Busy page retires a healthy socket: 194 drops/min with 65 sessions (prod) #245

Closed
opened 2026-10-18 17:27:59 +00:00 by kayg · 78 comments
Owner

Production 2026-10-18 ~22:50 IST, owner's desktop browser (Console view, 65 sessions): after refresh and CA unlock, keeps showing "The connection did not respond in time." / "The server stopped hearing from this browser." Server journal: closed 194 times in 60 s, reason websocket_closed, who=browser, websocket_code=4000 websocket_reason="connection unresponsive" — the BROWSER retires the socket. Server load 0.28, no restarts.

Cause (hypothesis, to be proven): apps/tracer/src/connection.ts checkLiveness() retires the single shared socket when a pong is later than responseAllowance() = max(250, srtt + 4·rttvar + 50) ms (~300 ms at India↔Germany RTT). With 65 terminals attaching/drawing, the page's main thread stalls longer than that, the pong waits unprocessed in the task queue, the page retires the socket, all 65 streams reattach, the main thread stalls again: a loop. Same family as #244 (phone).

Production 2026-10-18 ~22:50 IST, owner's desktop browser (Console view, 65 sessions): after refresh and CA unlock, keeps showing "The connection did not respond in time." / "The server stopped hearing from this browser." Server journal: `closed 194 times in 60 s, reason websocket_closed`, who=browser, websocket_code=4000 websocket_reason="connection unresponsive" — the BROWSER retires the socket. Server load 0.28, no restarts. Cause (hypothesis, to be proven): apps/tracer/src/connection.ts `checkLiveness()` retires the single shared socket when a pong is later than `responseAllowance()` = max(250, srtt + 4·rttvar + 50) ms (~300 ms at India↔Germany RTT). With 65 terminals attaching/drawing, the page's main thread stalls longer than that, the pong waits unprocessed in the task queue, the page retires the socket, all 65 streams reattach, the main thread stalls again: a loop. Same family as #244 (phone).
377 KiB
9.5 KiB
325 KiB
7.6 KiB
393 KiB
1.4 KiB
427 KiB
413 KiB
322 KiB
11 KiB
287 KiB
Author
Owner

Start #245: branch busy-page-liveness at production base a906ede871. Read issue and related #234/#244 histories (no parent listed). Scope is web-only. Baseline has an expiry check in acceptPong as well as checkLiveness, so either task order can retire a busy page. Reading #244 compatibility changes without merging. Reproduce on production build, add failing controls, preserve responsive-page dead-link detection, then scoped checks, full fast, production web artifact and branch push; no deployment.

Start #245: branch busy-page-liveness at production base a906ede87110465c08ecde0d811c8eca2cbe08cc. Read issue and related #234/#244 histories (no parent listed). Scope is web-only. Baseline has an expiry check in acceptPong as well as checkLiveness, so either task order can retire a busy page. Reading #244 compatibility changes without merging. Reproduce on production build, add failing controls, preserve responsive-page dead-link detection, then scoped checks, full fast, production web artifact and branch push; no deployment.
Author
Owner

Step 1 pushed: 6bd956cc0. Only tracer connection code/regressions changed. Baseline controlled-clock suite: 30 pass / 4 fail (1 s and 60 s stalls, both task orders). After: all 48 connection tests pass, 146 assertions; strict TypeScript and fmt pass. Timer lateness is credited once; retirement yields a task; correlated queued pongs recover without training RTT from renderer wait. Responsive-page allowance/probe cadence unchanged. Rejected blanket deadline inflation and additional continuous polling.

Real production binary/bundle on locked perf VM: one idle 1 s main-thread block at 150 ms RTT produces a client 4000 "connection unresponsive" close (load 0.63/0.40/0.34). The many-window harness first exposed layout reload restoring 1 rather than 65 windows, so the focused measurement now reconnects the existing 65 windows together. Baseline/final scale and idle-dead-link rows are underway. #244 read: its visibility, refusal and allowance changes are not merged; the new lag accounting is independent of its allowance formula. Full iterate is queued behind the host build slots. No deployment.

Step 1 pushed: 6bd956cc0. Only tracer connection code/regressions changed. Baseline controlled-clock suite: 30 pass / 4 fail (1 s and 60 s stalls, both task orders). After: all 48 connection tests pass, 146 assertions; strict TypeScript and fmt pass. Timer lateness is credited once; retirement yields a task; correlated queued pongs recover without training RTT from renderer wait. Responsive-page allowance/probe cadence unchanged. Rejected blanket deadline inflation and additional continuous polling. Real production binary/bundle on locked perf VM: one idle 1 s main-thread block at 150 ms RTT produces a client 4000 "connection unresponsive" close (load 0.63/0.40/0.34). The many-window harness first exposed layout reload restoring 1 rather than 65 windows, so the focused measurement now reconnects the existing 65 windows together. Baseline/final scale and idle-dead-link rows are underway. #244 read: its visibility, refusal and allowance changes are not merged; the new lag accounting is independent of its allowance formula. Full iterate is queued behind the host build slots. No deployment.
Author
Owner

Step 2 pushed: 17d8da5c7. Added exact-deadline task-order controls independently of lag credit: correlated queued Pong saves the route; wrong timestamp does not. All 50 connection tests pass / 150 assertions, strict TypeScript passes.

Raw receipts:
baseline: 4 regression failures
after: 50 connection tests
preliminary production-browser run
clean baseline scale run

The scale fixture confirms 65 distinct real attached sessions. Preliminary run after an idle block: 2 liveness closes / 60,202 ms. Clean-start baseline: 0 / 60,247 ms, but only 37 windows live and 28 reconnecting after the forced route restart. These are not a claimed production-rate reproduction (194/min) or a healthy 65-window result. The idle 1 s block consistently reproduces one liveness close. Strengthening scale to show all windows and verifying all 65 live on the final branch. Final browser attempts also encountered cold-navigation ERR_NETWORK_CHANGED; fixture startup is being retried with its disposable TLS front explicitly trusted, before any measurements. Build-slot iterate still queued. No deployment.

Step 2 pushed: 17d8da5c7. Added exact-deadline task-order controls independently of lag credit: correlated queued Pong saves the route; wrong timestamp does not. All 50 connection tests pass / 150 assertions, strict TypeScript passes. Raw receipts: [baseline: 4 regression failures](https://git.kayg.org/attachments/22e52931-a321-473a-b22d-5e0718cade91) [after: 50 connection tests](https://git.kayg.org/attachments/53e81e7a-d2e1-4819-a9b5-42cb96c8022f) [preliminary production-browser run](https://git.kayg.org/attachments/1078e761-57d8-431a-8fc3-630127b016c2) [clean baseline scale run](https://git.kayg.org/attachments/7132283f-812a-4cfb-b91c-6bdadc22b70c) The scale fixture confirms 65 distinct real attached sessions. Preliminary run after an idle block: 2 liveness closes / 60,202 ms. Clean-start baseline: 0 / 60,247 ms, but only 37 windows live and 28 reconnecting after the forced route restart. These are not a claimed production-rate reproduction (194/min) or a healthy 65-window result. The idle 1 s block consistently reproduces one liveness close. Strengthening scale to show all windows and verifying all 65 live on the final branch. Final browser attempts also encountered cold-navigation ERR_NETWORK_CHANGED; fixture startup is being retried with its disposable TLS front explicitly trusted, before any measurements. Build-slot iterate still queued. No deployment.
Author
Owner

Pushed steps 95c8afbaf (one task per restored renderer initialization) and 97b8c0588 (real production browser measurement spec). Current head 97b8c0588; web-only, no server source/dependency changes, no deployment. Production web build with index.html and passing transfer budget is at /home/kayg/.cache/codex-scratch/busy-page-liveness/web. Rechecking this exact final bundle now.

Locked perf VM: Linux 6.12.111, 4 CPUs, MemTotal 8,069,112 kB. Real production binary is merge-base release-4 artifact SHA-256 c821a30a063b982c813ce7e5ca61eee7ee5f21e4f3bff29c95eb5c2f2ca193b1. Same real sessions, production bundle, 150 ms relay RTT, 6x browser CPU, valid saved 13x5 layout, fresh page reload:

  • Production baseline: 3 client 4000 liveness closes / 63,458.6 ms = 2.84/min; 65 live at finish, longest task 3,997 ms. This reproduces the fault, not the exact production 194/min rate.
  • Liveness fix alone: 0 / 63,027.4 ms; 65 live, longest task 3,471 ms.
  • Plus per-renderer task yield: 0 / 62,826.5 ms; 65 live, longest task 957 ms. The work no longer runs all renderer creation continuations in one microtask batch. This is not a claim that all layout/GC tasks meet the frame budget.

Five retained-real-socket/backend-stop trials, browser page responsive, retirement medians: LAN baseline 266.4 ms -> fix 268.1 ms; 150 ms baseline 186 ms -> fix 156.1 ms (probe phase explains variation; no slowdown demonstrated). Reconnecting medians are 266.6 -> 268.2 ms and 186.1 -> 156.2 ms. #234 D300 host-link notice/retirement numbers (LAN 270.2/544.1 ms; 150 ms 454.2/830.1 ms) concern the other leg; native binary unchanged here.

One idle 1 s main-thread block at 150 ms: baseline one client liveness close, fix zero. LAN also produces a non-4000 close during this deliberately long block in both variants; this web-only patch does not alter native liveness. Interactive fixture construction before the valid-grid reload also exposes native reply timeouts/protocol refusals/resume-refusal loops, separately recorded; #244 is not merged. The valid reload runs above nevertheless finish with all 65 real sessions live.

Receipts:
baseline grid
final code variant, normal grid run
core fix grid
retained real-socket 150 ms trials
native construction diagnostic
measurement driver source

Trace-heavy diagnostic is deliberately not the headline measurement: zero client liveness closes but all windows reconnecting under additional trace collection overhead. Remaining longest categories include microtasks, layout and GC; no engine choice or broad renderer rewrite added to this hotfix. Diagnostic receipt.

Compatibility dry-run only (no merge): #244 has three small textual overlaps in sampleRoundTrip guard, checkLiveness guard, and Welcome timer setup. Keep #244 hidden-page guards and allowance, then this lag credit/due timestamp; initialize due only when Welcome arms its foreground timer. Existing 250 ms test assumptions need #244's own 500 ms bounds when integrated.

Validation ongoing: stopped the partial iterate after its cold compilation phase to avoid running the whole native matrix twice after implementation was complete. It is not a passing gate. Full scripts/verify fast is now queued/running on committed 97b8c0588, reusing the same job target, with static builds and every row enabled. Logs: /home/kayg/.cache/codex-scratch/busy-page-liveness/evidence/fast.log. Final gate, exact-head browser receipts, binary delta and cleanup follow. Issue remains open.

