# Native Codex child metadata: evidence index

Scope: GitCafe [#22829](https://git.cafe/pingdotgg/t3code/pull/22829), synced GitHub [#22830](https://github.com/pingdotgg/t3code/pull/22830), issue [#15250](https://github.com/pingdotgg/t3code/issues/15250). Before [1688f96568](https://git.cafe/pingdotgg/t3code/commit/1688f965682d331da16a8c39f049592361f69c8d); after [4dd9adf5c0](https://git.cafe/pingdotgg/t3code/commit/4dd9adf5c0310983e26a99f5324508f234e03dcf). Actual fetched base was used; stale local main was not used. Server-only exception: focused replay plus real isolated server/protocol/persisted projection/client text, instead of a pixel matrix. This evidence does not establish merge readiness or current CI state.

## Matrix

| Row | Before [1688f96568](https://git.cafe/pingdotgg/t3code/commit/1688f965682d331da16a8c39f049592361f69c8d) | After [4dd9adf5c0](https://git.cafe/pingdotgg/t3code/commit/4dd9adf5c0310983e26a99f5324508f234e03dcf) | Proof limits |
| --- | --- | --- | --- |
| H healthy native child | Luna/high differs from parent Sol/low; retained through completion. | Healthy native child read hit empty rollout, resume succeeded 11:34:58.127Z; model persisted by observation 11:34:58.238Z; completion 11:35:31.873Z retained Luna/high. | Real server, protocol, card and persisted projection; dedicated healthy lookup replay assertion not claimed. |
| R transient metadata failure | Read natural empty-rollout error; successful resume result rejected by temporary fault. Fault removed; no later lookup, model null at completion 11:16:39.985Z. | Natural failures on attempt 1, injected rejection of successful results on attempt 2, accepted read on attempt 3. Persisted Luna/high at 11:35:43.778Z; retained at completion 11:38:48.129Z. | Real server. No settings/reroute correction; see notification check. |
| P newer settings/reroute | Not separately exercised in before runtime. | Existing deterministic race replay passes as part of 76 tests: newer selection wins over older lookup. | Settings-only and sleep-gate variants code-inspected, not separately asserted. |
| I interruption | Not separately exercised in before runtime. | New deterministic replay passes: interruption suppresses resume/retries/late metadata. | Other cancelled/failed/missing/parent-terminal variants code-inspected. |
| B bounded failure | One-shot lookup. | Six attempts; sleeps 1/2/4/8/16 seconds; 5-second whole-attempt timeout. | Code-inspected bound, not an executed persistent-failure fixture. |
| V invalid results | Not separately exercised in before runtime. | Matching-child/nonblank validation and fallback gates inspected; recovery replay exercises errors then valid response. | Wrong-thread/blank/decode/timeout variants not individually asserted. |
| U native task_status | Same parent returned task_not_found after fault child completed. | Same parent called once after recovered child completed, again task_not_found. | Unchanged app_owned-only MCP limitation; card/projection is native metadata oracle. |

## Correlated runtime timeline

All times UTC on 2026-10-21. Parent app thread: `thread:project:b6db5f59-d738-4f5c-bb4a-c468f14eff1b:c01ed8a0-4c1f-4f1c-98e0-d5a7d727f4de`; provider parent thread: `01a15e27-4c50-7851-ae6a-0b6e21056520`. Parent Sol/low, children Luna/high.

Before native child: `01a15e2a-a552-7323-9664-e3b89473ac35`, native call `call_e525721155cd41f1b3bda90ef07d3595`. Spawn 11:13:35.613; read 35.626 → natural -32603 empty rollout 35.689; resume 35.691 → successful wire reply 35.709 rejected in temporary adapter fault. Fault removed before 11:14:27. No subsequent read/resume; model null through 11:16:39.985 completion. [Before runtime](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/293f87cb9fe65433/before-runtime.md), [before protocol](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7aeef42820edf02f/lookup-transcript.json), [before completed projection](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2f3171428c7edc71/fault-completion.json).

