# Runtime evidence for [#25675](https://git.cafe/pingdotgg/t3code/pull/25675)

Differences beyond the PR's stop-timeout outcome: generated identities/clocks, provider wording and usage, event interleaving, runtime diagnostics and shutdown cleanup. They are enumerated below and retained in both diffs. No additional product outcome regression was observed in these fixtures.

Captured **7/7 required runtime rows, 14/14 before/after transcripts**. R0/R6 have source inventory as specified: **9/9 matrix rows accounted for**, 7/9 as runtime captures. No required row is unverified. Optional R6 race harness was not run; its branch is covered by immutable source inventory, with no runtime race claim.

Environment: Captured 2026-10-27 UTC; machine ~/.agents/MACHINE=fs-37; actual hostname=fs-37 (brief said freestyle); Linux x86_64 kernel 6.1.102; global vp 1.3.0; checkout vite-plus 1.4.0; pnpm 12.14.0; Node 26.12.1; Effect 4.0.5; Codex CLI 0.163.0, model gpt-5.6-sol through existing CLIProxyAPI hub. Real server source runtime, native Node TypeScript, fresh per-side app-migrated SQLite (migration 69 ThreadMessageSearch), T3CODE_DEV_SEED=0. No browser, other machine or live-state access. R7/R8: production worker/outbox with synthetic executor, no provider reply claimed. Production policy unchanged: stop deadline 30s only on after, maxAttempts=5, lease=30s, persisted backoff=100/200/400/800ms. R1's original manifest inherited a static 'hostname freestyle' label from old script; this file records measured hostname and future driver uses actual hostname. Original retained.

Capture window: 2026-10-27 13:35:06–13:44:48 UTC. Surface: server. Before is [96fc7b9551](https://git.cafe/pingdotgg/t3code/commit/96fc7b955196637605cbf3b415152ce4dd0e2294); after is [802efb97da](https://git.cafe/pingdotgg/t3code/commit/802efb97da70e935d2c55ff2be6caf1093ffdb32). Every row uses a fresh database created by its own revision's actual server, with T3CODE_DEV_SEED=0. No screenshots apply. Production timeout/retry/backoff was not overridden. Identical driver SHA256 verified within each pair; executed worker reconstructed from immutable source plus retained exact injection diff and matched against capture-time SHA256.

| Row | Before<br>[96fc7b9551](https://git.cafe/pingdotgg/t3code/commit/96fc7b955196637605cbf3b415152ce4dd0e2294) | After<br>[802efb97da](https://git.cafe/pingdotgg/t3code/commit/802efb97da70e935d2c55ff2be6caf1093ffdb32) | Diff | Observation |
| --- | --- | --- | --- | --- |
| R0 | [Source inventory](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f504a1f957f7e4c7/source-inventory.md) | [Source inventory](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f504a1f957f7e4c7/source-inventory.md) | No runtime capture required | Eligibility/bypass inventory. |
| R1 | [Transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/11a03e9a00d8515a/R1-before-transcript.md) | [Transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5b09de5633b5ff2f/R1-after-transcript.md) | [Normalized](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a7e78a61a25ec468/R1-normalized.diff) · [Raw](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d3a6da22ad9624e5/R1-raw.diff) | Real app; before blocked >160s, after fails stop on attempt 5 with 100/200/400/800ms backoff then completes real reply/run/checkpoint. |
| R2 | [Transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4801ef74c01f4610/R2-before-transcript.md) | [Transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f173ae8e959f2f5e/R2-after-transcript.md) | [Normalized](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/af5f7beb6b5a548f/R2-normalized.diff) · [Raw](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/bb92d648728c2824/R2-raw.diff) | Real app, actual process crash/restart; before replay attempt 2 blocked >130s; after attempts 2–5 time out, fail, then new message completes. Old pending start cancels on both. |
| R3 | [Transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/99ccbd024b7328e7/R3-before-transcript.md) | [Transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f7493824fe510ed4/R3-after-transcript.md) | [Normalized](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3fa9905c966d1a00/R3-normalized.diff) · [Raw](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3e2e84359c3d5245/R3-raw.diff) | Real app-owned child and running provider; genuine Stop succeeds attempt 1 on both; subsequent real parent reply completes. |
| R4 | [Transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/cb83e1af39c85124/R4-before-transcript.md) | [Transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/cc272c35b27b14c7/R4-after-transcript.md) | [Normalized](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7b49a8b30b2f3cc4/R4-normalized.diff) · [Raw](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e685c1511be14c92/R4-raw.diff) | Real app; before blocked >65s; after attempt 1 timeout, 100ms backoff, fresh attempt 2 succeeds after 25.009s and real reply completes. |
| R5 | [Transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d84727c25be62868/R5-before-transcript.md) | [Transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/fc87d0cb3cf33a88/R5-after-transcript.md) | [Normalized](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/146c93c89f529781/R5-normalized.diff) · [Raw](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/44436b4f4c9017b2/R5-raw.diff) | Real app; original injected error retained, 100ms backoff, second attempt succeeds on both; real reply completes. |
| R6 | [Source inventory](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f504a1f957f7e4c7/source-inventory.md) | [Source inventory](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f504a1f957f7e4c7/source-inventory.md) | No runtime capture required | Durable recheck precedes wrapper; optional race harness not run. |
| R7 | [Transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3b0647cd869ec046/R7-before-transcript.md) | [Transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2570ca15bbbc7e2f/R7-after-transcript.md) | [Normalized](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/81e14ea3f5d4fcde/R7-normalized.diff) · [Raw](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f7c4799ea1e863b2/R7-raw.diff) | LABELLED HARNESS; active durable cancellation, executor interruption, registration cleanup, synthetic successor and stable cancelled/1 after 35s on both. |
| R8 | [Transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/12eb0d52a9bb8ebc/R8-before-transcript.md) | [Transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ca6b2f9f5893ff09/R8-after-transcript.md) | [Normalized](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f76f978cf7f2ce2d/R8-normalized.diff) · [Raw](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7a8f743510f7984e/R8-raw.diff) | LABELLED HARNESS; non-stop effect stays running/1 beyond 35s and initial lease expiry, successor pending/0; explicit release then both succeed. |