Pushed steps 95c8afbaf (one task per restored renderer initialization) and 97b8c0588 (real production browser measurement spec). Current head 97b8c0588; web-only, no server source/dependency changes, no deployment. Production web build with index.html and passing transfer budget is at /home/kayg/.cache/codex-scratch/busy-page-liveness/web. Rechecking this exact final bundle now. Locked perf VM: Linux 6.12.111, 4 CPUs, MemTotal 8,069,112 kB. Real production binary is merge-base release-4 artifact SHA-256 c821a30a063b982c813ce7e5ca61eee7ee5f21e4f3bff29c95eb5c2f2ca193b1. Same real sessions, production bundle, 150 ms relay RTT, 6x browser CPU, valid saved 13x5 layout, fresh page reload: - Production baseline: 3 client 4000 liveness closes / 63,458.6 ms = 2.84/min; 65 live at finish, longest task 3,997 ms. This reproduces the fault, not the exact production 194/min rate. - Liveness fix alone: 0 / 63,027.4 ms; 65 live, longest task 3,471 ms. - Plus per-renderer task yield: 0 / 62,826.5 ms; 65 live, longest task 957 ms. The work no longer runs all renderer creation continuations in one microtask batch. This is not a claim that all layout/GC tasks meet the frame budget. Five retained-real-socket/backend-stop trials, browser page responsive, retirement medians: LAN baseline 266.4 ms -> fix 268.1 ms; 150 ms baseline 186 ms -> fix 156.1 ms (probe phase explains variation; no slowdown demonstrated). Reconnecting medians are 266.6 -> 268.2 ms and 186.1 -> 156.2 ms. #234 D300 host-link notice/retirement numbers (LAN 270.2/544.1 ms; 150 ms 454.2/830.1 ms) concern the other leg; native binary unchanged here. One idle 1 s main-thread block at 150 ms: baseline one client liveness close, fix zero. LAN also produces a non-4000 close during this deliberately long block in both variants; this web-only patch does not alter native liveness. Interactive fixture construction before the valid-grid reload also exposes native reply timeouts/protocol refusals/resume-refusal loops, separately recorded; #244 is not merged. The valid reload runs above nevertheless finish with all 65 real sessions live. Receipts: [baseline grid](https://git.kayg.org/attachments/4bed6a11-dd38-42d7-95a8-1acad4cf83b7) [final code variant, normal grid run](https://git.kayg.org/attachments/ee0decef-10ad-45f5-af67-7612c2a5478f) [core fix grid](https://git.kayg.org/attachments/153c3368-443d-4258-ba84-a00c31add34c) [retained real-socket 150 ms trials](https://git.kayg.org/attachments/9e5414f7-02cd-4bc1-849c-c6c904ac9e27) [native construction diagnostic](https://git.kayg.org/attachments/c900a797-5611-4c5e-9f1e-f091b44e85ee) [measurement driver source](https://git.kayg.org/attachments/bd5b39a1-8c32-4db3-a745-d6fe5b36e1f1) Trace-heavy diagnostic is deliberately not the headline measurement: zero client liveness closes but all windows reconnecting under additional trace collection overhead. Remaining longest categories include microtasks, layout and GC; no engine choice or broad renderer rewrite added to this hotfix. [Diagnostic receipt](https://git.kayg.org/attachments/537c763f-2afb-4655-aea2-a88691b16fca). Compatibility dry-run only (no merge): #244 has three small textual overlaps in sampleRoundTrip guard, checkLiveness guard, and Welcome timer setup. Keep #244 hidden-page guards and allowance, then this lag credit/due timestamp; initialize due only when Welcome arms its foreground timer. Existing 250 ms test assumptions need #244's own 500 ms bounds when integrated. Validation ongoing: stopped the partial iterate after its cold compilation phase to avoid running the whole native matrix twice after implementation was complete. It is not a passing gate. Full scripts/verify fast is now queued/running on committed 97b8c0588, reusing the same job target, with static builds and every row enabled. Logs: /home/kayg/.cache/codex-scratch/busy-page-liveness/evidence/fast.log. Final gate, exact-head browser receipts, binary delta and cleanup follow. Issue remains open.
Author
Owner

Exact committed-head production web bundle validation (97b8c05883) is complete. 265 web files, index.html present; commit embedded in chunk-y8m37s0y.js. Critical gzip 300,328/307,200 B, +146 B vs production baseline; deferred 49,078/51,200 B. Artifact remains at /home/kayg/.cache/codex-scratch/busy-page-liveness/web.

Final locked perf-VM runs: 65 real sessions, 150 ms RTT, 6x CPU -> 0 client liveness closes / 63,785.4 ms, all 65 live. Longest cold-start task 1,515 ms (the earlier untraced yield trial was 957 ms); do not treat the best single sample as a universal bound. Baseline was 3 / 63,458.6 ms = 2.84/min. One idle 1 s block at 150 ms -> zero closes; LAN still sees a non-4000 close, as baseline does. Five exact-bundle dead-link retirement medians: LAN 262.9 ms, 150 ms 162.2 ms; baseline 266.4/186 ms. Reconnecting medians 262.9/162.2 ms. Native server unchanged.

final 65-session receipt
final 150 ms idle/dead-link trials
final LAN idle/dead-link trials
final production build, 65 sessions
production build and transfer budget

Additional existing browser suite at 150 ms: 5 functional tests pass (including typing recovery with both/up/down stopped, passkey, terminal resume/input); the first-paint case fails on both original and final bundles. Screenshot upper bounds setup/signin: baseline 1306/1091 ms, final 1032/1080 ms. No budget changed or test waived. The unmodified zero-RTT local first-paint profile passes (459/305 ms). All 50 connection tests pass, 150 assertions.
browser controls
same first-paint failure on baseline
local first-paint pass

Full fast: fmt, VT fmt, CLI compile-out and clippy pass. Native test row stopped only because previous_attempt_shell.py:25 requires INFRATERNAL_TEST_RUNTIME_HELPER, absent from the launch environment. The existing target/debug/examples/recovery-helper is built; isolated rerun passes with that variable set. No server/test source is changed. The first attempt is completing both static builds; a complete second fast run is queued immediately afterwards with INFRATERNAL_TEST_RUNTIME_HELPER=/home/kayg/.cache/codex-scratch/busy-page-liveness/target/debug/examples/recovery-helper, same target and all rows enabled. Final gate and static delta are still pending; do not call the partial gate green.

Perf VM cleanup is complete: zero owned executable/cwd references, then all owned VM folders removed. Host target/runtime cleanup waits for the gate.
zero-process audit
VM folder cleanup

Exact committed-head production web bundle validation (97b8c058839e9b7163d7d159036e7c7e0f1a0cce) is complete. 265 web files, index.html present; commit embedded in chunk-y8m37s0y.js. Critical gzip 300,328/307,200 B, +146 B vs production baseline; deferred 49,078/51,200 B. Artifact remains at /home/kayg/.cache/codex-scratch/busy-page-liveness/web. Final locked perf-VM runs: 65 real sessions, 150 ms RTT, 6x CPU -> 0 client liveness closes / 63,785.4 ms, all 65 live. Longest cold-start task 1,515 ms (the earlier untraced yield trial was 957 ms); do not treat the best single sample as a universal bound. Baseline was 3 / 63,458.6 ms = 2.84/min. One idle 1 s block at 150 ms -> zero closes; LAN still sees a non-4000 close, as baseline does. Five exact-bundle dead-link retirement medians: LAN 262.9 ms, 150 ms 162.2 ms; baseline 266.4/186 ms. Reconnecting medians 262.9/162.2 ms. Native server unchanged. [final 65-session receipt](https://git.kayg.org/attachments/1f66c1e4-a785-42e2-b96f-7b80661c7984) [final 150 ms idle/dead-link trials](https://git.kayg.org/attachments/8eb38201-c8c7-4ec2-b96c-69c598e7f46a) [final LAN idle/dead-link trials](https://git.kayg.org/attachments/ec078fce-37b2-44ef-af89-4b8800d877e7) ![final production build, 65 sessions](https://git.kayg.org/attachments/25afd0df-7b3b-49a8-bf86-469f15d8e8fe) [production build and transfer budget](https://git.kayg.org/attachments/c9021ff4-23b5-46a3-abde-fedaf22e46d6) Additional existing browser suite at 150 ms: 5 functional tests pass (including typing recovery with both/up/down stopped, passkey, terminal resume/input); the first-paint case fails on both original and final bundles. Screenshot upper bounds setup/signin: baseline 1306/1091 ms, final 1032/1080 ms. No budget changed or test waived. The unmodified zero-RTT local first-paint profile passes (459/305 ms). All 50 connection tests pass, 150 assertions. [browser controls](https://git.kayg.org/attachments/4670099d-2ae9-41b5-947c-2c7fcb9a03fb) [same first-paint failure on baseline](https://git.kayg.org/attachments/2e716b7a-a2ab-4bf9-b324-eaa6b2a2479f) [local first-paint pass](https://git.kayg.org/attachments/0832c3a4-f55a-4576-bee3-f62c2eb404f5) Full fast: fmt, VT fmt, CLI compile-out and clippy pass. Native test row stopped only because previous_attempt_shell.py:25 requires INFRATERNAL_TEST_RUNTIME_HELPER, absent from the launch environment. The existing target/debug/examples/recovery-helper is built; isolated rerun passes with that variable set. No server/test source is changed. The first attempt is completing both static builds; a complete second fast run is queued immediately afterwards with INFRATERNAL_TEST_RUNTIME_HELPER=/home/kayg/.cache/codex-scratch/busy-page-liveness/target/debug/examples/recovery-helper, same target and all rows enabled. Final gate and static delta are still pending; do not call the partial gate green. Perf VM cleanup is complete: zero owned executable/cwd references, then all owned VM folders removed. Host target/runtime cleanup waits for the gate. [zero-process audit](https://git.kayg.org/attachments/807b2a3b-87b4-4ea8-bf37-39d85ae467d8) [VM folder cleanup](https://git.kayg.org/attachments/e9ba09e3-2b77-47f1-9fc8-7009473cbb0c)
Author
Owner

Final refinement pushed: 30b57eddc (supersedes 97b8c0588). On an overdue task, only the overdue portion was observable; the preceding scheduled wait could also be part of the renderer stall. An outstanding probe now gets a fresh responsive observation allowance. Fully answered routes still sample immediately on wake; timely-task budgets/cadence are unchanged. New control failed before, passes after: all 51 connection tests / 152 assertions pass, strict TypeScript passes. This is the same web-only scope; no native source changed.
before refinement: outstanding-probe control fails
51 passing connection tests

Exact rebuilt 30b57eddc web dist remains /home/kayg/.cache/codex-scratch/busy-page-liveness/web, with index.html. Repeated production perf-VM run: 0 liveness closes / 63,807.4 ms, all 65 real sessions live, 150 ms RTT / 6x CPU. Baseline 3 / 63,458.6 ms = 2.84/min. Largest cold task 1,292 ms vs baseline 3,997 ms; no claim that every individual runtime/layout/GC task is gone. All three stopped-route typing recovery cases also pass on this exact bundle.
latest grid receipt
latest 150 ms idle/dead-link
latest LAN idle/dead-link
latest three typing-recovery cases
latest production build, 65 sessions

Five dead-link trials, baseline -> latest: LAN retirement median 266.4 -> 267.2 ms, maximum 273.6 -> 268.0 ms; 150 ms median 186.0 -> 220.7 ms, maximum 240.8 -> 245.2 ms. The probe phase changes the sample median; the 150 ms ranges overlap (127.0–240.8 vs 127.4–245.2 ms), with +4.4 ms at the observed maximum. The idle allowance is unchanged. Reconnecting DOM-state median 266.6 -> 267.3 ms LAN and 186.1 -> 220.8 ms at 150 ms. D300 native-host figures stay separate and unchanged.

Fresh static x86 is bit-identical to release-4 merge base: 21,144,112 B, +0 B, SHA-256 c821a30a063b982c813ce7e5ca61eee7ee5f21e4f3bff29c95eb5c2f2ca193b1. ARM exact cap 19,370,696 B also passes. All prior native/static gate rows except the test row pass. Initial test setup failures are retained, not waived: missing helper env; parallel runtime socket lifetime observation (isolated control passes); too-long recovery socket paths; then a short symlink root correctly refused by restart guards. No assertion, timeout, skip or native code changed.

The final full fast launch uses RUST_TEST_THREADS=1, existing target/debug/examples/recovery-helper via INFRATERNAL_TEST_RUNTIME_HELPER, and a real private mode-700 /home/kayg/.cache/b245 state root (short enough for sun_path and not a symlink). Recovery fixtures pass 11/11 runnable cases there, and the restart cold-exec control passes. It is waiting for a shared build slot; all rows remain enabled. Native caches are reused under this job's one target folder. The state root, unused /run/user/1001/b245 alias, target symlink and build targets will be removed at finish. No deployment.

