# Server runtime evidence: ACP busy follow-up

**PASS: 6/6 runtime pairs, 12/12 revision scenarios. No required row is missing.**

PR [#22697](https://git.cafe/pingdotgg/t3code/pull/22697), mirror [#22698](https://github.com/pingdotgg/t3code/pull/22698). Branch `fix/issue-22660`.

- Before: [6a6c84f9906cbdfa7f533fecfc39ce18c2f4c273](https://git.cafe/pingdotgg/t3code/commit/6a6c84f9906cbdfa7f533fecfc39ce18c2f4c273) (pinned base; clean detached checkout).
- After runtime: [eb303fe4b6458aa2091fbfcba2fcf66bbad3e1ec](https://git.cafe/pingdotgg/t3code/commit/eb303fe4b6458aa2091fbfcba2fcf66bbad3e1ec). At process start only the untracked fixture/driver were present; no production source diff. Capture used source-mode real T3 server, not an injected adapter/runtime harness.
- New local head: [27a924b004e2e67f15935c9e2c6981c3eb9e7af7](https://git.cafe/pingdotgg/t3code/commit/27a924b004e2e67f15935c9e2c6981c3eb9e7af7). Adds reproducible fixture/driver and two guard test cases; production implementation is byte-identical to the pinned after revision. Clean working tree. **No push or forge writes.** Parent owns PR updates.
- [Required matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/66bb01afbf538ec2/matrix.md) and local proof report were read before capture.

## Environment and transport

Linux 6.1.102 x86_64, Node v24.21.0. Synthetic ACP protocol v1 agent `t3-synthetic-busy-lifecycle` version 1.0.0, registered as six real `acpRegistry` local provider instances with `source: local`, Node commandPath, and fixture commandArgs. **Synthetic, not actual oh-my-pi.** No account or credentials were required for the scenarios.

Each run launched the real server entry point `apps/server/src/bin.ts start` from the selected source checkout with explicit `--base-dir`, `--port`, `--host 127.0.0.1`, `--no-browser`, and the existing desktop bootstrap FD. Standard OAuth bootstrap exchange → access token → WebSocket ticket → authenticated Effect RPC was used. Projects were created through the real HTTP mutation endpoint; provider settings, thread launch, confirmation messages, Stop, projections, subscriptions, and item reads used existing public RPCs. No auth, permission, provider mode, sandbox, or MCP implementation was changed to seed. Runtime mode used the existing default `full-access`, interaction mode `default`.

| Side | Address | Isolated T3 home | Final capture UTC |
| --- | --- | --- | --- |
| Before | `http://127.0.0.1:34587` | `/tmp/issue-22660/final-before/home` | 07:42:22.272–07:42:55.101, 2026-10-21 |
| After | `http://127.0.0.1:38535` | `/tmp/issue-22660/final-after/home` | 07:42:22.886–07:48:53.048, 2026-10-21 |

Separate disposable Git projects and isolated databases were created through the real app. No live state was seeded, copied, or opened for writing. Both revisions used identical fixture and driver bytes. Initial prompt and confirmation `нажал` were identical; generated IDs, ports, home paths and actual clocks naturally differ. Clock was intentionally unfrozen for real backoff and absence windows. No browsers, screenshots, pixel diffs, or simulators were used under the server-only adaptation.

## Runtime pairs

Dispatch counts include the first prompt and any explicitly stated fresh-turn check. Before R1–R5 cannot reach the new queue branch: first-rejection failure/no automatic retry is the expected baseline, not missing evidence. Each linked NDJSON includes both full SHA manifests, ordered command receipts, persisted read-model snapshots/events, monotonic timestamps, IDs, complete confirmation payloads, and ACP request/response/cancel frames.

