Real-app recovery reproduction

Run the base and head app from separate checkouts using `T3CODE_DEV_SEED=0 vp run dev` and fresh isolated T3 homes. Install OpenCode 2.0.28 in scratch space. Configure the app's OpenCode provider with Server URL empty and its binary path pointing to owned-opencode.mjs. That launcher starts the real CLI and exposes its real HTTP responses through a latency proxy; it does not synthesize replies or events. Its credentials come from a private local OpenCode configuration, excluded from these artifacts.

Create an empty git repository as `.t3/recovery-evidence` in each checkout and add it using the app's `project add` CLI. Use drive.py start with the same available model provided through PROOF_MODEL, three threads and the same synthetic prompt. Wait until all three native bash tools are running.

Record the real browser, with a 1280x800 viewport, light theme, the Working shelf expanded and thread details closed. The model selector is hidden solely to redact private operational metadata.

Run drive.py stall for each side in a detached subprocess (start_new_session=True), supplying the checkout and the launcher's artifact directory. It delays history reads by 20 seconds, suspends only the captured native child PID for 70 seconds, then resumes that PID. Do not send any follow-up prompts. Observe base failure versus head completion. Query the real app through drive.py status and query native session activity with native-status.py after setting the base proxy delay to zero once the app has failed.

No repository tests are used as evidence. AI-assisted; verified with the tests and tools listed above.
Repeat Stop with one new thread on each side, the same prompt, the same 70-second suspension and a 60000-ms history delay. Once the delayed history request is in flight, click the web client's Stop generation button. The recorded clicks were 22:31:17.300Z (head) and 22:31:17.354Z (base); their interrupt requests reached the proxy at 22:31:17.334Z and 22:31:21.198Z respectively. Keep recording through the late history response. The head remains interrupted afterwards. The supplementary Stop recordings redact the machine label in the details panel with a fixed white rectangle. No turn content or status is redacted.

For the separate process-exit check, start one new thread with the same prompt on each side, wait for its sleep tool to start, and send SIGKILL only to the native PID in the launcher's owned.json. Both app turns settled as interrupted (Stopped by the provider), so this does not establish the requested failed outcome on process exit during recovery. The supplementary exit videos use the same machine-label redaction.