Final refinement pushed: 30b57eddc (supersedes 97b8c0588). On an overdue task, only the overdue portion was observable; the preceding scheduled wait could also be part of the renderer stall. An outstanding probe now gets a fresh responsive observation allowance. Fully answered routes still sample immediately on wake; timely-task budgets/cadence are unchanged. New control failed before, passes after: all 51 connection tests / 152 assertions pass, strict TypeScript passes. This is the same web-only scope; no native source changed. [before refinement: outstanding-probe control fails](https://git.kayg.org/attachments/b5f113f7-f2ef-49f0-a7e5-76c11fd8baf4) [51 passing connection tests](https://git.kayg.org/attachments/e3b261e5-e6cf-4d04-b0bd-f022e2b7333e) Exact rebuilt 30b57eddc web dist remains /home/kayg/.cache/codex-scratch/busy-page-liveness/web, with index.html. Repeated production perf-VM run: 0 liveness closes / 63,807.4 ms, all 65 real sessions live, 150 ms RTT / 6x CPU. Baseline 3 / 63,458.6 ms = 2.84/min. Largest cold task 1,292 ms vs baseline 3,997 ms; no claim that every individual runtime/layout/GC task is gone. All three stopped-route typing recovery cases also pass on this exact bundle. [latest grid receipt](https://git.kayg.org/attachments/bcc730db-7d40-4172-a353-ed585d85cf9a) [latest 150 ms idle/dead-link](https://git.kayg.org/attachments/3e6ab332-0bc6-4dff-807a-784e98027377) [latest LAN idle/dead-link](https://git.kayg.org/attachments/316b81f2-8a98-440d-b34e-507af88e5db7) [latest three typing-recovery cases](https://git.kayg.org/attachments/317d094c-5f6b-4d46-8718-1a43d0875298) ![latest production build, 65 sessions](https://git.kayg.org/attachments/f68b41f7-afa8-4b95-bda7-e7f02c485ed8) Five dead-link trials, baseline -> latest: LAN retirement median 266.4 -> 267.2 ms, maximum 273.6 -> 268.0 ms; 150 ms median 186.0 -> 220.7 ms, maximum 240.8 -> 245.2 ms. The probe phase changes the sample median; the 150 ms ranges overlap (127.0–240.8 vs 127.4–245.2 ms), with +4.4 ms at the observed maximum. The idle allowance is unchanged. Reconnecting DOM-state median 266.6 -> 267.3 ms LAN and 186.1 -> 220.8 ms at 150 ms. D300 native-host figures stay separate and unchanged. Fresh static x86 is bit-identical to release-4 merge base: 21,144,112 B, +0 B, SHA-256 c821a30a063b982c813ce7e5ca61eee7ee5f21e4f3bff29c95eb5c2f2ca193b1. ARM exact cap 19,370,696 B also passes. All prior native/static gate rows except the test row pass. Initial test setup failures are retained, not waived: missing helper env; parallel runtime socket lifetime observation (isolated control passes); too-long recovery socket paths; then a short symlink root correctly refused by restart guards. No assertion, timeout, skip or native code changed. The final full fast launch uses RUST_TEST_THREADS=1, existing target/debug/examples/recovery-helper via INFRATERNAL_TEST_RUNTIME_HELPER, and a real private mode-700 /home/kayg/.cache/b245 state root (short enough for sun_path and not a symlink). Recovery fixtures pass 11/11 runnable cases there, and the restart cold-exec control passes. It is waiting for a shared build slot; all rows remain enabled. Native caches are reused under this job's one target folder. The state root, unused /run/user/1001/b245 alias, target symlink and build targets will be removed at finish. No deployment.
Author
Owner

Finished: busy-page-liveness, head 30b57eddc0, pushed and remote verified. Five atomic commits, only five apps/tracer files. No deployment or server changes. #244 was inspected, not merged; the small overlapping liveness bookkeeping/hidden-page guards are documented above.

Healthy-page liveness now excludes locally stalled observation, accepts correlated queued replies without learning renderer delay as RTT, and gives socket tasks a turn before retirement. Restored renderers each get a task rather than one shared-promise microtask batch. Timely-task allowance and probe cadence stay unchanged.

Final production build on locked perf VM (4 vCPU, 8,069,112 KiB MemTotal), 65 real sessions / 150 ms RTT / Chromium 6x: baseline 3 closes in 63,458.6 ms (2.84/min), head 0 in 63,807.4 ms (0/min), all 65 live. Largest task 3,997 -> 1,292 ms; remaining individual runtime/layout tasks are not claimed eliminated. Ending load baseline 1.63/1.34/1.00, head 2.63/0.97/0.51. One-second idle block at 150 ms: baseline 1 client liveness close, head 0.

Five idle dead-link trials: LAN retirement median 266.4 -> 267.2 ms, maximum 273.6 -> 268.0 ms; RTT150 median 186.0 -> 220.7 ms, maximum 240.8 -> 245.2 ms. Reconnecting DOM-state median LAN 266.6 -> 267.3 ms, RTT150 186.1 -> 220.8 ms. Probe phases vary; ranges overlap. D300/#234 native notice/retire medians (LAN 270.2/544.1 ms, RTT150 454.2/830.1 ms) describe a different native-host lease and remain unchanged.
exact measurements

Production web dist: /home/kayg/.cache/codex-scratch/busy-page-liveness/web (265 files, index.html present, final head embedded). Production flags INFRATERNAL_CLUSTERS_PREVIEW=0, INFRATERNAL_RECOVERY_UI=off. Critical JS gzip 300,321/307,200 B (+139 B vs baseline), deferred 49,070/51,200 B. Stripped static x86 21,144,112 B, +0 B and byte-identical to merge base; ARM size gate also passes.
artifact checksums · production build · native comparison

Final full scripts/verify fast completed exit 0 on this head, with every row enabled. Runtime fixtures use existing recovery-helper, RUST_TEST_THREADS=1 and a real short private state root; no source, assertion, timeout or skip was changed to obtain the pass. Verbatim gate summary and frontend/protocol output:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

 256 pass
 0 fail
 11712 expect() calls
Ran 256 tests across 41 files. [1305.00ms]

 37 pass
 0 fail
 34463 expect() calls
Ran 37 tests across 10 files. [2.78s]

full verbatim final gate output

All 51 focused connection controls / 152 assertions pass, including new controls demonstrated failing before each liveness correction. Three stopped-route typing recovery browser cases pass on the final artifact. Broader terminal/restart controls ran earlier; the RTT150 first-paint profile is red on both production baseline and candidate, already linked above, and was not waived as green. LAN synthetic block can still get a non-4000 close from the existing server/control path; that is outside this web-only fix.

Earlier unsuccessful full-gate attempts remain available: missing fixture helper, parallel runtime descriptor lifetime, long socket fixture path, symlink root correctly refused. Real short-root recovery and cold restart preflight controls pass.

Author review completed for correlation, task ordering, timer reset/cancellation, stale-socket guards, RTT accounting, unchanged idle allowance, dependencies and web-only scope. Production screenshot is attached for independent visual review; no author visual-quality verdict. Worktree clean; remote head matches. No owned test process references remain. Own targets, comparison builds, test state and temporary symlinks removed; web artifact/evidence retained. host cleanup · perf VM cleanup. Issue remains open for review/deployment by orchestrator.

Finished: busy-page-liveness, head 30b57eddc0bcd06067891d21584c19d9d6e8106c, pushed and remote verified. Five atomic commits, only five apps/tracer files. No deployment or server changes. #244 was inspected, not merged; the small overlapping liveness bookkeeping/hidden-page guards are documented above. Healthy-page liveness now excludes locally stalled observation, accepts correlated queued replies without learning renderer delay as RTT, and gives socket tasks a turn before retirement. Restored renderers each get a task rather than one shared-promise microtask batch. Timely-task allowance and probe cadence stay unchanged. Final production build on locked perf VM (4 vCPU, 8,069,112 KiB MemTotal), 65 real sessions / 150 ms RTT / Chromium 6x: baseline 3 closes in 63,458.6 ms (2.84/min), head 0 in 63,807.4 ms (0/min), all 65 live. Largest task 3,997 -> 1,292 ms; remaining individual runtime/layout tasks are not claimed eliminated. Ending load baseline 1.63/1.34/1.00, head 2.63/0.97/0.51. One-second idle block at 150 ms: baseline 1 client liveness close, head 0. Five idle dead-link trials: LAN retirement median 266.4 -> 267.2 ms, maximum 273.6 -> 268.0 ms; RTT150 median 186.0 -> 220.7 ms, maximum 240.8 -> 245.2 ms. Reconnecting DOM-state median LAN 266.6 -> 267.3 ms, RTT150 186.1 -> 220.8 ms. Probe phases vary; ranges overlap. D300/#234 native notice/retire medians (LAN 270.2/544.1 ms, RTT150 454.2/830.1 ms) describe a different native-host lease and remain unchanged. [exact measurements](https://git.kayg.org/attachments/e16d2d79-f39b-4169-b16b-6c1edbee48e4) Production web dist: /home/kayg/.cache/codex-scratch/busy-page-liveness/web (265 files, index.html present, final head embedded). Production flags INFRATERNAL_CLUSTERS_PREVIEW=0, INFRATERNAL_RECOVERY_UI=off. Critical JS gzip 300,321/307,200 B (+139 B vs baseline), deferred 49,070/51,200 B. Stripped static x86 21,144,112 B, +0 B and byte-identical to merge base; ARM size gate also passes. [artifact checksums](https://git.kayg.org/attachments/b5fa6030-4d8c-4e00-95ff-8c94b027e5e5) · [production build](https://git.kayg.org/attachments/bb067b68-8aa1-4622-942e-59f281a1d479) · [native comparison](https://git.kayg.org/attachments/668624f3-50a7-481f-9c4b-18da165a0e41) Final full scripts/verify fast completed exit 0 on this head, with every row enabled. Runtime fixtures use existing recovery-helper, RUST_TEST_THREADS=1 and a real short private state root; no source, assertion, timeout or skip was changed to obtain the pass. Verbatim gate summary and frontend/protocol output: ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 256 pass 0 fail 11712 expect() calls Ran 256 tests across 41 files. [1305.00ms] 37 pass 0 fail 34463 expect() calls Ran 37 tests across 10 files. [2.78s] ``` [full verbatim final gate output](https://git.kayg.org/attachments/f5fb5f12-6ca5-4e9a-a423-78624f1ef9c3) All 51 focused connection controls / 152 assertions pass, including new controls demonstrated failing before each liveness correction. Three stopped-route typing recovery browser cases pass on the final artifact. Broader terminal/restart controls ran earlier; the RTT150 first-paint profile is red on both production baseline and candidate, already linked above, and was not waived as green. LAN synthetic block can still get a non-4000 close from the existing server/control path; that is outside this web-only fix. Earlier unsuccessful full-gate attempts remain available: [missing fixture helper](https://git.kayg.org/attachments/2e27b015-a937-40cd-a592-e9e7408d6f1f), [parallel runtime descriptor lifetime](https://git.kayg.org/attachments/35b8f5e8-5d97-464a-b029-cded0d673cd1), [long socket fixture path](https://git.kayg.org/attachments/39a0ae6f-f70e-4613-9dd3-1b4894e7cfa3), [symlink root correctly refused](https://git.kayg.org/attachments/f4d8e2de-bc51-46e0-a625-1d63e8721e46). Real short-root [recovery](https://git.kayg.org/attachments/da3f23d3-1084-4487-a901-6e21ea84efe9) and [cold restart](https://git.kayg.org/attachments/4392dea8-58a2-4790-9b82-fde873527c95) preflight controls pass. Author review completed for correlation, task ordering, timer reset/cancellation, stale-socket guards, RTT accounting, unchanged idle allowance, dependencies and web-only scope. Production screenshot is attached for independent visual review; no author visual-quality verdict. Worktree clean; remote head matches. No owned test process references remain. Own targets, comparison builds, test state and temporary symlinks removed; web artifact/evidence retained. [host cleanup](https://git.kayg.org/attachments/c499035c-9746-416e-b568-ab7ece7cf6b7) · [perf VM cleanup](https://git.kayg.org/attachments/a04eeb7c-f7c1-4567-9c87-eac50b939a4b). Issue remains open for review/deployment by orchestrator.
Author
Owner

Review start: branch review-busy-page-liveness, base/head 253ce0e17f. Read every #245 comment; no parent listed. Reviewing git diff origin/release-prod-live 253ce0e17 (five apps/tracer files). D300 is absent from this head's DECISIONS.md; read its definition from origin/dev (host-side doubt then two consecutive misses), and D265/D267 browser recovery contract. Testing repeated scheduling lateness, throttled timer schedules, restore/input routing and production workload; MERGE/HOLD pending. No deployment.

Review start: branch review-busy-page-liveness, base/head 253ce0e17f18cb5b2d56fddb600f8156a41c1f80. Read every #245 comment; no parent listed. Reviewing git diff origin/release-prod-live 253ce0e17 (five apps/tracer files). D300 is absent from this head's DECISIONS.md; read its definition from origin/dev (host-side doubt then two consecutive misses), and D265/D267 browser recovery contract. Testing repeated scheduling lateness, throttled timer schedules, restore/input routing and production workload; MERGE/HOLD pending. No deployment.
Author
Owner

P1 / HOLD: repeated timer lateness renews a dead browser route indefinitely (connection.ts:520–532). accountLivenessDelay resets lastPongAt to now whenever the timer is >25 ms late, without any peer reply or limit on renewals. Pending probes therefore never reach responseAllowance while callbacks remain late. Streams continue to report welcomed/live; unacknowledged typing cannot trigger retirement.