Every transcript starts with the driver plan, actual UTC step times, durable transition timing and exact injection diff. It merges server log blocks, lossless append-only outbox transitions (timestamps, attempts, leases and complete errors) and persisted provider/message/run/checkpoint events. R7/R8 also include their exact synthetic executor source and milestones. Raw logs, manifests, normalized transcript inputs, invocation-specific script copies and selected-run manifest are in [the raw evidence archive](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b703acfd8a2d2a1c/runtime-evidence-raw.tar.gz). Database files and credentials are excluded.

[Runtime-record analysis](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7aad30558dd8dd12/capture-analysis.md) · [Verification](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ced6dbd5b595367c/verification.txt) · [Selected captures](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4675b1b2ac2a7648/selected-runs.json)

## What else changed

Differences beyond the PR's stop-timeout behavior are present in the recordings: generated identities and clocks, provider wording/usage/timing, cross-thread event interleaving, runtime diagnostic ordering, and cleanup transitions. These are disclosed below; the normalized and raw diffs preserve all payload/content differences. No additional product outcome regression was observed in the required fixtures. This is a bounded runtime observation, not a claim about all possible providers or hangs.

- R1: before remains running attempt 1 and later start stays pending/0 for more than 160s. After records five stop failures about 30s per attempt, persisted backoffs 100/200/400/800ms, terminal failed/5, and only then later real start, assistant reply, completed run and checkpoints. The extra provider/session/message/run/checkpoint events exist only after because that work unblocked. Before's subsequent SIGTERM cleanup requeues the stop and cancels unfinished work; it is separate from live behavior.
- R2: actual process loss and startup reconciliation occur on both sides. Both replay-safe stop rows requeue with 0ms delay, retain count 1, then claim attempt 2; both pre-crash process-bound pending starts cancel. Before stays running/2 for more than 130s. After attempts 2–5 time out with remaining backoffs 200/400/800ms, fail/5 and release only the new post-restart message, with real completed reply/run/checkpoints. Recovery warning counters and timestamps differ according to reached state. Before's final SIGTERM cleanup requeue/cancellation is separate from live behavior.
- R3: genuine stop succeeds on attempt 1 on both sides; claim-to-success is 63ms before, 54ms after. Both app-owned children have real running provider turns and both subsequent parent messages complete. The initial parent commentary differs: before “I’ll make the single requested local request and return the response verbatim.”; after “I’ll make the single requested request and return the raw response.” Provider tool-call/native-item identities, streaming payloads, token usage, timings and parent/child event ordering differ. Both finish with EVIDENCE_R3_NEXT, and all persisted event-type counts match between sides. No retry/timeout or product outcome difference appears.
- R4: before stays running/1 beyond 65s. After attempt 1 times out, 100ms backoff persists, attempt 2 succeeds after 25.009s, and later real start/reply/run/checkpoint follows stop success. No third attempt occurs. The extra provider/session/message/run/checkpoint events are downstream of unblocking. Before's SIGTERM cleanup is explicitly separate.
- R5: both retain EVIDENCE_R5_ORIGINAL_EXECUTOR_FAILURE after the 5s injected error, persist 100ms backoff, clear last_error on claim 2 and succeed on attempt 2 before releasing later real message. No Timed out cause replaces the original error. Actual execution/provider latency, diagnostic stack locations, IDs and timestamps differ; final behavior is preserved.
- R7 (labelled harness): both cancel the active stop at attempt 1 through the actual outbox service, interrupt the executor, clear cancellation registration and release the synthetic successor. Both remain cancelled/1 beyond 35s with no timeout retry. Recorded cancellation/settlement scheduling and clocks/IDs differ; no additional outcome difference appears. No actual provider reply is claimed.
- R8 (labelled harness): both keep non-stop checkpoint.capture running/1 beyond 35s and initial lease expiry, with later synthetic start pending/0. Both settle checkpoint then successor only after explicit gate release, without timeout/retry/reclaim. Recorded clocks and scheduling differ; no additional outcome difference appears. No actual checkpoint implementation behavior or provider reply is claimed.
- Across every pair: source commit/blob/hash and injection patch context reflect the requested before/after code; per-side checkout/home/project/output paths and UTC stamps differ. Random RPC command/message/task/provider-native/checkpoint IDs, bootstrap-derived nonsecret state, server/recorder/harness PIDs, lease owners, HTTP ports, git synthetic-commit identifiers, provider usage and telemetry counters, fiber numbers and source-stack line offsets can differ. Absolute dates/UUIDs/PIDs/ports/fibers/source hashes are normalized for the companion diff; statuses, attempts, errors, event content and ordering remain. Captured durations/backoffs remain in timing tables. Raw diffs retain every byte difference, including normalized-away identities.
- Startup diagnostics on both revisions include native resource telemetry sidecar unavailable and Codex rate-limit reads requiring first-party ChatGPT authentication. Their ordering/repetition depends on each observation window; neither prevents provider execution. Background/runtime activity and provider-event interleaving are not asserted to have deterministic order.
- Every before/after row uses the same driver version within that pair. R1 retains the inherited static hostname label in its original manifest; measured fs-37 is explicitly corrected in environment.txt and transcript headers. Later rows measure hostname. This provenance correction is unrelated to the source change.

