# Slow-host session takeover verification

Target: [#25526](https://github.com/pingdotgg/t3code/pull/25526), mirrored as [#25528](https://git.cafe/pingdotgg/t3code/pulls/25528).
Original author: [@yordis](https://github.com/yordis).
Final head: [8fbfc33c1a](https://github.com/yordis/t3code/commit/8fbfc33c1ac503048ca2983564318bc29143086a).
Before/merge-base: [dd5b5401e1](https://git.cafe/pingdotgg/t3code/commit/dd5b5401e1f240f4314af29edf431369d182f386).

## Shape and behavior

The existing contributor branch was fast-forwarded, with the author's original commit preserved. A merge commit brings in main and the takeover commits. No rebase, force push, replacement PR, or closure.

Only the session loader's timeout policy changed: attempts use 6, 12, 24, 48 and 60 seconds by default, then fail after the final attempt (150 seconds total). Every non-timeout error propagates through the existing request layer. Credential renewal/rejection, grants and server authorization are unchanged. Cold permission-gated controls remain disabled until actual grants arrive. Cached session revalidation and terminal-state presentation are covered by the separate runtime evidence.

The original counter/logarithmic retry-count implementation was replaced with a local recursive request whose growing deadline also determines termination. The original 60-second cap, error type and relevant explanatory comment remain. No regex/parser, dependency patch, wire schema, adapter or UI component was added.

The existing independent six-second command authorization deadline remains. A session-dependent action awaiting the loader can now wait up to 150 seconds on an unresponsive host. These are disclosed timing limits, not claims that every command can run while grants are pending.

## Tests and checks

- Original PR additions: two tests. Takeover: two rewritten tests, in the existing [environmentHttpAuth.test.ts](https://github.com/yordis/t3code/blob/8fbfc33c1ac503048ca2983564318bc29143086a/packages/client-runtime/src/state/environmentHttpAuth.test.ts); 34 total versus 32 on main. Both regressions fail by assertion on main and pass with the final loader. No test-timeout-based failure.
- Scoped session HTTP and command permission suites: 48/48 passed independently by both reviewers.
- Implementation's session HTTP and supervisor suites: 69/69 passed.
- Final-head check:changed: format, lint, both knip checks, seven affected-package typechecks and the changed-file tests all passed. The parent tracked its PID and enforced a 20-minute cap; it finished normally.
- Public regression driver/log records identical test hashes and production source hashes for before and after.
- A separate public TestClock driver checks omitted-timeout defaults: 6/12/24/48/60 seconds, five requests and terminal 60-second timeout. It fails by assertion against main and passes against the final head. These reproduction files are uploaded, never committed.
- No repo-wide checks or browser/component assertion tests were added.

## Independent review

Round 1: reviewer A, GPT-6.1 Sol via Codex: MERGE. Reviewer B, Claude Opus 5.5 via claudeAgent: MERGE. Both reviewed the full two-file diff, callers, failure handling, cancellation and compatibility. No blocking findings. Reviews were of [f871636989](https://github.com/yordis/t3code/commit/f8716369890ab99d1f171966b0019cad155743b5); the final [8fbfc33c1a](https://github.com/yordis/t3code/commit/8fbfc33c1ac503048ca2983564318bc29143086a) tree is byte-identical, with only ancestry changed to preserve the author and main.

Both reviewers found no sensitive-surface semantic change. Reviewer B identified the possible 150-second wait in a session-dependent deleted-thread/worktree path; reviewer A noted the existing independent command authorization deadline. No regex/parser timing benchmark applies.

## Friction collected from the lead and step agents

brief | The initial instruction forbade pushing to the fork, then the dispatcher corrected maintainerCanModify to true | Check maintainer-edit eligibility before selecting publication shape; resolved by preserving the author and pushing the existing branch.
tool | cafe pr diff --patch produced a JSON hunk list rather than a directly applicable diff | Request/convert a unified patch explicitly for local application.
tool | A delegated-review invocation lost its task argument when shared state was read before another execution finished | Pass independent briefs directly or await the state-producing execution first; retried successfully.
tool | check:changed initially reported lint failure without the rule diagnostic | Include the failing lint diagnostic in the aggregate summary; direct file lint identified prefer-catch-tags.
runbook | A system-skill path was guessed for project-local test-t3-app and did not exist | Resolve the catalog's skill root before reading; the project-local skill was found and used.
model | A recursive Effect helper requires an explicit return annotation | Account for circular inference when comparing retry shapes.
brief | Existing CI belonged to the original head while local takeover work was still unpublished | Always name original and takeover heads separately; final pushed-head checks were read separately.
other | Following session-query consumers and their deadlines required tracing multiple modules | Keep review bounded but follow the actual query implementation rather than assuming caller timeouts.
brief | The original PR and takeover heads, and GitHub/GitCafe PR numbers, differ | Pin both numbers and SHAs in every step brief; no number-parity assumption.
brief | Existing green tests did not pin the production default schedule, and a non-timeout table targeted another loader | The published default-schedule driver and existing session-specific rejection/malformed-response tests make the distinction explicit.
other | Navigation or SWR revalidation can conceal an initial session failure; cached grants change the observed UI | Capture cold and warm episodes separately and record request milestones.
runbook | Default development seeding would inspect live state, and generated dev auth must remain private | Use explicit --no-seed and a fresh /tmp home; upload only sanitized fixture/scripts/logs.
brief | Code reviews precede the capture phase, so those reviews cannot certify runtime artifacts | Separate code verdicts from the later proof-audit verdict.

