLoopDirector((turn) =>
+        turn < 8
+          ? [
+              {
+                id: `c${turn}`,
+                name: "run_shell",
+                arguments: {
+                  command: `echo churn-${turn}`,
+                  cwd: `/tmp/cwd-${turn}`,
+                  timeout: 1000 + turn,
+                },
+              },
+            ]
+          : null,
+      ),
+    });
+
+    reactor.start();
+    reactor.deliver(makeInboundMessage());
+    await waitFor("reactor.done");
+
+    expect(getEvent(events, "reactor.error").data.fatal).toBe(true);
+    expect(getEvent(events, "message.run.ended").data.error?.kind).toBe(
+      "doom_loop",
+    );
+    expect(events.filter((e) => e.type === "tool.start").length).toBe(3);
+  });
+
+  test("trips on mixed echo/true trivial churn", async () => {
+    // Alternating between the two no-op programs with fresh arguments must
+    // count as the same loop, not as distinct work.
+    const commands = [
+      "echo alpha",
+      "true alpha",
+      "echo bravo",
+      "true bravo",
+      "echo charlie",
+      "true charlie",
+      "echo delta",
+      "true delta",
+    ];
+    const { reactor, events, waitFor } = createTestReactor({
+      director: createBatchLoopDirector((turn) => {
+        const command = commands[turn];
+        return command === undefined
+          ? null
+          : [{ id: `c${turn}`, name: "run_shell", arguments: { command } }];
+      }),
+    });
+
+    reactor.start();
+    reactor.deliver(makeInboundMessage());
+    await waitFor("reactor.done");
+
+    expect(getEvent(events, "reactor.error").data.fatal).toBe(true);
+    expect(getEvent(events, "message.run.ended").data.error?.kind).toBe(
+      "doom_loop",
+    );
+    expect(events.filter((e) => e.type === "tool.start").length).toBe(3);
+  });
+
+  test("does not trip on distinct legitimate shell work", async () => {
+    // Different real commands are different turns: a changing command string
+    // here is genuine work, not no-op churn, so five distinct commands must
+    // run to completion.
+    const commands = [
+      "git status",
+      "npm test",
+      "git diff --stat",
+      "npm run build",
+      "git log --oneline -3",
+    ];
+    const { reactor, events, waitFor } = createTestReactor({
+      director: createBatchLoopDirector((turn) => {
+        const command = commands[turn];
+        return command === undefined
+          ? null
+          : [{ id: `c${turn}`, name: "run_shell", arguments: { command } }];
+      }),
+    });
+
+    reactor.start();
+    reactor.deliver(makeInboundMessage());
+    await waitFor("reactor.done");
+
+    expect(events.some((e) => e.type === "reactor.error")).toBe(false);
+    expect(getEvent(events, "message.run.ended").data.status).toBe("completed");
+    expect(events.filter((e) => e.type === "tool.start").length).toBe(5);
+  });
+
+  test("does not collapse echo with redirection into trivial churn", async () => {
+    // `echo payload > file` writes a file: a side effect, not a no-op. Fresh
+    // redirect targets must keep distinct signatures so real file writes are
+    // never mistaken for churn.
+    const { reactor, events, waitFor } = createTestReactor({
+      director: createBatchLoopDirector((turn) =>
+        turn < 5
+          ? [
+              {
+                id: `c${turn}`,
+                name: "run_shell",
+                arguments: { command: `echo payload-${turn} > out-${turn}.txt` },
+              },
+            ]
+          : null,
+      ),
+    });
+
+    reactor.start();
+    reactor.deliver(makeInboundMessage());
+    await waitFor("reactor.done");
+
+    expect(events.some((e) => e.type === "reactor.error")).toBe(false);
+    expect(getEvent(events, "message.run.ended").data.status).toBe("completed");
+    expect(events.filter((e) => e.type === "tool.start").length).toBe(5);
+  });
+
+  test("does not collapse a real trivial-noop-shell command into echo churn", async () => {
+    // The no-op marker must be disjoint from any legal command string. If it
+    // reused `trivial-noop-shell` as a command, two echo no-ops plus one real
+    // `trivial-noop-shell` would trip the default threshold of 3.
+    const commands = [
+      "echo a",
+      "echo b",
+      "trivial-noop-shell",
+      "echo c",
+      "echo d",
+    ];
+    const { reactor, events, waitFor } = createTestReactor({
+      director: createBatchLoopDirector((turn) => {
+        const command = commands[turn];
+        return command === undefined
+          ? null
+          : [{ id: `c${turn}`, name: "run_shell", arguments: { command } }];
+      }),
+    });
+
+    reactor.start();
+    reactor.deliver(makeInboundMessage());
+    await waitFor("reactor.done");
+
+    expect(events.some((e) => e.type === "reactor.error")).toBe(false);
+    expect(getEvent(events, "message.run.ended").data.status).toBe("completed");
+    expect(events.filter((e) => e.type === "tool.start").length).toBe(5);
+  });
+
+  test("does not collapse relative-path true into trivial churn", async () => {
+    // Exact program tokens only: `./true` is not `true`. Basename matching
+    // would collapse these five payloads and trip at the default threshold.
