# Runtime evidence for [#33628](https://git.cafe/pingdotgg/t3code/pull/33628)

Captured 2026-11-10 UTC. **8 of 13 matrix rows fully captured; all 8 minimum rows captured** (A1–A3, B1–B3, C2–C3). C2/C3 share one recording per revision: 14 timestamped transcripts total. The remaining five non-minimum rows are explicitly listed below.

Before = [53bcb9af7a](https://git.cafe/pingdotgg/t3code/commit/53bcb9af7a37dd0b4df11a7d6fa0106e9e5b7356); after = [e039e17308](https://git.cafe/pingdotgg/t3code/commit/e039e17308b32c280903c5dd4cd82f2457e0d8f0). Every accepted run used exactly the same driver, stub, and runner bytes; SHA-256 hashes are in each transcript and [accepted-captures.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/be2f076a845e07cc/accepted-captures.json).

**Environment:** Linux 6.1.102 x86_64, glibc 2.39, Node v26.13.0. Production-runtime harness, synthetic config and stub connector: real CloudManagedEndpointRuntime, real Node spawner with a passive observer on its exit-result Effect, stub cloudflared in the server process group. **Not a real Cloudflare tunnel or desktop measurement.**

A/B use NodeRuntime.runMain. C2/C3 use an explicitly labelled Effect.runPromise host that survives parent-only SIGINT and SIGTERM, allowing runtime scopes to close and rebuild in one process. Host listener identities are measured, not just counts.

Only synthetic tunnel-1/synthetic-token and a fresh ServerConfig.layerTest base directory per run were used. No T3 database was read, copied, seeded, or uploaded. No tracked files, commits, or PR body were changed. All started process groups were empty after their recordings. The temporary before worktree was removed.

AI-assisted; verified with the tests and tools listed above.

## Row index

Each transcript contains timestamped runner milestones, complete driver output, full relay-client NDJSON, full stub log, measured durations, recovery events, script hashes, and tracked process-group cleanup. Durations are individual observations; they are not benchmark averages.

| Row | Before transcript / stop | After transcript / stop | Observed result |
|---|---|---|---|
| A1 | [A1-before-transcript.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/33bcd2e4083b3793/A1-before-transcript.md); 3372 ms | [A1-after-transcript.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/15871481d4bdf201/A1-after-transcript.md); 1073 ms | Before: replacement + 1 recovery during predecessor; after: no replacement or recovery. |
| A2 | [A2-before-transcript.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9a4877dd030b215e/A2-before-transcript.md); 3349 ms | [A2-after-transcript.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f97d88ec36b57fee/A2-after-transcript.md); 1042 ms | SIGINT independently reproduces before restart/recovery and after suppression; stub records actual signal. |
| A3 | [A3-before-transcript.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/187793d0b7cff6c9/A3-before-transcript.md); 68 ms | [A3-after-transcript.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/493238704c8cc252/A3-after-transcript.md); 72 ms | Both: one original connector, no restart/recovery; fast-finalizer ordering control. |
| B1 | [B1-before-transcript.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5d3f24693331ee4e/B1-before-transcript.md); 63 ms | [B1-after-transcript.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/08a3bfa12086042c/B1-after-transcript.md); 66 ms | Both: exit 1 causes one recovery and one replacement before server signal; later fast shutdown adds neither. |
| B2 | [B2-before-transcript.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6756ae7af5db6fec/B2-before-transcript.md); 3360 ms | [B2-after-transcript.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ebd549341de69243/B2-after-transcript.md); 1041 ms | Exit 1 observed under public reconcile lock, then SIGTERM releases gate: before restarts/requests recovery; after neither. |
| B3 | [B3-before-transcript.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8d2458d8bd9e11f8/B3-before-transcript.md); 3955 ms | [B3-after-transcript.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a76c180350af85b0/B3-after-transcript.md); 1641 ms | Both enter recorded 1000ms backoff; server signalled during delay, predecessor 1600ms. Before third connector + second recovery; after stops second child beyond delay without either. |
| C2 | [C2-C3-before-transcript.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a31fc682db4b988c/C2-C3-before-transcript.md); 43 ms (scope close) | [C2-C3-after-transcript.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f2ef51f288fc6eb3/C2-C3-after-transcript.md); 34 ms (scope close) | Both: no OS signal, explicit runtime scope close stops original without restart/recovery; host survives. |
| C3 | [C2-C3-before-transcript.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a31fc682db4b988c/C2-C3-before-transcript.md); 25 ms signalled scope; 26 ms fresh scope | [C2-C3-after-transcript.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f2ef51f288fc6eb3/C2-C3-after-transcript.md); 26 ms signalled scope; 27 ms fresh scope | Before listeners 1→1→1; after 1→2→1 for both signals, exact host identities preserved after every close. Signalled layer closes, fresh layer recovers normally from exit 1. |

