Evidence capture for [#32587](https://git.cafe/pingdotgg/t3code/pull/32587), mirrored as [#32587](https://github.com/pingdotgg/t3code/pull/32587).

Captured **8 / 8 requested rows**: F02, F05, F11, F12, F14, F15, F17, F18. There are 38 qualifying runs. The six earlier fixture-development runs are labelled and excluded in [preliminary-captures.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/69d1cc7c73a9cbf7/preliminary-captures.txt).

Environment: Ubuntu 24.04.4 LTS, Linux x86_64, kernel 6.8.0-117-generic; `/bin/sh = dash 0.5.12-6ubuntu5`; Node v26.12.1; Python 3.12. Real archive runner 0.1.8-nightly.20261107.4314 for F02, updated to 0.1.9-nightly.20261110.4465 for F05. [environment.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/65f0278dbfbd0d6b/environment.json) contains source and archive hashes.

Every launch script was rendered through `launchOrReuseRemoteServer` from its own pinned checkout, then run locally with `/bin/sh -s -- <alias>`. A rerender using each checkout’s own shared-package sources was byte-identical for all six scripts. [evidence-manifest.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f5129f54c2bcf41f/evidence-manifest.json) records run locations, transcript hashes, and launch-script hashes.

All production timeout values remained unmodified. The PATH shim records `nohup` PIDs before exec, without replacing the real archive server. F14 audits `sleep`/`rm` commands. F18 holds a foreground command at a documented milestone, sends a signal to the tracked launch shell, and aborts that command before its file mutation so only the production EXIT cleanup can remove `.next`.

Each run used a fresh timestamped throwaway HOME under the capture directory and a sanitized environment. No existing T3 database was read or copied. The real archive runs created only disposable state. Pairing credential lines and QR glyphs are omitted from uploads; no private runtime model identifiers are included.

**F02: Warm archive, same alias**

| Before | After |
|---|---|
| SHA [0a9abddaee](https://git.cafe/pingdotgg/t3code/commit/0a9abddaee00ff1495e77a03dd4fafa73c3cd4cb) | SHA [29975cd79c](https://git.cafe/pingdotgg/t3code/commit/29975cd79ca419625cba29d698c34cc875f9c0a0) |
| Real archive 0.1.8-nightly.20261107.4314 | Real archive 0.1.8-nightly.20261107.4314 |
| Two starts; dead recorded PID; one ownership error; reconnect changes to external. | One start; record matches runtime/live PID; both launches and reconnect report managed. |
| [F02-before.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5537060b4dc90b36/F02-before.txt) | [F02-after.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c6b5d8a36e5c375e/F02-after.txt) |

Verdict: Pass on head; baseline reproduces the ownership regression.

**F05: Real runner update under contention**

| Before | After |
|---|---|
| SHA [0a9abddaee](https://git.cafe/pingdotgg/t3code/commit/0a9abddaee00ff1495e77a03dd4fafa73c3cd4cb) | SHA [29975cd79c](https://git.cafe/pingdotgg/t3code/commit/29975cd79ca419625cba29d698c34cc875f9c0a0) |
| Real archives 0.1.8-nightly.20261107.4314 -> 0.1.9-nightly.20261110.4465 | Real archives 0.1.8-nightly.20261107.4314 -> 0.1.9-nightly.20261110.4465 |
| Old managed PID is live. Of the two update launches, A exits 126 (Permission denied), B succeeds. One replacement survives. | Old managed PID stops; exactly one replacement starts on the new version; both updates exit 0; reconnect stays managed. |
| [F05-before.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6fbf36ae374a08fb/F05-before.txt) | [F05-after.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/755711441ed793ba/F05-after.txt) |

Verdict: Pass on head. This baseline exhibited a publication/permission race rather than two replacement starts; no claim of a double restart is made.

**F11: New child fails readiness**

| Before | After |
|---|---|
| SHA [0a9abddaee](https://git.cafe/pingdotgg/t3code/commit/0a9abddaee00ff1495e77a03dd4fafa73c3cd4cb) | SHA [29975cd79c](https://git.cafe/pingdotgg/t3code/commit/29975cd79ca419625cba29d698c34cc875f9c0a0) |
| Synthetic fixture: alive, owns unique port, returns HTTP 503, never publishes runtime | Synthetic fixture: alive, owns unique port, returns HTTP 503, never publishes runtime |
| Readiness fails after the native 60-second budget; child stopped; pid/port/managed files cleared; later launch succeeds. | Same failure cleanup, plus owned launch lock released; later launch obtains the lock and succeeds managed. |
| [F11-before.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/22198a9c039b98b9/F11-before.txt) | [F11-after.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dd85abdaa37a99a5/F11-after.txt) |

Verdict: Pass on both revisions for inherited failure cleanup; new lock release verified on head.