## Unverified surface

Native mobile UI is unverified. Shared client-runtime behavior is covered by the scoped tests; this is not a claim of native rendering verification.

## Supplemental capture pass and repair

The first evidence pass produced eight chaptered sampled videos and 48 before/after/diff sets, but certified zero of sixteen logical pairs as fully compliant. Warm-cache rows were missing; cold recordings had bootstrap, geometry, sampling and stability gaps. These artifacts are supplemental, not acceptance proof. A separate proof audit checks the gaps; a fresh capture run repairs them with the authorized full-resolution browser fallback.

Additional friction from the first capture agent:

tool | Browser screenshots repeatedly capped requested 1440-wide output to 1280x800 at DPR2 | Verify actual pixel geometry in a pilot and use an authorized full-resolution recording backend.
other | A first-two-request bootstrap bypass did not reliably identify the measured session loader | Separate healthy bootstrap from the slow environment or identify the request source explicitly.
other | Settings navigation did not trigger a verified cached-session revalidation | Seed a genuine cached result and invoke the real refresh request path without replacing grants or results.
tool | Eight tabs and snapshot latency produced sparse frames and missed the six-second boundary | Use continuous recording and request-aligned pilots before the matrix batch.
tool | preview_snapshot save:true automatically wrote one screenshot into the live T3 browser-artifacts directory | Use save:false and an explicit isolated output path; no live database was read or copied, and the artifact was not read, copied or cleaned up.
tool | Pairing uses --base-dir and a canonical PTY truncated long JSON frame writes | Read current command help and use a noncanonical byte writer or a standalone browser capture script.
brief | Existing override tests did not pin default deadlines or live cached-state transitions | The lead added an uploaded default-schedule proof driver; the real-app retake covers cached transitions.
brief | The first capture budget could not repair all discovered bootstrap and warm-cache fixture gaps | Validate one cold and one warm pilot before batching every viewport/theme.

## Second capture and preliminary audit

The second capture produced 12/16 strict logical pairs. Its standalone two-environment fixture isolates primary bootstrap from the delayed secondary session, and uses genuine cached grants followed by explicit runtime refresh. A third capture run repairs the remaining unstable checkpoints and further proof-audit findings. The independent audit recomputed 118 paired comparisons (236 diff images) with no arithmetic mismatch. This numerical result does not certify fixture identity or persisted interactions.

## Friction

| Category | What | Prevention |
|---|---|---|
| tool | Prior preview1440 captures capped1280×800 at DPR2; no continuous recorder/reduced motion | Authorized isolated agent-browser, assert viewport/DPR/media |
| tool | addinitscript unavailable; changing open init-script relaunches context | Install observer before pairing, never reapply flag |
| tool | Eight contexts and10fps caused encoder backlog | Four contexts, native5fps; require clean recorder result |
| other | Cloned browser state omitted saved environment | Pair each context through actual Connections UI |
| other | Cold bootstrap must stay healthy | Delay only separately paired secondary origin |
| other | Several checkpoints failed strict evidence | Mark incomplete; never substitute a later state |
| tool | inspect.py shadowed Python stdlib | Rename inspect-stills.py |


Native video-only recordings require matching written steps and timestamps; audio is not a separate requirement. The auditor identified missing persistence readback, disabled-control tooltip interaction, exact process/SHA ownership and an additional unstable restored checkpoint. These are capture acceptance findings, not newly discovered production bugs.

CI observed on final head: 31 successful, zero pending or failing. CodeRabbit reports no actionable comments; no new human reviews were present.