## What else changed

- The new layer adds one SIGINT and one SIGTERM listener while live. C3 records before 1→1→1 and after 1→2→1, and exact restoration of the unrelated host listeners. Three successive scopes per side restore the baseline. Both sides recover normally on the fresh layer after the previous layer received both signals.
- Fast teardown A3 measured 68 ms before and 72 ms after; B1 shutdown measured 63 ms before and 66 ms after. Both controls keep the same spawn/recovery counts and add no shutdown replacement. These small single-run timing differences do not establish a regression.
- C2 no-signal scope close measured 43 ms before and 34 ms after; C3 signalled close 25/26 ms, fresh close 26/27 ms. No extra lifecycle recovery or spawn was observed.
- PIDs, fiber IDs, timestamps, and short-lived uptime measurements differ between runs. NodeRuntime exits with code 130 on both SIGINT and SIGTERM in both revisions. This is its interrupt exit status, not a connector crash.
- The stub retains the original age-based shutdown model: a stop before age 2000 ms takes 2300 ms, otherwise 15 ms. Its 2100 ms marker is synthetic age, not Cloudflare registration. Timers for this model, the predecessor finalizer, and the production crash backoff are deliberate fixture behavior; ordering gates use observed events. No unrelated semantic difference was observed in the captured rows.

## Unverified rows and limits

| Row | Status and reason |
|---|---|
| C1 | Unverified; non-minimum boundary. Did not signal the original connector during its synthetic slow-stop window. A1/A2 show a replacement in that state only. |
| D1 | Partial; A1/A2 capture clean exit 0 and B1/B2/B3 capture exit 1. The untrapped-signal / failed exitCode Effect variant was not enacted; non-minimum beyond the requested clean/nonzero controls. |
| D2 | Unverified as a row; non-minimum unchanged config/policy/executable/stale-ownership branches were not enacted. This harness intentionally uses one allowed synthetic managed configuration and available stub executable. No private runtime refs were mutated. |
| D3 | Unverified as a row; B2 uses the public restartConnector lock with a false stillDead result, but does not claim forced-restart, watchdog, install, registration/auth, HTTP/2 fallback, or external recovery shutdown coverage. Those independent paths are outside the requested minimum. |
| E1 | Unverified; no real linked macOS desktop plus actual cloudflared recording was run. These Linux synthetic harness timings do not establish real Cloudflare or macOS timing. |

The evidence establishes suppression in the connector supervisor after it observes shutdown, including lock and backoff waits. It does not establish a universal no-spawn-after-signal barrier or cancellation of a restart that already passed that guard. The recovery stream is observed, not consumed by a real CloudLink service.

## Reproduction and artifacts

Run `run.sh WORKTREE before|after ROW` from any directory, using the script directory `/tmp/lead-33628-r1/capture-1/` as supplied. Supported rows: A1, A2, A3, B1, B2, B3, C2-C3. Install checkout dependencies first. The runner makes a new timestamped output directory; it never reuses or deletes a previous capture. Module resolution is anchored to the selected checkout; shared import-only sources are loaded from that checkout.

Real children are spawned by the Node spawner; the wrapper observes exit results and preserves them. B2 holds only the public `restartConnector` predicate and releases it on the recorded host signal. B3 gates on the production 1000 ms backoff log before signalling and keeps the runtime open for 1600 ms. Only captured child PIDs and the session/process group captured at spawn are signalled.

[driver.ts](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/bbb5fd640808f153/driver.ts)

[cloudflared-stub.sh](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/26d12175037ab677/cloudflared-stub.sh)

[cloudflared-stub.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f877be7b3b4c78c5/cloudflared-stub.mjs)

[runner.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/81073d8a69614f39/runner.py)

[run.sh](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e84548b16351ca1b/run.sh)

[accepted-captures.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/be2f076a845e07cc/accepted-captures.json)

[raw-recordings.tar.gz](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/44f974ce38afce75/raw-recordings.tar.gz)

[proof-matrix.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ddf9a4dfca62a112/proof-matrix.md)

Raw archive contains the 14 accepted recordings’ runner/driver/relay/stub logs and summaries, plus provenance. Preliminary harness bring-up captures remain locally in scratch, are excluded from accepted results, and have not been deleted.

## Friction

```text
FRICTION:
tool | Web fetch could not open the matrix artifact; curl succeeded | direct raw-file download support.
runbook | Recreated harness needed import-only shared-module resolution and explicit precedence for its real-spawner observer; preliminary attempts excluded | archive the original runnable harness directory.
tool | Runner initially added up to 1s after process exit while waiting for reaping; EOF-driven completion fixed it and all accepted rows were recaptured | measure completion through EOF plus process.wait from the outset.
```