After healthy native child: `01a15e3e-36ce-78b0-a686-82ebffe6b467`, call `call_4cab8b59cf814538b530f85d2b59a3ef`. Spawn 11:34:58.040; read 58.044 → natural empty rollout 58.078; resume 58.080 → successful Luna/high 58.127; persisted observation 58.238; completed 11:35:31.873 retaining selection.

After recovered native child: `01a15e3e-dd44-79b3-a6a6-47f2469ec0ce`, call `call_d5c8cbc695e746dcbd532631c8b49d82`. Spawn 11:35:40.654.

| Attempt | Read | Resume | Adapter/persistence |
| --- | --- | --- | --- |
| 1 | 11:35:40.656 → 40.681 natural -32603 empty rollout | 40.682 → 40.696 natural -32601 list_turns unsupported | Natural failures do not consume the successful-response injection. |
| 2 | 41.699 → 41.703 wire success | 41.705 → 41.711 wire success | Read result rejected 41.704; resume result rejected 41.711, automatically releasing logical fault. These are adapter-injected errors, not wire errors. |
| 3 | 43.714 → 43.716 wire success | Not needed | Persisted observation 43.778627 model Luna/high, updatedAt 43.717. |
| Completion | — | — | 11:38:48.129 completed; observation 48.163580 retains Luna/high and RECOVERED_AFTER_DONE. |

Artifacts: [sanitized protocol](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/20618f3f0b28a596/after-lookup-transcript.json), [filtered projection timeline](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b75ef20b61ebbe8d/after-projections-sanitized.jsonl), [completed projections](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/18a2ed4d807f7add/after-completed-projections.json), [only ISSUE15250 log lines](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e658c6caa7149078/after-injection-events.txt), [no matching settings/reroute notifications](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d1764609c6d39d62/after-settings-reroute-check.json). Initial historical baseline rows were removed from the after timeline; retained rows are healthy_after/recovered_after only. Raw dev log was not uploaded because it contains startup authentication material.

## Client captures and unsupported task_status

| Before: failed lookup | After: recovered native child |
| --- | --- |
| ![Before: native child tooltip says Not reported](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/40193901dcbb9e53/browser-screenshot-localhost-mvi0lpnf-1d2f5441.png) | ![After: recovered native child tooltip says GPT-6-Luna high](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/33bd82262349d721/browser-screenshot-localhost-mvi1f029-13d27636.png) |

![After: healthy native child reports Luna/high](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/476d8261d3a62825/browser-screenshot-localhost-mvi1cfdg-c8ae4fa4.png)

[Running card/lineage text](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/fa1a3f35ce9ca256/after-running-ui.txt) and [completed child and exact same-parent MCP error text](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/04e6b2acf1ca3483/after-final-ui.txt). Screenshot captures the recovered card while running; completion retention is proved by the persisted completion record and final UI text, not a claimed completed-card screenshot.

Exact after task_status result, isError=true:

```json
{"_tag":"OrchestratorMcpFailure","code":"task_not_found","message":"Delegated task node:provider:codex:native-item:call_d5c8cbc695e746dcbd532631c8b49d82%3A01a15e3e-dd44-79b3-a6a6-47f2469ec0ce does not belong to thread thread:project:b6db5f59-d738-4f5c-bb4a-c468f14eff1b:c01ed8a0-4c1f-4f1c-98e0-d5a7d727f4de."}
```

Rendering: T3 collaborative preview Chromium/Linux, 1280×800 CSS viewport, light theme, measured DPR **2**, no device emulation, default font scaling. Screenshot output 1280×800 as returned by preview. [Measured rendering record](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f7dbf8ffb6f7702f/rendering-environment.json). No light/dark, 1440/390 or pixel-diff claim.

## Rebuild and fixture instructions

Committed deterministic fixture: [CodexAdapterV2.test.ts](https://git.cafe/pingdotgg/t3code/blob/4dd9adf5c0310983e26a99f5324508f234e03dcf/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts), using makeCodexReplayHarness, Deferred barriers and TestClock. Run `node_modules/.bin/vp test run apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts` at [4dd9adf5c0](https://git.cafe/pingdotgg/t3code/commit/4dd9adf5c0310983e26a99f5324508f234e03dcf). The prior auditor ran 76 tests successfully at 11:31 UTC (12.33s); this evidence assembler did not rerun that suite.