**F12: Runtime publication late or absent**

| Before | After |
|---|---|
| SHA [0a9abddaee](https://git.cafe/pingdotgg/t3code/commit/0a9abddaee00ff1495e77a03dd4fafa73c3cd4cb) | SHA [29975cd79c](https://git.cafe/pingdotgg/t3code/commit/29975cd79ca419625cba29d698c34cc875f9c0a0) |
| Synthetic fixture, two aliases: publication at 15 seconds, and never | Synthetic fixture, two aliases: publication at 15 seconds, and never |
| First alias succeeds. Second alias attempts another server, loses fixture home ownership, then fails readiness; two attempted starts total. | After the runtime-record deadline, second alias discovers the live sibling launch record and reports external while runtime JSON is still absent; one attempted start total. Late variant subsequently publishes; never variant remains absent. |
| [F12-before.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4254ad9a3e9d5935/F12-before.txt) | [F12-after.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6dc925aed13fbf65/F12-after.txt) |

Verdict: Pass on head for both late and never-published runtime variants.

**F14: Empty main launch lock**

| Before | After |
|---|---|
| SHA [0a9abddaee](https://git.cafe/pingdotgg/t3code/commit/0a9abddaee00ff1495e77a03dd4fafa73c3cd4cb) | SHA [29975cd79c](https://git.cafe/pingdotgg/t3code/commit/29975cd79ca419625cba29d698c34cc875f9c0a0) |
| Synthetic healthy fixture; command audit records production backoffs | Synthetic healthy fixture; command audit records production backoffs |
| Empty file is ignored and remains; no lock-grace backoffs or recovery operation. | Four sleep-1 backoffs, then recovery on the fifth empty observation; one managed child; both locks absent on success. |
| [F14-before.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a57878f02e3e883c/F14-before.txt) | [F14-after.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/cb53f6220807504c/F14-after.txt) |

Verdict: Pass on head; explicit command audit establishes the five-observation grace.

**F15: Abandoned recovery lock**

| Before | After |
|---|---|
| SHA [0a9abddaee](https://git.cafe/pingdotgg/t3code/commit/0a9abddaee00ff1495e77a03dd4fafa73c3cd4cb) | SHA [29975cd79c](https://git.cafe/pingdotgg/t3code/commit/29975cd79ca419625cba29d698c34cc875f9c0a0) |
| Synthetic runner; stale main PID plus empty/dead-owner break variants | Synthetic runner; stale main PID plus empty/dead-owner break variants |
| Both variants ignore the locks and start a server; seeded main and recovery locks remain. | No server start. Empty break exits 1 at 82.413 s; dead-owner break exits 1 at 82.327 s. Both seeded files unchanged; .next removed; diagnostic names .launch.lock.break. |
| [F15-before.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/39be4ec68db63914/F15-before.txt) | [F15-after.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7fb2eacfe1222585/F15-after.txt) |

Verdict: Pass on head. Capture follows the current brief: never auto-remove another recovery lock. The linked earlier matrix describes a superseded removal policy.

**F17: Bounded wait for a foreign live owner**

| Before | After |
|---|---|
| SHA [0a9abddaee](https://git.cafe/pingdotgg/t3code/commit/0a9abddaee00ff1495e77a03dd4fafa73c3cd4cb) | SHA [29975cd79c](https://git.cafe/pingdotgg/t3code/commit/29975cd79ca419625cba29d698c34cc875f9c0a0) |
| Synthetic runner; tracked live owner of main lock, or live break owner plus stale main | Synthetic runner; tracked live owner of main lock, or live break owner plus stale main |
| Launch ignores seeded foreign locks and starts a server. | Live main: exit 1 at 82.325 s with held-too-long diagnostic. Live recovery owner: exit 1 at 82.350 s naming the break file. No server start; foreign locks preserved; .next removed. |
| [F17-before.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/20909067242f9802/F17-before.txt) | [F17-after.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5aa24a10cd875ff3/F17-after.txt) |

Verdict: Pass on head with the unmodified full 82-second wait in both variants.