Three new deterministic controls in connection-idle.test.ts fail on 253ce0e17: "a dead typing route eventually retires when browser tasks run every 75ms", and the idle variants every 1000ms and 60000ms. Each executes callbacks for 600,000 virtual ms with forwarding disabled, then observes isWelcomed=true. No finite worst-case detection bound exists: repeat the same schedule for any duration. These are controlled-clock counterexamples, not build-host performance measurements or claims of a particular browser's timer policy. The 60,000ms case models minute-spaced background timer batches; a native Safari/hidden Chromium run is still pending.

All three controls PASS against origin/release-prod-live's connection.ts with the same fixture. Existing 37 idle controls still pass on the candidate. candidate 37 pass / 3 fail. Strict TypeScript and git diff --check pass.

D300 applies to the native host lease, not this browser lease; it requires doubt then retirement on a second consecutive miss. This finding leaves native D300 behavior unchanged but violates bounded browser detection/recovery in D265/D267. A finite stall grace or responsive-time accumulation must preserve queued healthy replies without permitting unlimited dead-route renewals. Regression tests will be committed intentionally red as required by break-it review. No implementation fix in this review lane.

P1 / HOLD: repeated timer lateness renews a dead browser route indefinitely (connection.ts:520–532). accountLivenessDelay resets lastPongAt to now whenever the timer is >25 ms late, without any peer reply or limit on renewals. Pending probes therefore never reach responseAllowance while callbacks remain late. Streams continue to report welcomed/live; unacknowledged typing cannot trigger retirement. Three new deterministic controls in connection-idle.test.ts fail on 253ce0e17: "a dead typing route eventually retires when browser tasks run every 75ms", and the idle variants every 1000ms and 60000ms. Each executes callbacks for 600,000 virtual ms with forwarding disabled, then observes isWelcomed=true. No finite worst-case detection bound exists: repeat the same schedule for any duration. These are controlled-clock counterexamples, not build-host performance measurements or claims of a particular browser's timer policy. The 60,000ms case models minute-spaced background timer batches; a native Safari/hidden Chromium run is still pending. All three controls PASS against origin/release-prod-live's connection.ts with the same fixture. Existing 37 idle controls still pass on the candidate. [candidate 37 pass / 3 fail](https://git.kayg.org/attachments/988bb6e9-fea2-40af-b3d9-6efc55b532aa). Strict TypeScript and git diff --check pass. D300 applies to the native host lease, not this browser lease; it requires doubt then retirement on a second consecutive miss. This finding leaves native D300 behavior unchanged but violates bounded browser detection/recovery in D265/D267. A finite stall grace or responsive-time accumulation must preserve queued healthy replies without permitting unlimited dead-route renewals. Regression tests will be committed intentionally red as required by break-it review. No implementation fix in this review lane.
Author
Owner

Review step committed/pushed: 5dd86380a (three controlled-clock dead-route regressions); 2d2382369 (real-browser stopped-link and restore-input regressions; verified real-output soak and restored-order assertions). Branch review-busy-page-liveness only. TypeScript and diff checks pass; red review controls are intentional, no implementation changed.

Locked perf VM, production 253ce0e17 web code, release-5 binary, RTT150: "repeated busy tasks do not keep a stopped route live" fails: backend stopped behind retained browser socket; repeated 75ms tasks for six seconds; closes=[], status=live, ending load 1.48/1.26/0.70. This independently confirms the P1 deadline-renewal finding. Baseline real-browser control queued.

Restore-input test also fails on candidate with deterministic 150ms spacing between zero-delay task callbacks: at first typing only 1 of 8 renderers exists, chosen terminal t-aad54d8f-a4dc-4b00-85d4-e64c7471f67f; focus ends in t-49b99a43-408e-4596-837b-a13f6d159291; executed marker count 0. Awaiting production-bundle control before classifying as an additional regression. Window constructor unconditionally focuses each renderer; the new task yield permits input tasks between these focus changes.

The valid-grid 65-real-session soak has now verified three distinct real printing streams at 6x CPU / RTT150 and is observing for 600,000ms. Earlier setup attempts (0/1/2 verified printers) are not counted as measurements; switched workload launch to explicit window activation plus atomic pasted command and an executed marker per printer. No timing bound relaxed. Full fast is still running cold native builds in the job-specific target. HOLD already required by the first P1. No deployment or production handoff artifact.

Review step committed/pushed: 5dd86380a (three controlled-clock dead-route regressions); 2d2382369 (real-browser stopped-link and restore-input regressions; verified real-output soak and restored-order assertions). Branch review-busy-page-liveness only. TypeScript and diff checks pass; red review controls are intentional, no implementation changed. Locked perf VM, production 253ce0e17 web code, release-5 binary, RTT150: "repeated busy tasks do not keep a stopped route live" fails: backend stopped behind retained browser socket; repeated 75ms tasks for six seconds; closes=[], status=live, ending load 1.48/1.26/0.70. This independently confirms the P1 deadline-renewal finding. Baseline real-browser control queued. Restore-input test also fails on candidate with deterministic 150ms spacing between zero-delay task callbacks: at first typing only 1 of 8 renderers exists, chosen terminal t-aad54d8f-a4dc-4b00-85d4-e64c7471f67f; focus ends in t-49b99a43-408e-4596-837b-a13f6d159291; executed marker count 0. Awaiting production-bundle control before classifying as an additional regression. Window constructor unconditionally focuses each renderer; the new task yield permits input tasks between these focus changes. The valid-grid 65-real-session soak has now verified three distinct real printing streams at 6x CPU / RTT150 and is observing for 600,000ms. Earlier setup attempts (0/1/2 verified printers) are not counted as measurements; switched workload launch to explicit window activation plus atomic pasted command and an executed marker per printer. No timing bound relaxed. Full fast is still running cold native builds in the job-specific target. HOLD already required by the first P1. No deployment or production handoff artifact.
Author
Owner

Initial full fast reached the previous_attempt_shell integration test and failed because my launch omitted INFRATERNAL_TEST_RUNTIME_HELPER (documented in the author's #245 history); Python raises KeyError before its checks. It continues both static builds. This is a gate setup error, not a change regression. The existing target/debug/examples/recovery-helper is built. After this invocation releases its build slot, rerun full fast on 2d2382369 with that helper, RUST_TEST_THREADS=1, and the new real private /home/kayg/.cache/codex-scratch/q245 runtime root. No tests, skips, assertions, timeouts or native code changed. Initial transcript retained as evidence/fast.log.

Initial full fast reached the previous_attempt_shell integration test and failed because my launch omitted INFRATERNAL_TEST_RUNTIME_HELPER (documented in the author's #245 history); Python raises KeyError before its checks. It continues both static builds. This is a gate setup error, not a change regression. The existing target/debug/examples/recovery-helper is built. After this invocation releases its build slot, rerun full fast on 2d2382369 with that helper, RUST_TEST_THREADS=1, and the new real private /home/kayg/.cache/codex-scratch/q245 runtime root. No tests, skips, assertions, timeouts or native code changed. Initial transcript retained as evidence/fast.log.
Author
Owner

P1 / HOLD: per-renderer task yields allow later restored terminals to steal focus during typing (terminal.ts:449 with constructor focus at :425). "typing into a restored terminal stays with that terminal while others initialize" now isolates only native promise-resolver zero-delay callbacks, leaving ordinary UI/deferred-focus callbacks unchanged. With 8 real sessions, a deterministic 150ms gap between the new renderer yields permits typing into the first initialized terminal. Subsequent constructors focus their own terminals; the command splits across shells and never executes. Fix must respect current user focus while restoring other windows.

Same release-5 real binary, production bundles, RTT150, locked perf VM:

  • production baseline: 8 initialized at first typing; executed restore-42 count 1; chosen/final focus t-26361c1c-7d08-4d24-816b-578099bb8fce; PASS.
  • 253ce0e17: 1 initialized; executed count 0; chosen t-94173a87-84c1-466f-aa9e-cc160f8e442a, final focus t-8e8c2c22-50e0-462b-99bc-3c793995cae0; FAIL.
    isolated candidate failure · baseline pass
    candidate: command fragments in different shells
    baseline: intact command

The earlier override of ALL zero-delay callbacks failed on both variants; it changed existing deferred-focus behavior and is not evidence of a new regression. Refinement committed/pushed as 181444701 (tests only; strict TypeScript/diff checks pass). Scope counts now P0=0, P1=2, P2=0, P3=0. First P1 also has real-browser baseline control: production retires the stopped route, candidate retains live status, baseline controlled-clock 3/3 pass.

65-session real-output observation PASSES: 3 verified distinct printing streams; 65 real sessions, production 253ce0e17 web; RTT150 / 6x CPU; elapsed 625,310.3ms including restore/workload setup and 600,000ms observation; 0 client 4000 closes = 0/min; ending 65 live; longest task 857ms; ending load 2.66/2.01/1.37. Saved window IDs/order match after reload. Linux 6.12.111, 4 vCPU perf VM. raw run · numbers · production screenshot.

Receipt caveat: after Playwright printed 1 passed / 2 skipped, the soak wrapper printed "un: command not found" because I edited its file while that shell waited for Playwright. Environment and running test code were already loaded; all observation records and assertions completed beforehand. Retained raw transcript includes the post-test wrapper error. Do not describe the wrapper exit as green.

The 60s timer schedule is a controlled-clock counterexample, not a native Safari or Chromium intensive-throttling measurement. Those real background profiles remain unverified. HOLD does not depend on them: the visible stopped-route test already reproduces P1. No production handoff build/deployment. Final full gate/runtime setup and cleanup still in progress.

P1 / HOLD: per-renderer task yields allow later restored terminals to steal focus during typing (terminal.ts:449 with constructor focus at :425). "typing into a restored terminal stays with that terminal while others initialize" now isolates only native promise-resolver zero-delay callbacks, leaving ordinary UI/deferred-focus callbacks unchanged. With 8 real sessions, a deterministic 150ms gap between the new renderer yields permits typing into the first initialized terminal. Subsequent constructors focus their own terminals; the command splits across shells and never executes. Fix must respect current user focus while restoring other windows. Same release-5 real binary, production bundles, RTT150, locked perf VM: - production baseline: 8 initialized at first typing; executed restore-42 count 1; chosen/final focus t-26361c1c-7d08-4d24-816b-578099bb8fce; PASS. - 253ce0e17: 1 initialized; executed count 0; chosen t-94173a87-84c1-466f-aa9e-cc160f8e442a, final focus t-8e8c2c22-50e0-462b-99bc-3c793995cae0; FAIL. [isolated candidate failure](https://git.kayg.org/attachments/6566091b-1964-49da-a332-326bd76a7d22) · [baseline pass](https://git.kayg.org/attachments/c21bab97-dbdb-483a-bd93-07549ab531f9) ![candidate: command fragments in different shells](https://git.kayg.org/attachments/ec1eebfd-c0dd-4cd6-9f09-6d76ee3bfb35) ![baseline: intact command](https://git.kayg.org/attachments/e8be043e-a50d-4ad2-9466-7b72d4c349f8) The earlier override of ALL zero-delay callbacks failed on both variants; it changed existing deferred-focus behavior and is not evidence of a new regression. Refinement committed/pushed as 181444701 (tests only; strict TypeScript/diff checks pass). Scope counts now P0=0, P1=2, P2=0, P3=0. First P1 also has real-browser baseline control: [production retires the stopped route](https://git.kayg.org/attachments/8d5b8b4d-043a-419d-9206-ff5439da14ec), [candidate retains live status](https://git.kayg.org/attachments/b8622089-e856-4274-a146-b70213ecb8ec), [baseline controlled-clock 3/3 pass](https://git.kayg.org/attachments/ddc372de-dc79-4923-a098-b6fbd82ae6fa). 65-session real-output observation PASSES: 3 verified distinct printing streams; 65 real sessions, production 253ce0e17 web; RTT150 / 6x CPU; elapsed 625,310.3ms including restore/workload setup and 600,000ms observation; 0 client 4000 closes = 0/min; ending 65 live; longest task 857ms; ending load 2.66/2.01/1.37. Saved window IDs/order match after reload. Linux 6.12.111, 4 vCPU perf VM. [raw run](https://git.kayg.org/attachments/4b6d0512-fd74-4714-96de-abad027f3142) · [numbers](https://git.kayg.org/attachments/507eca68-f3c4-40c1-88d2-b54c56157f56) · [production screenshot](https://git.kayg.org/attachments/70201afb-d9a3-4be6-b987-19ca940a3fc9). Receipt caveat: after Playwright printed 1 passed / 2 skipped, the soak wrapper printed "un: command not found" because I edited its file while that shell waited for Playwright. Environment and running test code were already loaded; all observation records and assertions completed beforehand. Retained raw transcript includes the post-test wrapper error. Do not describe the wrapper exit as green. The 60s timer schedule is a controlled-clock counterexample, not a native Safari or Chromium intensive-throttling measurement. Those real background profiles remain unverified. HOLD does not depend on them: the visible stopped-route test already reproduces P1. No production handoff build/deployment. Final full gate/runtime setup and cleanup still in progress.
Author
Owner

Final test head pushed and remote verified: 1814447012. Three atomic review commits, no implementation changes. Focused head controls: 51 existing connection tests pass / 3 new regressions fail (158 assertions); verbatim output.