| Row | Before | After | Evidence and assertions |
| --- | --- | --- | --- |
| R1 Recovery | 2; completed → failed | 4 including fresh turn; completed → completed → completed | [R1 paired transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/78e8ad49bee3403a/R1-runtime-pair.ndjson). Queue attempt 1, maxAttempts null, 1000 ms; identical full retry payload; exactly one successful confirmation acceptance; settled notice; reusable thread. |
| R2 Long busy | 2; completed → failed | 14; both turns completed | [R2 paired transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/942c687453275a67/R2-runtime-pair.ndjson). 12 busy rejections; 241.060591302 s actual wall time; attempts 1–12; delays 1,2,4,8,16,30,30,30,30,30,30,30 s; all confirmation payloads equal; exactly one acceptance. |
| R3 Stop in backoff | 2; completed → failed; subsequent Stop command accepted | 3 including fresh turn; completed → interrupted → completed | [R3 paired transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d305e6ffb2ad1bac/R3-runtime-pair.ndjson). No outstanding prompt at Stop; cancel emitted; notice interrupted with no turn failure; count held at 2 for 60.002 s, then fresh independent turn. |
| R4 Stop in dispatch | 2; completed → failed; subsequent Stop command accepted | 4 including fresh turn; completed → interrupted → completed | [R4 paired transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/84d08144ebf1277f/R4-runtime-pair.ndjson). Third prompt held; cancel precedes its exact busy response; no resurrection; count held at 3 for 60.005 s, then fresh independent turn. |
| R5 Old root thought | 2; follow-up failed; late thought emitted and not attached to failed run | 3; both turns completed | [R5 paired transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e442583b8ea89c7a/R5-runtime-pair.ndjson). After queued notice persists, retry is held before acceptance. Old root thought produces a running reasoning node while retry notice stays running. Gate snapshot shows no premature terminal/recovery. Final getTurnItem returns exact thought text; reply completes and notice settles. |
| R6 Unrelated error | 2; completed → failed | 2; completed → failed | [R6 paired transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/52b95b941cd96748/R6-runtime-pair.ndjson). Another internal error retained; no retry item or retransmission through the 2.2 s observation window. |

## What changed in observed behavior

- The exact busy error becomes a queued retry rather than a failed follow-up. Retry attempts have no maximum and cap at 30 seconds.
- The same retry item carries the queued explanation, attempt and delay, then settles on success or Stop. No premature terminal occurred during R2.
- Stop works both with no outstanding prompt and with a held retry; both interrupted threads accept a fresh turn after the 60-second no-resubmission window.
- Old root thought output does not clear the queued notice. It is attached as reasoning to the still-running follow-up and retained after completion. The already-failed baseline does not attach that late thought.
- Unrelated internal errors continue to fail without a queue notice or retransmission.

No other behavior delta was observed within these six server scenarios. This is not an assertion about untouched clients or every provider. Streaming reasoning is represented by a durable node before its final text item is stored: R5 records the gate node/queue snapshot and final `getTurnItem` text, rather than incorrectly waiting for thought text in conversation history.

## Committed reproduction and scoped verification

- [RPC driver](https://git.cafe/pingdotgg/t3code/blob/27a924b004e2e67f15935c9e2c6981c3eb9e7af7/apps/server/scripts/verify-acp-busy-live.mjs)
- [Synthetic ACP v1 fixture](https://git.cafe/pingdotgg/t3code/blob/27a924b004e2e67f15935c9e2c6981c3eb9e7af7/apps/server/scripts/fixtures/acp-busy/agent.mjs)
- [Guard tests](https://git.cafe/pingdotgg/t3code/blob/27a924b004e2e67f15935c9e2c6981c3eb9e7af7/apps/server/src/orchestration-v2/Adapters/AcpRegistryAdapterV2.test.ts): exact busy message with another error code, and near-match busy message. Existing shared-provider tests exercise retry notice recovery, failure and Stop settlement.

Fixture SHA-256: `b6192ec4170dac12605100e985a7bc3f6616635faf797e2a55d142dba14df659`. Driver SHA-256: `9dfec30fc47ac449e3a82832b1724ddedffcc35f6e8cf00722b7abe52854fae8`. Both match the committed files and both runtime manifests.

Commands actually used (from `/home/ubuntu/wt/issue-22660`, with fresh output directories):

```sh
git worktree add --detach /tmp/issue-22660/before 6a6c84f9906cbdfa7f533fecfc39ce18c2f4c273
# In that temporary checkout: install from its frozen lockfile.
/home/ubuntu/wt/issue-22660/node_modules/.bin/vp install --frozen-lockfile
# Back in the task worktree, still at the pinned after SHA when the servers started:
node apps/server/scripts/verify-acp-busy-live.mjs --root /tmp/issue-22660/before --output /tmp/issue-22660/final-before --revision before
node apps/server/scripts/verify-acp-busy-live.mjs --output /tmp/issue-22660/final-after --revision after
# At the new committed head:
node_modules/.bin/vp test run apps/server/src/orchestration-v2/Adapters/AcpRegistryAdapterV2.test.ts apps/server/src/orchestration-v2/Adapters/AcpAdapterV2.test.ts apps/server/src/provider/acp/AcpJsonRpcConnection.test.ts
node_modules/.bin/vp lint apps/server/scripts/verify-acp-busy-live.mjs apps/server/scripts/fixtures/acp-busy/agent.mjs apps/server/src/orchestration-v2/Adapters/AcpRegistryAdapterV2.test.ts
git worktree remove /tmp/issue-22660/before
```