**F18: TERM / INT / HUP ownership cleanup**

| Before | After |
|---|---|
| SHA [0a9abddaee](https://git.cafe/pingdotgg/t3code/commit/0a9abddaee00ff1495e77a03dd4fafa73c3cd4cb) | SHA [29975cd79c](https://git.cafe/pingdotgg/t3code/commit/29975cd79ca419625cba29d698c34cc875f9c0a0) |
| Synthetic command gates before file mutation; nine head cases (3 signals x main owner / recovery owner / waiter) | Synthetic command gates before file mutation; nine head cases (3 signals x main owner / recovery owner / waiter) |
| At the comparable runner-move gate, all three signals terminate the shell and leak .next. Waiter/recovery milestones do not exist: baseline runs show no serialization and start a server, so those six baseline runs receive no signal. | Every signal exits 1. Main owner removes its main lock and .next, preserving foreign break. Recovery owner removes its break and .next, preserving stale foreign main. Waiter removes .next, preserving both foreign files. |
| [F18-before.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0ff76ff2b0c3fe79/F18-before.txt) | [F18-after.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4c5a87665ad8ec23/F18-after.txt) |

Verdict: Pass on head for all nine cases. PIPE/dropped-write behavior was not exercised and is not claimed.

**What else changed**

- The real F05 baseline exposed an additional `run-t3.sh: Permission denied` window (exit 126) while concurrent launches publish and chmod a changed runner. Neither head launch exhibited it.
- Catchable signals return the shell’s signal status before the fix (TERM -15, INT -2, HUP -1 as observed by Python), and the explicit trap returns exit 1 after the fix.
- With a live recovery owner, the bounded head diagnostic names the recovery file and gives manual recovery instructions, rather than the generic held-too-long message used for a live main owner.
- No other behavior differences beyond each row’s intended state/ownership changes were observed in these captures.

**Reproduction and scripts**

Put the downloaded scripts in `/tmp/lead-32587-r1/capture/`. With the main checkout dependencies installed, run `python3 prepare-runtime.py`, then `python3 run-matrix.py`. The preparation driver downloads and verifies both published archives, creates the two pinned sibling checkouts, and renders the scripts. The matrix driver runs cases sequentially to avoid fixture port interference. The capture driver always creates a fresh timestamped run directory and cleans up recorded processes. Remove only your own two capture worktrees afterward. The five `seed-*` scripts were copied from the provided implementation drivers; `render.mjs` is the adapted renderer.

- [capture.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/45789d9c09eac882/capture.py)
- [fixture-t3.cjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3eaaf9e32ee4fce1/fixture-t3.cjs)
- [command-shim.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4d091d7cba41a43b/command-shim.py)
- [render.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/df146ac330801c85/render.mjs)
- [prepare-runtime.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5c198ee4776245ed/prepare-runtime.py)
- [run-matrix.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c59630270c772ab6/run-matrix.py)
- [collect-evidence.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/35c511d26c50c538/collect-evidence.py)
- [seed-fake-t3.cjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f01e9846dda81c93/seed-fake-t3.cjs)
- [seed-launch-check.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4495fbf4ca04e453/seed-launch-check.py)
- [seed-lock-race-v2.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8f44bd6aa832c13a/seed-lock-race-v2.py)
- [seed-render.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/fca18ae8f8c7d140/seed-render.mjs)
- [seed-stale-break-e2e.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/de7d29f418db18d6/seed-stale-break-e2e.py)

**Rendered production scripts**

- [before-node.sh](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3a546ede4016cd3b/before-node.sh)
- [after-node.sh](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/53b907a1e503b462/after-node.sh)
- [before-archive.sh](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/04e574e8feff001c/before-archive.sh)
- [after-archive.sh](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c493270398b9f5ad/after-archive.sh)
- [before-new-archive.sh](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/52a77753f0083c19/before-new-archive.sh)
- [after-new-archive.sh](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a1160730d9d306f9/after-new-archive.sh)

Unverified requested rows: **none**. These are local rendered-shell captures, not a real two-desktop SSH run. No additional proof is claimed for PIPE or unsupported shells/surfaces. Previously covered rows were not recaptured.

Cleanup: all 33 recorded server PIDs from qualifying and preliminary runs were stopped; every driver reports no live tracked servers after cleanup. All tracked foreign-owner fixture processes were reaped. Both capture worktrees were removed. Main checkout is clean; the lead’s checkout was untouched. Scratch evidence is retained under `/tmp/lead-32587-r1/capture/`. Nothing was committed, pushed, or written to the PR.

FRICTION:

- tool | Bun 1.3.14 could not load node:sea while rendering | Run the renderer under the installed Node runtime.
- infra | Initial unready fixtures did not reserve their ports, so concurrent synthetic runs could answer each other’s readiness probes | Use an ephemeral port and a fixture that binds it and returns HTTP 503; corrected runs replaced the initial evidence.
- runbook | The first signal gate allowed mv before cleanup, weakening the temporary-runner assertion | Abort the gated mutation after delivering the signal; final runs prove cleanup alone removes the file.
- brief | The linked older F15 matrix expects stale recovery-lock removal, while the supplied current-head brief explicitly requires preservation | Update the audit matrix for the pinned head; this capture follows the explicit current brief.