Additional proof friction:

other | Core-only image auditing missed a substantial provider status/layout shift after restore | Check interaction checkpoints as well as pending/terminal frames.
other | Raw native recordings lacked written request-aligned viewer maps | Retain recording command timestamps and verify chapter times against decoded frames.
other | A repeated client toggle did not establish server persistence | Read the isolated server projection and persisted setting for both toggle and restoration.
other | SHA labels alone did not bind the running app to a source revision | Capture exact launch/switch SHA, process identity and fixture ownership.

## Publication and external merge

A final main fetch at approximately22:38 UTC found [024e593a63](https://github.com/pingdotgg/t3code/commit/024e593a635670a01187da6607508eceb88c0da0), the externally merged [#25526](https://github.com/pingdotgg/t3code/pull/25526). GitCafe reports mergedAt22:27:31 UTC, original head8fbfc33c1a. The lead did not issue a forge merge command. Both changed files are byte-identical between reviewed/pushed head8fbfc33c1a and the squash merge024e593a63. No further branch update or push is appropriate; the remaining work is evidence audit, PR-body update and cleanup.

The third capture reports16/16 logical configuration pairs and32 consumer rows, including persisted server-setting readbacks, disabled tooltip, timestamped video step maps, matched masks, source launch/switch records and continuation notes. This claim remains subject to the final independent audit.

other | Main advanced and the PR was externally merged while evidence repair was still running | Keep the claim/head status visible to the dispatcher and re-read forge state before final publication; no merge was performed by this lead.

Third capture friction:

other | An early navigation race and unstable relative-age checkpoints were rejected | Validate exact consumer/state and isolate only incidental age text using pixel deltas before accepting a take.
tool | The final R3 driver exited after the General terminal capture | Continue the Providers terminal duplicate and clean recorder stop in the same owned live browser and native recording; retain the continuation note.

## Final proof verdict and handoff

[Final independent proof audit](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8114637219a51e45/proof-audit-pass4.md): SUFFICIENT for16/16 configuration pairs and32/32 scoped historical web rows. The auditor checked291 stable checkpoint pairs,120 paired comparisons/240 diff images,40 sampled native recordings and254 public artifact hashes. Independent executable-kit real-app rebuild matched the accepted head image exactly: Diff0=0 and Diff8=0 pixels. [Supporting audit archive](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/571ee1e6d8bb87f3/audit4-support.zip).

[Final capture index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3a10d4563433ad2e/INDEX-repaired.md), [selection manifest](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/214e43e9a3435dae/PR-EVIDENCE.json), [32-row evidence table](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c7e890b0572290cd/PR-EVIDENCE.md), [public executable seed/capture kit](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c2ada13aac2741ce/recapture-kit-final.zip).

Historical provenance is qualified: some retained original captures lack contemporaneous per-frame process-source attestation; checkout chronology, retained dev-runner output and cleanup PID/cwd corroborate their source association. New repairs include launch/switch records. The independent exact live rebuild corroborates one affected head checkpoint, not every older process. The audit explicitly accepted this historical qualification. Native mobile UI remains unverified; no Electron shell/MCP verification is inferred.

All three capture passes and both insufficient follow-up audits have their actual gaps disclosed above; only the repaired final selection satisfies acceptance. The selected R3 same-session terminal continuation is disclosed and accepted. No extra baseline tooltip timestamp outside required R1 proof was treated as a missing milestone.

Final forge read: externally merged, original final head8fbfc33c1a;38 successful check contexts,0 pending,0 failing (post-merge cleanup added contexts). CodeRabbit no actionable issue. Macroscope human timing-policy note remains historical; both independent code reviewers returned MERGE and timing is stated explicitly. No human review was fabricated or posted.

Final auditor friction:

other | First live rebuild used a different visible proxy port and differed by70 pixels | Repeat with the exact accepted7433 endpoint; the second rebuild matched0 pixels.
infra | Public byte verification hit urllib403 and transient DNS/timeouts | Use curl and retry only failed downloads; all254 public hashes eventually matched.
brief | Older capture startup logging was overwritten | Record immutable launch/source/process ownership before capturing, and retain honest historical qualifications.

Final body preserves the original author description unchanged in a collapsed section, appends credit/takeover, open32-row Evidence matrix and collapsed Verification log. Evidence scripts and assets remain public attachments only. All owned server/browser resources were released, with no emulator started; the worktree and task scratch are removed at handoff. No fork branch deletion, rebase, force push, replacement PR or forge merge was performed by the lead.

Models: lead/reviewerA/evidence/proof GPT-6.1 Sol via Codex; tests/implementation/reviewerB Claude Opus5.5 via claudeAgent. Code-review round1 MERGE/MERGE; proof final pass4 SUFFICIENT.