To reproduce pinned revisions after this commit, keep this committed driver/fixture in the task checkout and pass `--root` pointing at a clean detached checkout of each pinned SHA (install frozen dependencies there). The driver selects source via `--root`; `--revision before` selects baseline assertions, not a Git revision. Use new empty output paths. The script generates its own bootstrap credential without requiring a user account, redacts it from logs, and kills only its captured server process group.

**105 tests passed in 3 scoped files at the new head; targeted lint and formatting passed.** No repo-wide checks were run. [Test log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f3a099876c51563f/evidence-final-tests.log), [lint log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b596fcf62f696b80/evidence-lint-final.log), [SHA/source-hash verification](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c655aed29d1eb6e4/verification.json).

## Artifacts, cleanup and limits

[Complete runtime archive](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/334604415b3f749f/runtime-evidence.tar.gz) contains both original manifests, full transcripts, wire frames, server logs, exact executed scripts, results, scoped check logs, source hashes and cleanup record. It excludes isolated databases, signing material, tokens and credentials. App-owned MCP configuration in `session/new` is redacted; confirmation prompt payloads are intact. [Artifact SHA-256 manifest](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a588a002355cc944/hashes.json).

| Artifact | SHA-256 |
| --- | --- |
| [R5-runtime-pair.ndjson](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e442583b8ea89c7a/R5-runtime-pair.ndjson) | `a3ee787eea18a4aef78e025703e6ec8658da2ceb6802939f217fd830a3f5a74e` |
| [runtime-evidence.tar.gz](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/334604415b3f749f/runtime-evidence.tar.gz) | `a9991bbd58081f905681849059f1c090c84b68090a8e8a18d81d61ed07aa78a1` |
| [R1-runtime-pair.ndjson](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/78e8ad49bee3403a/R1-runtime-pair.ndjson) | `4ede8e36e0ff986320f81108278c6e295669ae65a7572d222b1157bd1fc7ffe3` |
| [R4-runtime-pair.ndjson](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/84d08144ebf1277f/R4-runtime-pair.ndjson) | `91c5a7c70f41c932e0f8e32c498275faf0f75541b13361cad2385c8f8e28f87f` |
| [R2-runtime-pair.ndjson](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/942c687453275a67/R2-runtime-pair.ndjson) | `8999fe1d54e43648693c53210ad0c508b0b564a563726631ab06449d291550ca` |
| [R6-runtime-pair.ndjson](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/52b95b941cd96748/R6-runtime-pair.ndjson) | `452f2a5ee515e153febe2c4253f12bad240cc50d227704879dadbc4bb5e9dab1` |
| [R3-runtime-pair.ndjson](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d305e6ffb2ad1bac/R3-runtime-pair.ndjson) | `61a04013105427983fb2ad226dccbfd7d62abd2cf787a6e27e46a85bdb17a787` |

Cleanup verified all **13 captured server PIDs and 88 captured synthetic-provider PIDs** across exploratory and final runs absent; no members remain in any owned server process group. The temporary before worktree was removed. Isolated state and local transcripts remain under `/tmp/issue-22660` for inspection. [Cleanup record](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e19221f76604d388/cleanup.json). No process was killed by pattern.

One early exploratory launch was rejected by the ownership guard because the ambient `T3CODE_HOME` outranked the bootstrap home. It never started a server. The launcher was corrected to pass explicit `--base-dir`; every successful run used its isolated home. Exploratory R5 attempts also exposed the need to gate the prompted process and to observe reasoning through its node/final detail. Only `final-before`, `final-after`, and the linked paired transcripts are authoritative.

Missing required rows: **none**. Actual oh-my-pi lifecycle, Windows desktop, browser/mobile/desktop rendering, other ACP providers (including live Antigravity), remote/relay/tunnel topology, and restart durability remain **unverified**, as scoped exclusions. No claim of durable busy-queue recovery across restart is made.

Artifacts uploaded with the [ghdrop skill](/home/ubuntu/.codex/skills/ghdrop/SKILL.md). No PR body/comment edits, pushes, or other forge mutations were performed. PR registration in T3 succeeded and was confirmed before handoff. Parent owns the next PR update.