First full fast completed: fmt, VT fmt, CLI compile-out, clippy, cargo-deny and both static builds PASS; test row fails only at missing INFRATERNAL_TEST_RUNTIME_HELPER setup (32 Python KeyErrors). Complete initial gate transcript. Corrected full fast on final head is queued in build-slot with RUST_TEST_THREADS=1, the built recovery-helper and a real mode-700 /home/kayg/.cache/codex-scratch/q245 state root. Every row remains enabled.

Both stripped shipping binaries are byte-identical to release-5 merge base c00c6364e6, using the same scripts/static-cargo recipe: x86 21,225,872 B, ARM 19,427,688 B; both +0 B. Sizes/checksums.

Review-only production web build (253ce0e17 embedded) remains /home/kayg/.cache/codex-scratch/review-busy-page-liveness/review-web with 265 files/index.html; SHA-256 manifest alongside it at review-web.SHA256SUMS (copy). Transfer budget passes: critical gzip 300,322/307,200 B; deferred 49,076/51,200 B. The requested /web handoff is conditional on MERGE and is not produced under HOLD.

Perf VM receipt metadata: Linux 6.12.111, 4 vCPU, MemTotal 8,069,112 kB (machine). VM cleanup complete: zero owned executable/cwd references, own folder removed. Host target/runtime cleanup waits for the final gate. Verdict HOLD, P0=0/P1=2/P2=0/P3=0. No deployment.

Final test head pushed and remote verified: 1814447012aec3e81d1bcb0ac44f7a0aee499d55. Three atomic review commits, no implementation changes. Focused head controls: 51 existing connection tests pass / 3 new regressions fail (158 assertions); [verbatim output](https://git.kayg.org/attachments/491acc1c-de8f-4e08-88ce-6f7812054c05). First full fast completed: fmt, VT fmt, CLI compile-out, clippy, cargo-deny and both static builds PASS; test row fails only at missing INFRATERNAL_TEST_RUNTIME_HELPER setup (32 Python KeyErrors). [Complete initial gate transcript](https://git.kayg.org/attachments/5646f824-d2e5-4592-8fcd-c40cbd2e7daf). Corrected full fast on final head is queued in build-slot with RUST_TEST_THREADS=1, the built recovery-helper and a real mode-700 /home/kayg/.cache/codex-scratch/q245 state root. Every row remains enabled. Both stripped shipping binaries are byte-identical to release-5 merge base c00c6364e695, using the same scripts/static-cargo recipe: x86 21,225,872 B, ARM 19,427,688 B; both +0 B. [Sizes/checksums](https://git.kayg.org/attachments/36efe166-9ff5-40ff-a208-388a880910f1). Review-only production web build (253ce0e17 embedded) remains /home/kayg/.cache/codex-scratch/review-busy-page-liveness/review-web with 265 files/index.html; SHA-256 manifest alongside it at review-web.SHA256SUMS ([copy](https://git.kayg.org/attachments/7d406412-df1d-4792-85fb-3a76cd535246)). Transfer budget passes: critical gzip 300,322/307,200 B; deferred 49,076/51,200 B. The requested /web handoff is conditional on MERGE and is not produced under HOLD. Perf VM receipt metadata: Linux 6.12.111, 4 vCPU, MemTotal 8,069,112 kB ([machine](https://git.kayg.org/attachments/d3c06c27-a047-414a-bd2e-8ae4fbeea4f9)). VM cleanup complete: [zero owned executable/cwd references](https://git.kayg.org/attachments/67d1099f-f328-47ea-b4d7-c77a90a95ed4), [own folder removed](https://git.kayg.org/attachments/14c5e800-699d-421f-90ef-8f4119b67b78). Host target/runtime cleanup waits for the final gate. Verdict HOLD, P0=0/P1=2/P2=0/P3=0. No deployment.
Author
Owner

Gate runtime requirement isolated without source changes: the state root must be both short and on the checkout's filesystem. /home/kayg/.cache/codex-scratch/q245 is too long for deeper recovery-support sockets (second transcript); /run/user/1001/r245 fits the socket but makes the restart hard-link fixture fail EXDEV (third transcript).

Now using a new real private mode-700 /home/kayg/.cache/r245, matching the author's successful short same-filesystem setup. This is ephemeral native fixture state only; build target and evidence remain in codex-scratch/review-busy-page-liveness. No symlink, test skip/assertion/timeout change, or native code change. Existing compiled workspace binaries: recovery_support 11/11 runnable PASS (receipt); restart hard-link/cold-exec control PASS (receipt). Earlier partial short-root preflight: receipt.

Full fast rerun on 181444701 is active with that root, RUST_TEST_THREADS=1 and the existing recovery-helper; 99 native unit tests pass, real-daemon integration checks underway. Every row enabled. All three own fixture roots will be removed at finish. Review verdict remains HOLD with two independent P1 findings.

Gate runtime requirement isolated without source changes: the state root must be both short and on the checkout's filesystem. /home/kayg/.cache/codex-scratch/q245 is too long for deeper recovery-support sockets ([second transcript](https://git.kayg.org/attachments/f5eff680-3388-4135-bc70-495d125f89a0)); /run/user/1001/r245 fits the socket but makes the restart hard-link fixture fail EXDEV ([third transcript](https://git.kayg.org/attachments/1726b8c2-5399-46b5-87ed-1f23b85b23b0)). Now using a new real private mode-700 /home/kayg/.cache/r245, matching the author's successful short same-filesystem setup. This is ephemeral native fixture state only; build target and evidence remain in codex-scratch/review-busy-page-liveness. No symlink, test skip/assertion/timeout change, or native code change. Existing compiled workspace binaries: recovery_support 11/11 runnable PASS ([receipt](https://git.kayg.org/attachments/00829ddf-d552-41b8-827c-7391a7cae301)); restart hard-link/cold-exec control PASS ([receipt](https://git.kayg.org/attachments/927bce91-1cbb-4cb7-ab7b-e6188949bb31)). Earlier partial short-root preflight: [receipt](https://git.kayg.org/attachments/6fbe3503-3627-49ed-8d97-85a97bb95945). Full fast rerun on 181444701 is active with that root, RUST_TEST_THREADS=1 and the existing recovery-helper; 99 native unit tests pass, real-daemon integration checks underway. Every row enabled. All three own fixture roots will be removed at finish. Review verdict remains HOLD with two independent P1 findings.
Author
Owner

Full fast on 181444701 completed exit 0 with the proven short same-filesystem runtime root: every Rust row PASS; frontend 257 pass / 0 fail; protocol 37 pass / 0 fail. Verbatim complete run.

Coverage gap found during transcript audit: the multi-path frontend command's src/connection selection did not execute the root connection-idle.test.ts controls. Its green result did not contradict the separately red regressions. Added a two-line directory test entry importing the existing suite, without copying the fixture or modifying scripts/verify. New atomic commit pushed: 8bd3726956. Strict TypeScript/diff checks pass. Exact frontend gate command now reports 294 pass / 3 fail / 11,798 assertions; the only failures are the repeated-lateness review controls. Exact command output.

Final full fast on this new head is launched through build-slot with the same passing native environment and all rows enabled; transcript evidence/fast-review-head.log. Expected final exit is nonzero at these intentionally failing review tests. No implementation changes; source under review remains 253ce0e17. Verdict HOLD, P0=0/P1=2/P2=0/P3=0. Runtime/target cleanup follows this final gate.

Full fast on 181444701 completed exit 0 with the proven short same-filesystem runtime root: every Rust row PASS; frontend 257 pass / 0 fail; protocol 37 pass / 0 fail. [Verbatim complete run](https://git.kayg.org/attachments/225baae4-f6af-4cf7-867f-bf5753958841). Coverage gap found during transcript audit: the multi-path frontend command's src/connection selection did not execute the root connection-idle.test.ts controls. Its green result did not contradict the separately red regressions. Added a two-line directory test entry importing the existing suite, without copying the fixture or modifying scripts/verify. New atomic commit pushed: 8bd37269569ca2b10dec7fe65f659dc09ec10a25. Strict TypeScript/diff checks pass. Exact frontend gate command now reports 294 pass / 3 fail / 11,798 assertions; the only failures are the repeated-lateness review controls. [Exact command output](https://git.kayg.org/attachments/aca0dcc2-bc09-464b-b031-b92a8e80313a). Final full fast on this new head is launched through build-slot with the same passing native environment and all rows enabled; transcript evidence/fast-review-head.log. Expected final exit is nonzero at these intentionally failing review tests. No implementation changes; source under review remains 253ce0e17. Verdict HOLD, P0=0/P1=2/P2=0/P3=0. Runtime/target cleanup follows this final gate.
Author
Owner

Finished review: HOLD. P0=0, P1=2, P2=0, P3=0.

Reviewed production web code at 253ce0e17f against release-5 c00c6364e6. Review branch review-busy-page-liveness, final head 8bd3726956, pushed and remote verified. Four atomic test-only commits; three files changed relative to the review target. Implementation is unchanged.

P1 — unbounded dead-route renewal, connection.ts:527. Every >25ms-late callback resets lastPongAt without a peer reply. Repeating this schedule gives no finite retirement bound. Three controls (typing every 75ms, idle every 1000ms, idle every 60000ms) still report welcomed after 600,000 virtual ms; all three pass on production baseline. Real retained-socket/backend-stop test with repeated 75ms busy tasks: candidate remains live with no 4000 close after six seconds; baseline retires. D300 is the separate native host lease (doubt, then retirement after two consecutive misses); this violates bounded browser recovery under D265/D267. Candidate real-browser failure · baseline pass.

P1 — restore yields permit input to split across terminals, terminal.ts:449 / constructor focus :425. The isolated test spaces only native promise-resolver zero-delay callbacks by 150ms. Baseline: all 8 renderers exist at first typing, focus stays chosen, command executes once. Candidate: only 1 exists at first typing; subsequent constructors move focus, command fragments enter different shells, command never executes. Candidate failure · baseline pass · split input screenshot.

Positive workload: locked perf VM, Linux 6.12.111 / 4 vCPU / 8,069,112 kB RAM; 65 real sessions, three verified printing streams, 6x browser CPU, 150ms relay RTT. 600,000ms observation; 625,310.3ms including restore/workload setup. Zero browser liveness closes = 0/min, all 65 live at finish; restored window IDs/order match. Longest task 857ms; ending load 2.66/2.01/1.37. Raw receipt · screenshot. Playwright's workload assertions passed; the already-documented post-test wrapper error remains in the raw receipt and its wrapper exit is not described as green.

Coverage limit: the minute-spaced timer schedule is simulated. Native Safari and actual Chromium intensive-throttling profiles were not run. The visible busy-page P1 does not depend on those profiles.

Final scripts/verify fast on 8bd372695 exits 1 at the three intentionally failing review regressions. Every Rust row passes. The directory test entry now includes the previously omitted timer suite; the exact frontend command reports 294 pass / 3 fail. Verbatim final summary:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

3 tests failed:
(fail) a dead typing route eventually retires when browser tasks run every 75ms [116.26ms]
(fail) a dead idle route eventually retires when browser tasks run every 1000ms [1.89ms]
(fail) a dead idle route eventually retires when browser tasks run every 60000ms [1.44ms]

 294 pass
 3 fail
 11798 expect() calls
Ran 297 tests across 42 files. [2.17s]

Complete verbatim final gate output · summary. The pre-entry full run passed all rows, including 37/37 protocol tests; final gate stops before those later checks (complete prior run). No assertions, native code, timeouts or skips changed to resolve fixture setup. Earlier missing-helper, socket-path and cross-filesystem failures remain linked above; real short same-filesystem private fixture state resolved them.

