# Failed replacement startup: focused proof

Target: [#14729](https://github.com/pingdotgg/t3code/pull/14729).
Revision: [af7af24a0a](https://github.com/pingdotgg/t3code/commit/af7af24a0a6cf24f7e0b079edf2c532418dd4a90), based on [ab6be13d43](https://github.com/pingdotgg/t3code/commit/ab6be13d438abeace7617e8d789d59cf2e880f42).

## Before and after

Four added behavior cases replace twelve cases in the original PR. On the main-only rebuild, 40 of 42 cases passed and two assertions failed: inherited work stayed open, and current guarded work was not settled. With this implementation, all 42 pass. These include a real orchestrator/effect-worker/session-manager/SQLite selection restart, completed native links with live descendants, independent app-owned work, current answers/content/progress, and optional-read failure fallback. Another 66 shared cascade/background cases and two guarded persistence cases pass: 110 scoped cases total. Scoped server typecheck, targeted lint, formatting and diff checks pass; three existing unused-variable lint warnings remain.

## Running Linux server

Two probes used the real server process, public WebSocket/RPC commands, authentication, SQLite, Git workspace and Codex adapter. Each used a disposable home and a scripted Codex app-server peer; no real provider account or paid turn was used. Both servers were stopped by their captured PIDs after verification.

Each first created a running turn, a pending approval and a running command, then used restart_active to switch between compatible provider instances within the same run. The first probe made replacement initialize exit with status 9. The second rejected thread resume and fallback start requests until loading failed.

| Observed state | Before restart | After replacement failure, both probes |
| --- | --- | --- |
| Run | running | failed, same run ID |
| Attempts | running | superseded, failed |
| Approval | pending | cancelled |
| Background command | running | interrupted, terminal outcome preserved |
| Provider turn count | 1 | 1; replacement never starts a turn |

Codex's ordinary interrupt already terminalized the command; this live check proves that its terminal outcome survives failed startup. The integration tests, rather than this live command, prove the new settlement of work left open. Codex's streaming deltas are transient rather than persisted messages, so persisted inherited streaming replies and native-child/app-owned boundaries are covered by integration tests. The probes do not claim visual UI proof or a provider-account end-to-end run.

## Limits

No client or wire schema changed, so screenshots do not add evidence for the server transaction behavior. macOS, Windows, iOS, Android, Electron desktop, and remote/relay/tunnel modes were not verified. Large native-child histories may lengthen the writer transaction; no performance benchmark is claimed. Optional read failure deliberately leaves inherited work open while mandatory startup failure commits and logs its cause. Human maintainer approval remains required. Nothing was merged.

Tests: GPT-6-Astra/Codex; implementation: GPT-6.1-Sol/Codex; independent review: GPT-6-Sol/Codex and Claude Opus 5.5, all through T3 Code delegation.