+    const { reactor, events, waitFor } = createTestReactor({
+      director: createBatchLoopDirector((turn) =>
+        turn < 5
+          ? [
+              {
+                id: `c${turn}`,
+                name: "run_shell",
+                arguments: { command: `./true --fix-${turn}` },
+              },
+            ]
+          : null,
+      ),
+    });
+
+    reactor.start();
+    reactor.deliver(makeInboundMessage());
+    await waitFor("reactor.done");
+
+    expect(events.some((e) => e.type === "reactor.error")).toBe(false);
+    expect(getEvent(events, "message.run.ended").data.status).toBe("completed");
+    expect(events.filter((e) => e.type === "tool.start").length).toBe(5);
+  });
+
+  test("does not collapse relative-path echo into trivial churn", async () => {
+    const { reactor, events, waitFor } = createTestReactor({
+      director: createBatchLoopDirector((turn) =>
+        turn < 5
+          ? [
+              {
+                id: `c${turn}`,
+                name: "run_shell",
+                arguments: { command: `scripts/echo payload-${turn}` },
+              },
+            ]
+          : null,
+      ),
+    });
+
+    reactor.start();
+    reactor.deliver(makeInboundMessage());
+    await waitFor("reactor.done");
+
+    expect(events.some((e) => e.type === "reactor.error")).toBe(false);
+    expect(getEvent(events, "message.run.ended").data.status).toBe("completed");
+    expect(events.filter((e) => e.type === "tool.start").length).toBe(5);
+  });
+
   test("treats key-reordered arguments as identical", async () => {
     // Same logical arguments, keys emitted in different orders. Canonical
     // serialization must collapse them to one signature, so three such turns
 
@@ -215,16 +215,74 @@ function resolveDoomLoopThreshold(
  * differs on every request); sorting makes a parallel batch match regardless
  * of the order the model emitted its calls. Two turns share a signature when
  * they run the same multiset of `(name, arguments)` pairs.
+ *
+ * Trivial `run_shell` no-ops (`echo`/`true` with fresh strings) normalize to
+ * one shared identity — see `isTrivialNoopShellCommand`. Without that, a
+ * runaway model evades the guard by varying a payload that does no work.
+ * The marker is `{ name: "run_shell", trivialNoopShell: true }`, disjoint
+ * from any legal `(name, arguments)` pair, so a real command string cannot
+ * collide with the collapsed identity.
+ *
+ * Locally patched — see vendor/intx-inference/PATCHES.md#reactor-ts-doom-loop-trivial-shell-churn
  */
 function toolBatchSignature(calls: ToolCall[]): string {
   return calls
     .map((call) =>
-      canonicalJsonStringify({ name: call.name, arguments: call.arguments }),
+      canonicalJsonStringify(canonicalCallIdentity(call)),
     )
     .sort()
     .join("\n");
 }
 
+/**
+ * Shared signature identity for one tool call. Everything but a trivial
+ * `run_shell` no-op keeps its exact `(name, arguments)` pair; a trivial
+ * no-op collapses to a constant marker so `echo churn-1`, `echo churn-2`,
+ * and `true whatever` all count as the same loop. Extra fields such as
+ * `cwd`/`timeout` ride the marker (dropped) so they collapse among no-ops
+ * only — they cannot share identity with a real call, which still carries
+ * `arguments`.
+ */
+function canonicalCallIdentity(call: ToolCall): unknown {
+  if (
+    call.name === "run_shell" &&
+    isTrivialNoopShellCommand(call.arguments["command"])
+  ) {
+    return { name: "run_shell", trivialNoopShell: true };
+  }
+  return { name: call.name, arguments: call.arguments };
+}
+
+const TRIVIAL_NOOP_SHELL_PROGRAMS = new Set([
+  "echo",
+  "true",
+  "/bin/echo",
+  "/usr/bin/echo",
+  "/bin/true",
+  "/usr/bin/true",
+]);
+
+/**
+ * Whether a `run_shell` command value is a side-effect-free no-op whose
+ * arguments are churn, not work: a bare `echo`/`true` (or their `/bin` /
+ * `/usr/bin` paths) with no chaining, redirection, substitution, or comment
+ * operators. Relative paths (`./true`, `scripts/echo`) are not the closed
+ * set — they may be real scripts. Anything with shell metacharacters
+ * (`echo hi > file`, `echo a && test`) may do real work, so it keeps its
+ * exact signature and never collapses.
+ */
+function isTrivialNoopShellCommand(command: unknown): boolean {
+  if (typeof command !== "string") return false;
+  const trimmed = command.trim();
+  if (trimmed.length === 0) return false;
+  // Chaining, piping, redirection, substitution, grouping, comments, and
+  // newlines all mark a command that can do more than print-and-exit.
+  if (/[;&|><`$(){}#\n\r]/.test(trimmed)) return false;
+  const firstToken = trimmed.split(/\s+/, 1)[0] ?? "";
+  const unquoted = firstToken.replace(/^["']|["']$/g, "");
+  return TRIVIAL_NOOP_SHELL_PROGRAMS.has(unquoted);
+}
+
 /**
  * Creates a reactor instance bound to the given configuration.
  * Call `start()` to begin the event loop.