`test/shell` fork-bombs the user session on any machine where `python3` resolves to a mise shim. The session's task limit is exhausted, unrelated processes are denied forks, and `mise` dies with `SIGABRT` + a core dump.

Separate from #7360 and #7234: those are `exec` loops in the generated `~/.local/bin` wrappers, so the PID count never grows and they present as a hang. This one **forks**, so it takes the whole session down with it.

### What happened

Running `test/shell` produced a `systemd-coredump` entry:

```
PID: 510864 (python3)   Signal: 6 (ABRT) si_code: SI_TKILL   Executable: /usr/bin/mise
Command Line: /home/…/.local/share/mise/shims/python3 -c '<repair_py>' \
              /tmp/tmp.fxvnt7Qz7a/home/.config/chromium/Default/Preferences <pinned_id> check
```

Expected: the test passes, or fails an assertion. It should not be able to exhaust the session's task limit.

### Mechanism

`test/shell.d/copy-url-shortcut-migration-test.sh:31` captures the interpreter as:

```bash
REAL_PYTHON=$(command -v python3)
```

When python is installed under mise but not *active* in the current directory, `python3` on `PATH` is the mise **shim**, so `REAL_PYTHON` is the shim rather than an interpreter:

```console
$ mise which python3
mise ERROR python3 is a mise bin however it is not currently active. Use `mise use` to activate it in this directory.
```

The test then writes its own `python3` stub into `$stub_bin` and puts that dir first on `PATH` (lines 164-173 and 187-194), and the stub calls `"${REAL_PYTHON}" "$@"`. The shim, having no active mise python, falls back to a plain `PATH` lookup — and finds the stub. So:

> stub → mise shim → `PATH` lookup → stub → mise shim → …

The stub uses no `exec`, so every level **forks and waits**. Each mise process additionally spawns a tokio multi-threaded runtime, multiplying the task count per level. Concurrency grows until the scope's `TasksMax` is hit, `clone()` returns `EAGAIN`, and tokio aborts.

### Evidence

Panic string recovered verbatim from the core:

```
thread 'main' (510864) panicked at /cargo/registry/src/index.crates.io-…/tokio-1.53.1/src/runtime/scheduler/multi_thread/worker.rs:514:13:
OS can't spawn worker thread: Resource temporarily unavailable (os error 11)
```

Process environment, also from the core — the stub dir is first on `PATH`, and `REAL_PYTHON` points back at the shim:

```
HOME=/tmp/tmp.fxvnt7Qz7a/home
PATH=/tmp/tmp.fxvnt7Qz7a/bin:…:/home/…/.local/share/mise/shims:…
REAL_PYTHON=/home/…/.local/share/mise/shims/python3
```

Not memory pressure — 8.3 GiB was available and there were no OOM kills. It is the pids limit:

```console
$ cat /sys/fs/cgroup/user.slice/pids.peak        # 20208
$ cat /sys/fs/cgroup/user.slice/pids.events      # max 40
$ systemctl show --property=DefaultTasksMax      # DefaultTasksMax=19028
```

`pids.events: max 40` means **40 forks were rejected** — the collateral damage lands on unrelated processes in the session, not just on the test.

That the shim re-enters a same-named `PATH` entry is directly demonstrable with a harmless, non-recursive stub:

```console
$ tmpd=$(mktemp -d); mkdir -p "$tmpd/bin"
$ printf '#!/bin/bash\necho "STUB-REACHED $0"\n' > "$tmpd/bin/python3"; chmod +x "$tmpd/bin/python3"
$ PATH="$tmpd/bin:$PATH" ~/.local/share/mise/shims/python3 -c 'pass'
STUB-REACHED /tmp/…/bin/python3
```

### Reproduction

Bounded with `TasksMax` so it cannot take the machine down, and with cores disabled:

```bash
tmpd=$(mktemp -d); mkdir -p "$tmpd/bin" "$tmpd/home"
shim=~/.local/share/mise/shims/python3
printf '#!/bin/bash\n"${REAL_PYTHON}" "$@"\nexit $?\n' > "$tmpd/bin/python3"
chmod +x "$tmpd/bin/python3"

systemd-run --user --scope -q -p TasksMax=60 -- bash -c \
  "ulimit -c 0; export REAL_PYTHON='$shim' HOME='$tmpd/home' PATH='$tmpd/bin:$PATH'; '$shim' -c 'pass'"
```

Result — identical file:line and message to the original crash, exit 134 (128+SIGABRT):

```
thread 'main' panicked at …/tokio-1.53.1/src/runtime/scheduler/multi_thread/worker.rs:514:13:
OS can't spawn worker thread: Resource temporarily unavailable (os error 11)
…/bin/python3: line 2: 541479 Aborted (core dumped) "${REAL_PYTHON}" "$@"
```

### Fix

Resolve through the shim to the actual interpreter, so the stub cannot re-enter a `PATH` lookup:

```bash
REAL_PYTHON=$(python3 -c 'import sys; print(sys.executable)')   # → /usr/bin/python3
```

`command -v` is unsafe here for any name a version manager shims (mise, asdf, pyenv, rbenv): it returns the dispatcher, and pairing it with a same-named stub earlier on `PATH` closes the loop. This is the only occurrence of the pattern in `test/shell.d` — `grep -rn 'command -v' test/shell.d/*.sh | grep -E 'REAL_|ORIG_|ACTUAL_'` returns just this one line.

A cheap belt-and-braces addition would be running `test/shell` under a `TasksMax` cap, so a future instance of this shape fails its own suite instead of the developer's session.

### System

| | |
|---|---|
| Omarchy | 4.0.1-1 (stable) |
| Kernel | 7.1.9-arch1-2 |
| mise | 2026.8.14 linux-x64 (2026-08-26), `mise-bin` 2026.8.14-1 |
| Test/migration | identical to `upstream/quattro`, unmodified |

`omarchy debug --no-sudo --print` is referenced by the crash-diagnosis skill but is not a command in 4.0.1 (`Unknown Omarchy command: omarchy debug`), so no output from it is included rather than substituting something invented.

---

Filed by claude-opus-5 via OpenCode.