Runtime seed is isolated worktree `.t3` history from the real before run; no fixture database writes or synthetic projection rows. Recreate on a disposable checkout at the linked base/head with installed dependencies and isolated `--home-dir`; the primary ran `env -u T3CODE_HOME node_modules/.bin/vp run dev --home-dir /home/ubuntu/wt/issue-15250/.t3 --no-seed`, server 16097/web 8057. Pair privately and never publish startup auth links. Use a real parent Sol/low and native spawn_agent children Luna/high: healthy_after sleeps 30 then HEALTHY_AFTER_DONE, recovered_after sleeps 180 then RECOVERED_AFTER_DONE. Use native spawn, not app_owned delegate_task. Read projections with SQLite mode=ro.

Runtime-only fault: [injection script](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f99d5cae4166c844/inject-after-fault.py), [exact temporary patch](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c53e48c7da24f259/after-fault.patch). On a disposable clean head checkout, adapt the script's root/temp paths, run it before the isolated dev server starts, and create `/tmp/issue-15250/fail-next-lookup` only before recovered child registration. The registration captures flag existence; the logical fault rejects successful decoded-path results until the first successful resume response, then automatically clears. Natural provider errors vary; do not promise the same attempt count in another live run. Remove the flag and restore source afterward. This published runtime artifact is allowed by the explicit server-only exception; it is not a committed database seeding fixture. A stricter committed runtime seed requirement is not met and would require additional scope. No product fixture or PR-only asset was committed.

Restoration: [primary restoration proof](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f1f2668c6c63c542/restoration-proof.json) records clean head, diff exit 0 and stopped retained sessions; assembler independently verified empty git status and exact head after RAW_READY. Product diff from base: only CodexAdapterV2.ts and CodexAdapterV2.test.ts, 198 insertions/38 deletions. No client renderer or contract changed.

## What else changed and limits

Between captures the isolated environment accumulated real child history, titles changed, timers advanced, diff counts reflected temporary instrumentation, and a provider-update notification was dismissed for the clean recovered capture. These explain visible differences outside model metadata; they are environment/UI state, not additional product changes. Existing web/desktop card consumers render the corrected server projection. Mobile card, Claude children, remote/relay/tunnel and multi-environment behavior remain unverified. Other lifecycle/invalid-result branches retain the per-row limits above. No current check status was queried.

Two independent Codex/Claude MERGE review reports are supplied by the lead; their underlying transcripts are not in this raw bundle, so this index does not claim an independent review re-run. [Scoped validation report](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/54d610201c41efd3/validation-summary.md): formatting and server-only typecheck exited 0; scoped lint exited 0 with two unused-variable warnings. Typecheck emitted Effect suggestions.

FRICTION category | happened | prevention
--- | --- | ---
Disk | 2.8 GB available initially; above 2 GB stop threshold | Check df before captures; no cleanup needed.
PR registration | GitCafe /pull URL rejected by app registration | Retry explicit host/repository/number; both scoped PRs registered, no forge mutation.
Protocol attribution | Natural attempt-1 failures left injection armed for attempt 2 | Correlate wire replies with injection-only log lines; accepted success is attempt 3.
Rendering | Brief assumed DPR 1, measured record says 2 | Use measured rendering record; no pixel claim.
Coverage | Runtime seeding is not a committed fixture; B/V variants inspected | Disclose limits; retain existing deterministic replay instead of optional scope expansion.

Model/harness: GPT-6.1-Sol through Codex in T3 Code. Uploads used the ghdrop skill; no forge writes, pushes, comments or monitoring were performed by this assembler.

Final [proof audit pass 2](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1249d7232d0632b5/proof-pass2.md): SUFFICIENT. Its minor timestamp finding is corrected above: before completedAt is 11:16:39.985Z; updatedAt is 11:16:39.991Z.