Reproduce the review controls: bun test apps/tracer/src/connection. On the locked perf VM with a real binary and production TRACER_DIST, run the committed busy-page-liveness.spec.ts with TRACER_TEST_PORT=4297 and BUSY_PAGE_MEASURE=1; select BUSY_PAGE_DEAD_BUSY=1 or BUSY_PAGE_RESTORE_INPUT=1 for the two negative browser controls. Positive workload uses BUSY_PAGE_PRINTING=1 BUSY_PAGE_OBSERVE_MS=600000 BUSY_PAGE_EXPECT_HEALTHY=1.

Stripped static sizes against merge base, same recipe: x86 21,225,872 B (+0 B); ARM 19,427,688 B (+0 B). Both byte-identical to release 5. Final-head sizes/checksums.

Review-only production web dist from 253ce0e17: /home/kayg/.cache/codex-scratch/review-busy-page-liveness/review-web (265 files; index.html present). Manifest next to it: review-web.SHA256SUMS (copy). Production flags INFRATERNAL_CLUSTERS_PREVIEW=0 / INFRATERNAL_RECOVERY_UI=off. Transfer budget passes: critical gzip 300,322/307,200 B, deferred 49,076/51,200 B. The requested /web production handoff is conditional on MERGE and is not produced under HOLD.

Reviewer checklist completed for timer/task ordering, nonce correlation, stale-route/reset lifecycle, saved order, focus/input routing, real-engine workload, dependencies/licensing, module documentation and evidence/scope hygiene. VM processes/copy removed; host test-process audit empty; own target, baseline copy and all three fixture roots removed. Review web artifact/evidence retained. Host cleanup · VM cleanup. Worktree clean. Issue remains open. No deployment.

Finished review: HOLD. P0=0, P1=2, P2=0, P3=0. Reviewed production web code at 253ce0e17f18cb5b2d56fddb600f8156a41c1f80 against release-5 c00c6364e695. Review branch review-busy-page-liveness, final head 8bd37269569ca2b10dec7fe65f659dc09ec10a25, pushed and remote verified. Four atomic test-only commits; three files changed relative to the review target. Implementation is unchanged. P1 — unbounded dead-route renewal, connection.ts:527. Every >25ms-late callback resets lastPongAt without a peer reply. Repeating this schedule gives no finite retirement bound. Three controls (typing every 75ms, idle every 1000ms, idle every 60000ms) still report welcomed after 600,000 virtual ms; all three pass on production baseline. Real retained-socket/backend-stop test with repeated 75ms busy tasks: candidate remains live with no 4000 close after six seconds; baseline retires. D300 is the separate native host lease (doubt, then retirement after two consecutive misses); this violates bounded browser recovery under D265/D267. [Candidate real-browser failure](https://git.kayg.org/attachments/b8622089-e856-4274-a146-b70213ecb8ec) · [baseline pass](https://git.kayg.org/attachments/8d5b8b4d-043a-419d-9206-ff5439da14ec). P1 — restore yields permit input to split across terminals, terminal.ts:449 / constructor focus :425. The isolated test spaces only native promise-resolver zero-delay callbacks by 150ms. Baseline: all 8 renderers exist at first typing, focus stays chosen, command executes once. Candidate: only 1 exists at first typing; subsequent constructors move focus, command fragments enter different shells, command never executes. [Candidate failure](https://git.kayg.org/attachments/6566091b-1964-49da-a332-326bd76a7d22) · [baseline pass](https://git.kayg.org/attachments/c21bab97-dbdb-483a-bd93-07549ab531f9) · [split input screenshot](https://git.kayg.org/attachments/ec1eebfd-c0dd-4cd6-9f09-6d76ee3bfb35). Positive workload: locked perf VM, Linux 6.12.111 / 4 vCPU / 8,069,112 kB RAM; 65 real sessions, three verified printing streams, 6x browser CPU, 150ms relay RTT. 600,000ms observation; 625,310.3ms including restore/workload setup. Zero browser liveness closes = 0/min, all 65 live at finish; restored window IDs/order match. Longest task 857ms; ending load 2.66/2.01/1.37. [Raw receipt](https://git.kayg.org/attachments/4b6d0512-fd74-4714-96de-abad027f3142) · [screenshot](https://git.kayg.org/attachments/70201afb-d9a3-4be6-b987-19ca940a3fc9). Playwright's workload assertions passed; the already-documented post-test wrapper error remains in the raw receipt and its wrapper exit is not described as green. Coverage limit: the minute-spaced timer schedule is simulated. Native Safari and actual Chromium intensive-throttling profiles were not run. The visible busy-page P1 does not depend on those profiles. Final scripts/verify fast on 8bd372695 exits 1 at the three intentionally failing review regressions. Every Rust row passes. The directory test entry now includes the previously omitted timer suite; the exact frontend command reports 294 pass / 3 fail. Verbatim final summary: ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 3 tests failed: (fail) a dead typing route eventually retires when browser tasks run every 75ms [116.26ms] (fail) a dead idle route eventually retires when browser tasks run every 1000ms [1.89ms] (fail) a dead idle route eventually retires when browser tasks run every 60000ms [1.44ms] 294 pass 3 fail 11798 expect() calls Ran 297 tests across 42 files. [2.17s] ``` [Complete verbatim final gate output](https://git.kayg.org/attachments/45a94bf1-42f8-43e7-ad43-0a566ac402c3) · [summary](https://git.kayg.org/attachments/dc3e56ad-3e7b-4441-bb8b-7fb2a2021418). The pre-entry full run passed all rows, including 37/37 protocol tests; final gate stops before those later checks ([complete prior run](https://git.kayg.org/attachments/225baae4-f6af-4cf7-867f-bf5753958841)). No assertions, native code, timeouts or skips changed to resolve fixture setup. Earlier missing-helper, socket-path and cross-filesystem failures remain linked above; real short same-filesystem private fixture state resolved them. Reproduce the review controls: bun test apps/tracer/src/connection. On the locked perf VM with a real binary and production TRACER_DIST, run the committed busy-page-liveness.spec.ts with TRACER_TEST_PORT=4297 and BUSY_PAGE_MEASURE=1; select BUSY_PAGE_DEAD_BUSY=1 or BUSY_PAGE_RESTORE_INPUT=1 for the two negative browser controls. Positive workload uses BUSY_PAGE_PRINTING=1 BUSY_PAGE_OBSERVE_MS=600000 BUSY_PAGE_EXPECT_HEALTHY=1. Stripped static sizes against merge base, same recipe: x86 21,225,872 B (+0 B); ARM 19,427,688 B (+0 B). Both byte-identical to release 5. [Final-head sizes/checksums](https://git.kayg.org/attachments/937f7756-8f0e-4cb0-8524-a06e16805cf3). Review-only production web dist from 253ce0e17: /home/kayg/.cache/codex-scratch/review-busy-page-liveness/review-web (265 files; index.html present). Manifest next to it: review-web.SHA256SUMS ([copy](https://git.kayg.org/attachments/7d406412-df1d-4792-85fb-3a76cd535246)). Production flags INFRATERNAL_CLUSTERS_PREVIEW=0 / INFRATERNAL_RECOVERY_UI=off. Transfer budget passes: critical gzip 300,322/307,200 B, deferred 49,076/51,200 B. The requested /web production handoff is conditional on MERGE and is not produced under HOLD. Reviewer checklist completed for timer/task ordering, nonce correlation, stale-route/reset lifecycle, saved order, focus/input routing, real-engine workload, dependencies/licensing, module documentation and evidence/scope hygiene. VM processes/copy removed; host test-process audit empty; own target, baseline copy and all three fixture roots removed. Review web artifact/evidence retained. [Host cleanup](https://git.kayg.org/attachments/26635e98-2d0e-4053-acd1-21bff36434d9) · [VM cleanup](https://git.kayg.org/attachments/14c5e800-699d-421f-90ef-8f4119b67b78). Worktree clean. Issue remains open. No deployment.
Author
Owner

Round 2 start: branch busy-page-liveness-r2, base 253ce0e17f. Read #245 body and all comments (no parent listed), repository contract/architecture/process and D265/D267. Cherry-picked the four required review test commits as 596869cc3, 9a893f1ec, 61d38ddd5, afb42359c; intentionally red controls preserved. Fix bounded silence accounting and restore focus ownership separately, then real-binary controls/65-session ten-minute perf-VM soak, full fast, zero native growth and production web artifact. No deployment. Push and fast-forward busy-page-liveness only after green, per this brief.

Round 2 start: branch busy-page-liveness-r2, base 253ce0e17f18cb5b2d56fddb600f8156a41c1f80. Read #245 body and all comments (no parent listed), repository contract/architecture/process and D265/D267. Cherry-picked the four required review test commits as 596869cc3, 9a893f1ec, 61d38ddd5, afb42359c; intentionally red controls preserved. Fix bounded silence accounting and restore focus ownership separately, then real-binary controls/65-session ten-minute perf-VM soak, full fast, zero native growth and production web artifact. No deployment. Push and fast-forward busy-page-liveness only after green, per this brief.
Author
Owner

Step 1: 262e54a9c bounds local stall grace to one fresh allowance per correlated peer reply; the final socket task turn is no longer renewable by lateness. The unchanged review controls failed before (51 pass / 3 fail), now 54 pass / 0 fail / 158 assertions. With allowance A and maximum callback gap G, conservative retirement bound after probe issuance is 2A + 3G; no wall bound is possible while no browser task executes. Timely callback cadence/allowance remains unchanged. Strict TypeScript and cargo fmt pass. Raw receipts under busy-page-liveness-r2/evidence/connection-{before,after}.log; attaching with browser evidence after real-binary runs. Found renderer.open also invokes focus and schedules a deferred focus task; restore fix must suppress this source as well as the explicit constructor focus, with the active window choosing initial focus.

Step 1: 262e54a9c bounds local stall grace to one fresh allowance per correlated peer reply; the final socket task turn is no longer renewable by lateness. The unchanged review controls failed before (51 pass / 3 fail), now 54 pass / 0 fail / 158 assertions. With allowance A and maximum callback gap G, conservative retirement bound after probe issuance is 2*A + 3*G; no wall bound is possible while no browser task executes. Timely callback cadence/allowance remains unchanged. Strict TypeScript and cargo fmt pass. Raw receipts under busy-page-liveness-r2/evidence/connection-{before,after}.log; attaching with browser evidence after real-binary runs. Found renderer.open also invokes focus and schedules a deferred focus task; restore fix must suppress this source as well as the explicit constructor focus, with the active window choosing initial focus.
Author
Owner

Focus steps committed: a702a7129 suppresses renderer opening focus (including its deferred callback) and cancels pending automatic focus on focus/pointer/key/input activity; 859bc9aeb lets only the active canvas binding request initial focus and removes stale post-open requests. Renderer yields retained. Strict TypeScript, 21 terminal unit controls and 208 canvas controls pass. Production bundle built at /home/kayg/.cache/codex-scratch/busy-page-liveness-r2/web: critical gzip 300,394/307,200 B, deferred 49,063/51,200 B. Full fast queued through host build-slot with short private same-filesystem runtime root and recovery-helper environment. Real-binary restore/baseline, stopped-route and ten-minute soak are prepared on the named perf VM; no deployment.

Focus steps committed: a702a7129 suppresses renderer opening focus (including its deferred callback) and cancels pending automatic focus on focus/pointer/key/input activity; 859bc9aeb lets only the active canvas binding request initial focus and removes stale post-open requests. Renderer yields retained. Strict TypeScript, 21 terminal unit controls and 208 canvas controls pass. Production bundle built at /home/kayg/.cache/codex-scratch/busy-page-liveness-r2/web: critical gzip 300,394/307,200 B, deferred 49,063/51,200 B. Full fast queued through host build-slot with short private same-filesystem runtime root and recovery-helper environment. Real-binary restore/baseline, stopped-route and ten-minute soak are prepared on the named perf VM; no deployment.
Author
Owner

Round 2 implementation head 37786982f. Added strict virtual-clock bound controls (c26b72f63): four new controls plus the three unchanged review controls fail on 253ce0e17; all 58 connection controls pass on the fix. Helper/focus follow-ups e6b0a8392, d5c32bcb9, 0f9071cbb, 76f1f9b7f and 37786982f share four temporary passive listeners across all pending opens and cover the dynamic import gap. No native/dependency/contract changes.