R0/R6 have no minimum runtime capture: immutable source inventory confirms eligibility/bypass and durable-cancellation short-circuit before execution. The optional R6 harness was not run. The fixtures do not demonstrate recovery from synchronous JS blockage, uninterruptible work or hanging finalizers; source inventory records those limits.

## Scripts and reproduction

[Rebuild instructions](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7ed15d9b9e144239/README-rebuild.md)

- [run-captures.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/afc678a9e2eebf26/run-captures.py)
- [app-recording.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4531076ff52d61d3/app-recording.mjs)
- [seed-outbox.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2f5f4333df9b3e53/seed-outbox.py)
- [inject-fixture.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/71bdfb3a1e36ca14/inject-fixture.py)
- [worker-harness.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8ef7653bf4fd71b8/worker-harness.mjs)
- [capture-inventory.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dcbf82831a6ab142/capture-inventory.py)
- [assemble-evidence.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6525624703ff4f7d/assemble-evidence.py)
- [analyze-captures.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3d5c4465fbdf4e50/analyze-captures.py)
- [publish-evidence.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b59e5fa63530c92d/publish-evidence.py)

[Measured environment](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/653cb6ac9d5ea2e6/environment.txt) · [Immutable R0/R6 source inventory](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f504a1f957f7e4c7/source-inventory.md) · [Standalone difference inventory](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/739c6797635bdfcf/what-else-changed.md)

## Unverified and scope limits

No required row is unverified. R6 optional runtime race harness was not exercised because source inventory meets the requested minimum. R7/R8 are production-worker/SQLite harness captures, with synthetic executor outcomes/successors and no real-provider reply assertion. The stop bound requires cooperative interruption; synchronous blockage, uninterruptible regions and hanging finalizers are outside this demonstrated recovery. Direct subtree service calls bypass the wrapper.

All recorded owned server/harness processes exited before upload. The lead worktree was never edited or committed. No PR body, review or CI state was changed. Both scratch checkouts are removed before final handback; cleanup is reported separately after upload.

FRICTION:
- tool | Python urllib returned HTTP 403 for public evidence download; curl succeeded. | Use curl for this evidence host.
- infra | One curl download failed DNS resolution; an explicit IPv4 curl retry succeeded. Native resource telemetry sidecar was unavailable on both app revisions; fixture execution still completed. | Reliable DNS and a running optional telemetry sidecar would remove those warnings.
- brief | Brief and inherited script said hostname freestyle; measured hostname and ~/.agents/MACHINE are fs-37. Original R1 manifest retained; corrected environment recorded; later driver measures hostname. | Resolve hostname dynamically in provenance rather than carrying a static label.

Evidence capture agent: gpt-6.1-sol through Codex harness. App fixture provider: Codex CLI 0.163.0, gpt-5.6-sol.