Locked perf VM, release-5 real binary, production bundle at 859bc9aeb, RTT150: unchanged restore regression PASS (1/8 renderers at first typing; command executed once; chosen/final focus identical); production c00c6364e6 baseline control PASS (8/8; executed once; focus identical). Repeated 75ms busy tasks with retained browser socket and stopped backend now produce client close 4000 and connecting status (PASS; old review had no close). Ending loads in attached receipts. Repeating restore and ten-minute 65-session/three-printer soak on exact final helper bundle now. Full fast cold native compilation active through build-slot, every row enabled. No deployment.

connection-before.log
bounds-before.log
connection-bounds.log
restore.log
baseline-restore.log
dead.log

Round 2 implementation head 37786982f. Added strict virtual-clock bound controls (c26b72f63): four new controls plus the three unchanged review controls fail on 253ce0e17; all 58 connection controls pass on the fix. Helper/focus follow-ups e6b0a8392, d5c32bcb9, 0f9071cbb, 76f1f9b7f and 37786982f share four temporary passive listeners across all pending opens and cover the dynamic import gap. No native/dependency/contract changes. Locked perf VM, release-5 real binary, production bundle at 859bc9aeb, RTT150: unchanged restore regression PASS (1/8 renderers at first typing; command executed once; chosen/final focus identical); production c00c6364e695 baseline control PASS (8/8; executed once; focus identical). Repeated 75ms busy tasks with retained browser socket and stopped backend now produce client close 4000 and connecting status (PASS; old review had no close). Ending loads in attached receipts. Repeating restore and ten-minute 65-session/three-printer soak on exact final helper bundle now. Full fast cold native compilation active through build-slot, every row enabled. No deployment. [connection-before.log](https://git.kayg.org/attachments/f2259566-1052-40c9-a151-d21de1eb58ef) [bounds-before.log](https://git.kayg.org/attachments/fba859b1-867b-42b4-8e65-9dde5d66766e) [connection-bounds.log](https://git.kayg.org/attachments/a0a86812-5cb5-438c-8c16-f954d1597660) [restore.log](https://git.kayg.org/attachments/8c2e151b-b5ff-4964-83a9-49d989fd071e) [baseline-restore.log](https://git.kayg.org/attachments/6db6622d-8e66-4aff-b553-db41189d8026) [dead.log](https://git.kayg.org/attachments/fd8d582e-d32b-4830-86da-8950a93b44ba)
Author
Owner

Exact-head 37786982f production bundle: locked perf VM soak PASS. Linux 6.12.111, 4 vCPU, MemTotal 8,069,112 kB; RTT150 / Chromium 6x; 65 real sessions, 3 verified distinct printing streams, saved window IDs/order unchanged after reload. Observation 600,000 ms; elapsed including restore/printer setup 616,748.5 ms. Client 4000 connection-unresponsive closes: 0 = 0/min. Ending 65 live. Longest task 673 ms. Ending load 1.21/1.19/0.82. This preserves the positive workload while bounding silent routes; no claim that every task meets a frame budget.

Exact helper bundle restore PASS: 1 of 8 initialized at first typing, command executed once, chosen/final focus identical. Exact bundle busy stopped-route PASS: one 4000 close while prescribed 75ms tasks run. Production restore baseline already passed (8 initialized, command executed once). All intentionally failing review assertions remain unchanged.

Functional focus ownership at scale: 65 windows / 130 pending waits share 4 passive listeners, zero after completion. Production web contains 265 files; final commit embedded; critical gzip 300,550/307,200 B and deferred 49,086/51,200 B. web-dist.tar and SHA256SUMS created and all checksums pass. Full fast is in native tests; terminal browser controls are waiting for the perf lock after releasing our short soak lock. No deployment; pushes wait for final green per brief.

soak.log
soak-numbers.json
restore-final.log
dead-final.log
65-sessions.png
restore-input.png
focus-count.log

Exact-head 37786982f production bundle: locked perf VM soak PASS. Linux 6.12.111, 4 vCPU, MemTotal 8,069,112 kB; RTT150 / Chromium 6x; 65 real sessions, 3 verified distinct printing streams, saved window IDs/order unchanged after reload. Observation 600,000 ms; elapsed including restore/printer setup 616,748.5 ms. Client 4000 connection-unresponsive closes: 0 = 0/min. Ending 65 live. Longest task 673 ms. Ending load 1.21/1.19/0.82. This preserves the positive workload while bounding silent routes; no claim that every task meets a frame budget. Exact helper bundle restore PASS: 1 of 8 initialized at first typing, command executed once, chosen/final focus identical. Exact bundle busy stopped-route PASS: one 4000 close while prescribed 75ms tasks run. Production restore baseline already passed (8 initialized, command executed once). All intentionally failing review assertions remain unchanged. Functional focus ownership at scale: 65 windows / 130 pending waits share 4 passive listeners, zero after completion. Production web contains 265 files; final commit embedded; critical gzip 300,550/307,200 B and deferred 49,086/51,200 B. web-dist.tar and SHA256SUMS created and all checksums pass. Full fast is in native tests; terminal browser controls are waiting for the perf lock after releasing our short soak lock. No deployment; pushes wait for final green per brief. [soak.log](https://git.kayg.org/attachments/4e90f69e-8cac-46b5-8b75-934c2c2882d0) [soak-numbers.json](https://git.kayg.org/attachments/389158c4-b8a0-4bea-afd2-62fb7b8c3e8f) [restore-final.log](https://git.kayg.org/attachments/1b92387b-eacc-4688-b2af-f7429847a867) [dead-final.log](https://git.kayg.org/attachments/d5b7e25f-37d1-43b6-a461-58d1860f61e2) ![65-sessions.png](https://git.kayg.org/attachments/8c062c7f-aaab-4c35-8a2e-ac5ae845d16f) ![restore-input.png](https://git.kayg.org/attachments/c639c589-b7d2-4baf-984f-b69bdc4b4a78) [focus-count.log](https://git.kayg.org/attachments/3aa87a1e-c644-4678-b0f6-58cdfd599619)
Author
Owner

Full fast first run: native test row failed only in recovery_support review_live_session_socket_in_newline_home_blocks_cleanup: Python bind raises AF_UNIX path too long with /home/kayg/.cache/b245r2. This repeats the setup constraint already recorded in #245, with no source changes. A new private mode-700 same-filesystem /home/kayg/.cache/b2r passes all 11 runnable recovery controls. No assertion, timeout or skip changed. Current full gate continues its static builds; after it releases the slot, rerun every row on exact head 37786982f with the proven shorter root. Native test transcript and preflight attached.

fast-initial-checkpoint.log

Full fast first run: native test row failed only in recovery_support review_live_session_socket_in_newline_home_blocks_cleanup: Python bind raises AF_UNIX path too long with /home/kayg/.cache/b245r2. This repeats the setup constraint already recorded in #245, with no source changes. A new private mode-700 same-filesystem /home/kayg/.cache/b2r passes all 11 runnable recovery controls. No assertion, timeout or skip changed. Current full gate continues its static builds; after it releases the slot, rerun every row on exact head 37786982f with the proven shorter root. Native test transcript and preflight attached. [fast-initial-checkpoint.log](https://git.kayg.org/attachments/386e261f-e3d0-467f-907b-78907614de36)
Author
Owner

Exact-head x86 static build complete: 21,225,872 B, +0 B against release-5 c00c6364e6 (the same native tree as merge base 253ce0e17). SHA-256 f8afe9bed532d7cf274a72aa9c7f89d1f4aa6d6ca1f8c73b05a7938c2e08da73 is byte-identical to release 5. Same scripts/static-cargo recipe; no native source/dependency/toolchain/build-script changes. ARM static build underway.

Short-root recovery preflight: 11 runnable PASS, existing Docker-only ignore unchanged. Full fast rerun will follow after the current static build releases its slot. After real-browser phases, audit found own fixture processes 3365088 and 3370001; verified own executable/cwd, terminated those exact PIDs with pidfds, confirmed both executable references gone. Final zero-process audit will follow terminal suite. The suite is still waiting for the perf lock. No deployment.

native-comparison.json
recovery-short-root.log
vm-after-soak-audit.log
vm-after-soak-cleanup.log

Exact-head x86 static build complete: 21,225,872 B, +0 B against release-5 c00c6364e695 (the same native tree as merge base 253ce0e17). SHA-256 f8afe9bed532d7cf274a72aa9c7f89d1f4aa6d6ca1f8c73b05a7938c2e08da73 is byte-identical to release 5. Same scripts/static-cargo recipe; no native source/dependency/toolchain/build-script changes. ARM static build underway. Short-root recovery preflight: 11 runnable PASS, existing Docker-only ignore unchanged. Full fast rerun will follow after the current static build releases its slot. After real-browser phases, audit found own fixture processes 3365088 and 3370001; verified own executable/cwd, terminated those exact PIDs with pidfds, confirmed both executable references gone. Final zero-process audit will follow terminal suite. The suite is still waiting for the perf lock. No deployment. [native-comparison.json](https://git.kayg.org/attachments/3248556b-c19b-4c62-9c19-ee4f87fb70b4) [recovery-short-root.log](https://git.kayg.org/attachments/32d6409f-bd43-4168-a308-194ca451ea15) [vm-after-soak-audit.log](https://git.kayg.org/attachments/29b00176-e110-4d7e-9924-d795ff933b2b) [vm-after-soak-cleanup.log](https://git.kayg.org/attachments/9e30f189-9975-4e98-8a70-a4558325b4dc)
Author
Owner

Both static builds completed and PASS on 37786982f: x86 21,225,872 B / ARM 19,427,688 B, both +0 B and byte-identical to release-5 full artifacts (native source equals merge base). Initial full fast exits 1 only at the already-recorded recovery socket-path setup error; fmt, VT fmt, CLI compile-out, clippy, cargo-deny and static builds PASS. Complete transcript attached.

Corrected full fast is queued through build-slot with /home/kayg/.cache/b2r, RUST_TEST_THREADS=1 and the built recovery-helper. That private short same-filesystem root passes all 11 runnable recovery controls. Command prints exact head before running all rows. No source/assertion/timeout/skip changes. Terminal browser suite is still waiting for the shared perf lock. All required real-binary restore/stopped-route/65-session ten-minute observations already pass as linked above; no pushes or deployment yet.

native-comparison.json
fast-initial.log

Both static builds completed and PASS on 37786982f: x86 21,225,872 B / ARM 19,427,688 B, both +0 B and byte-identical to release-5 full artifacts (native source equals merge base). Initial full fast exits 1 only at the already-recorded recovery socket-path setup error; fmt, VT fmt, CLI compile-out, clippy, cargo-deny and static builds PASS. Complete transcript attached. Corrected full fast is queued through build-slot with /home/kayg/.cache/b2r, RUST_TEST_THREADS=1 and the built recovery-helper. That private short same-filesystem root passes all 11 runnable recovery controls. Command prints exact head before running all rows. No source/assertion/timeout/skip changes. Terminal browser suite is still waiting for the shared perf lock. All required real-binary restore/stopped-route/65-session ten-minute observations already pass as linked above; no pushes or deployment yet. [native-comparison.json](https://git.kayg.org/attachments/dc8436d2-9c44-4a25-b68d-3d15b82faa8c) [fast-initial.log](https://git.kayg.org/attachments/6988d5f2-5651-4466-9abc-a7377f6cc1d7)
Author
Owner

Perf VM fairness checkpoint: terminal browser suite has waited 45 minutes for /var/lock/perf-bench.lock since the exact-head stopped-route run ended around 23:46 CEST. Current receipt:

2026-10-19T00:31:46+02:00
addhost-readd root 2026-10-18T22:23:40.964705+00:00

Continuing to wait; no lock modification or other job process action. Required real-binary restore/baseline, stopped-route and 65-session ten-minute soak already pass. Corrected full fast has passed the formerly failing recovery controls and is progressing through 615 server tests on exact head 37786982f. Both static full binaries are byte-identical to release 5, +0 B. No push/deployment yet.

Perf VM fairness checkpoint: terminal browser suite has waited 45 minutes for /var/lock/perf-bench.lock since the exact-head stopped-route run ended around 23:46 CEST. Current receipt: ``` 2026-10-19T00:31:46+02:00 addhost-readd root 2026-10-18T22:23:40.964705+00:00 ``` Continuing to wait; no lock modification or other job process action. Required real-binary restore/baseline, stopped-route and 65-session ten-minute soak already pass. Corrected full fast has passed the formerly failing recovery controls and is progressing through 615 server tests on exact head 37786982f. Both static full binaries are byte-identical to release 5, +0 B. No push/deployment yet.
Author
Owner

Full scripts/verify fast PASS, exit 0, exact head 37786982f1 (printed at transcript start). Every row enabled, same short private /home/kayg/.cache/b2r, built recovery-helper, RUST_TEST_THREADS=1. No native source, assertion, timeout or skip changed. Both static full images byte-identical to release 5: x86 21,225,872 B / ARM 19,427,688 B, +0 B each.

Verbatim gate summary and frontend/protocol output:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

 305 pass
 0 fail
 11840 expect() calls
Ran 305 tests across 43 files. [1.73s]

 37 pass
 0 fail
 34463 expect() calls
Ran 37 tests across 10 files. [6.87s]

fast.log
fast-summary.txt
native-comparison.json
web-SHA256SUMS.txt
focused-final.log

Required 65-session ten-minute production soak and real-binary restore/baseline/stopped-route rows remain PASS as linked above. Additional terminal browser suite is still queued on the shared perf lock; 45-minute wait owner receipt recorded. No push/deployment yet. Host audit finds zero own test executable/private fixture cwd references; own native build cache and fixture roots can now be removed.

Full scripts/verify fast PASS, exit 0, exact head 37786982f1abe561973cdc68cddf7ee7c1a4f5dc (printed at transcript start). Every row enabled, same short private /home/kayg/.cache/b2r, built recovery-helper, RUST_TEST_THREADS=1. No native source, assertion, timeout or skip changed. Both static full images byte-identical to release 5: x86 21,225,872 B / ARM 19,427,688 B, +0 B each. Verbatim gate summary and frontend/protocol output: ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 305 pass 0 fail 11840 expect() calls Ran 305 tests across 43 files. [1.73s] 37 pass 0 fail 34463 expect() calls Ran 37 tests across 10 files. [6.87s] ``` [fast.log](https://git.kayg.org/attachments/402a7c84-ba55-45a5-bf03-3b4d54b5c694) [fast-summary.txt](https://git.kayg.org/attachments/04568127-cd71-4409-9217-1fdbed00f513) [native-comparison.json](https://git.kayg.org/attachments/f5471eac-0100-44f7-ac4f-ed034d4cf824) [web-SHA256SUMS.txt](https://git.kayg.org/attachments/cc528095-23f6-4506-a4d4-44e7e8559d95) [focused-final.log](https://git.kayg.org/attachments/d02c5194-947e-4086-8419-8a9307497fc8) Required 65-session ten-minute production soak and real-binary restore/baseline/stopped-route rows remain PASS as linked above. Additional terminal browser suite is still queued on the shared perf lock; 45-minute wait owner receipt recorded. No push/deployment yet. Host audit finds zero own test executable/private fixture cwd references; own native build cache and fixture roots can now be removed.
Author
Owner

The first one-hour terminal-suite lock wait ended without starting any browser test. Old waiting-driver audit is empty; no duplicate runner remains. Current owner receipt at 00:46:41 CEST:

{"drivers": [], "descendants": []}
layout-browser-sync 2026-10-19T00:45:57+02:00

Renewed the foreground flock -w 3600 wait and continue; no lock or other process modified. Full fast has completed exit 0 on exact head 37786982f, with all Rust rows, 305 frontend and 37 protocol tests PASS. Own host build target/private runtime roots removed after zero test-process audit. Required real-binary restore/baseline/stopped-route and 65-session ten-minute soak PASS; only the additional terminal browser suite remains before pushes and final cleanup.

The first one-hour terminal-suite lock wait ended without starting any browser test. Old waiting-driver audit is empty; no duplicate runner remains. Current owner receipt at 00:46:41 CEST: ``` {"drivers": [], "descendants": []} layout-browser-sync 2026-10-19T00:45:57+02:00 ``` Renewed the foreground flock -w 3600 wait and continue; no lock or other process modified. Full fast has completed exit 0 on exact head 37786982f, with all Rust rows, 305 frontend and 37 protocol tests PASS. Own host build target/private runtime roots removed after zero test-process audit. Required real-binary restore/baseline/stopped-route and 65-session ten-minute soak PASS; only the additional terminal browser suite remains before pushes and final cleanup.
Author
Owner

Terminal browser suite acquired the perf lock. First attempt used shipping preview=0 at RTT0: 10 pass / 7 fail. Five product-hook tests cannot connect because main.ts:353 deliberately gates __tracerProductTestDouble behind preview=1; the predictive test requires RTT >60 ms. Theme socket-count mismatch also observed in that initial sequence. No test assertions changed.

Rerun with the repository browser-test build profile (preview=1, recovery UI off), exact same source head 37786982f, RTT150, locked perf VM: all 16 functional/interaction rows PASS, including theme socket preservation, links/touch, DPR1/2/3, replay, sign-in/resume and predictive input. Predicted glyph p99 13.6/17 ms, reconnect p99 556.3/600 ms, returning sign-in p99 3107/5000 ms. Machine/load and raw samples in receipt.

The 17th row is the already-documented RTT150 local-first-paint profile failure (setup/signin screenshot upper bounds 1220.1/1150.3 ms). Prior #245 production baseline control also fails this profile (1306/1091 ms, linked earlier). No budget changed or test waived. Queueing the unchanged local first-paint reference at RTT0, plus an isolated RTT0 theme/socket check to resolve the initial sequence result. Production handoff remains the previously measured preview=0 web artifact; the test-hook build is separate.

terminal-browser.log
terminal-browser-preview.log
browser-build.log

Terminal browser suite acquired the perf lock. First attempt used shipping preview=0 at RTT0: 10 pass / 7 fail. Five product-hook tests cannot connect because main.ts:353 deliberately gates __tracerProductTestDouble behind preview=1; the predictive test requires RTT >60 ms. Theme socket-count mismatch also observed in that initial sequence. No test assertions changed. Rerun with the repository browser-test build profile (preview=1, recovery UI off), exact same source head 37786982f, RTT150, locked perf VM: all 16 functional/interaction rows PASS, including theme socket preservation, links/touch, DPR1/2/3, replay, sign-in/resume and predictive input. Predicted glyph p99 13.6/17 ms, reconnect p99 556.3/600 ms, returning sign-in p99 3107/5000 ms. Machine/load and raw samples in receipt. The 17th row is the already-documented RTT150 local-first-paint profile failure (setup/signin screenshot upper bounds 1220.1/1150.3 ms). Prior #245 production baseline control also fails this profile (1306/1091 ms, linked earlier). No budget changed or test waived. Queueing the unchanged local first-paint reference at RTT0, plus an isolated RTT0 theme/socket check to resolve the initial sequence result. Production handoff remains the previously measured preview=0 web artifact; the test-hook build is separate. [terminal-browser.log](https://git.kayg.org/attachments/7246837c-ed4c-49e6-b9b9-81debf590e50) [terminal-browser-preview.log](https://git.kayg.org/attachments/054e3f36-c015-431e-81b9-7547d410d896) [browser-build.log](https://git.kayg.org/attachments/143910ad-b43d-4b23-874b-a59219dd795d)
Author
Owner

Finished round 2: head 37786982f1. Atomic push created busy-page-liveness-r2 and fast-forwarded busy-page-liveness from 253ce0e17; both remote refs verified at this head. Thirteen atomic commits include all four required review cherry-picks; their assertions are preserved. Worktree clean. No deployment; issue left open.

P1-a: only a correlated peer reply replenishes local stall grace. A silent route retires within the conservative 2A + 3G bound after probe issuance, where A is responseAllowance and G bounds liveness callback gaps. No wall bound is possible while the browser executes no callbacks. Added strict bound/replenishment controls fail on 253ce0e17; all 58 connection tests / 172 assertions pass now. P1-b: renderer opening focus and its deferred callback are suppressed; the selected window may take restore focus only while its pre-import/resource-wait intent remains current. Shared packages/ui tracking uses 4 passive listeners for 65 windows / 130 waits, zero after completion. Renderer task yields remain.

Required real-binary rows PASS on the locked perf VM, Linux 6.12.111 / 4 vCPU / 8,069,112 kB RAM, production preview=0 bundle and release-5 full binary (byte-identical to this head):

  • Restore at RTT150: 8 sessions, 1 renderer initialized at first typing, command executed exactly once, chosen/final focus identical. Production baseline control: 8 initialized, command executed once, focus identical.
  • Repeated 75ms busy tasks with retained socket/stopped backend: client 4000 retirement observed.
  • 65 sessions / 3 verified printing streams / RTT150 / CPU6x: 600,000ms observation, 616,748.5ms including restore/workload setup; 0 client 4000 liveness closes = 0/min; ending all 65 live; longest task 673ms; ending load 1.21/1.19/0.82. Saved window IDs/order match. This is an observed maximum, not a universal frame-time bound.

Full scripts/verify fast completed exit 0 on this exact head, every row enabled. Private short same-filesystem fixture root and built recovery-helper resolve the initial AF_UNIX path setup error; no source/assertion/timeout/skip change. Verbatim final gate summary and frontend/protocol output:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

 305 pass
 0 fail
 11840 expect() calls
Ran 305 tests across 43 files. [1.73s]

 37 pass
 0 fail
 34463 expect() calls
Ran 37 tests across 10 files. [6.87s]

Both stripped static full images are byte-identical to release 5 with the same recipe: x86 21,225,872 B / ARM 19,427,688 B, +0 B each. No native source/dependency/toolchain/build-script change.

Terminal browser coverage: 16 interaction cases PASS at RTT150 (standard preview=1 browser-test build): DPR1/2/3, fresh/reset renderer, links/touch, replay, theme/socket preservation, sign-in, resume and predictive input. Predicted glyph p99 13.6/17ms, reconnect p99 556.3/600ms, returning sign-in p99 3107/5000ms. Local first-paint reference PASS at RTT0 on the shipping bundle: setup/signin screenshot upper bounds 501.1/144.3ms, budget 1000ms. Extra profiles remain red and are retained, without waived assertions or budgets: RTT150 first-paint fails as already documented on the production baseline; the isolated RTT0 theme/socket check fails identically on this head and release-5 baseline (6 opened / 6 closed / 0 active). These are pre-existing profile failures. Initial hook-disabled/zero-RTT suite setup errors are also retained in the earlier receipts.

Production handoff at /home/kayg/.cache/codex-scratch/busy-page-liveness-r2/:

  • web/ (265 files, index.html present, exact head embedded), web-dist.tar, SHA256SUMS; every checksum verifies.
  • Flags: INFRATERNAL_CLUSTERS_PREVIEW=0 / INFRATERNAL_RECOVERY_UI=off.
  • Critical gzip 300,550/307,200 B; deferred 49,086/51,200 B. The separate test-hook build is not the handoff.

Author checklist completed for timer/task order, correlation, reset lifecycle, focus ownership, shared component reuse, source documentation, dependencies/licensing, real-engine coverage and evidence hygiene. Host audit zero owned test references; own native target and both private fixture roots removed. VM audit zero owned executable/cwd references; own VM folders removed. Two leftover fixture processes (3365088, 3370001) were verified by executable/cwd, terminated by exact pidfd and proved gone. No broad process termination.

How to test:

  1. Restore eight saved sessions and type into the first initialized terminal while the rest initialize: the command executes once in that shell.
  2. Run BUSY_PAGE_DEAD_BUSY=1 with the committed real-binary spec: a stopped retained route retires while busy tasks continue.
  3. Run BUSY_PAGE_PRINTING=1 BUSY_PAGE_OBSERVE_MS=600000 BUSY_PAGE_EXPECT_HEALTHY=1 on the locked perf VM: all 65 sessions remain live with zero client 4000 closes.

Gate, native comparison, checksums and focused unit receipts:
fast.log
fast-summary.txt
native-comparison.json
web-SHA256SUMS.txt
focused-final.log

Production soak/restore/stopped-route receipts and screenshots:
soak.log
soak-numbers.json
restore-final.log
dead-final.log
65-sessions.png
restore-input.png
focus-count.log

Terminal profiles and their baseline controls:
terminal-browser.log
terminal-browser-preview.log
browser-build.log

Final local/baseline checks, cleanup, author review and remote-ref proof:
terminal-local.log
terminal-theme-baseline.log
vm-final-process-audit.log
vm-final-cleanup.log
host-test-process-audit.json
reviewer-check.txt
remote-heads.txt
artifact-final-check.log

Finished round 2: head 37786982f1abe561973cdc68cddf7ee7c1a4f5dc. Atomic push created busy-page-liveness-r2 and fast-forwarded busy-page-liveness from 253ce0e17; both remote refs verified at this head. Thirteen atomic commits include all four required review cherry-picks; their assertions are preserved. Worktree clean. No deployment; issue left open. P1-a: only a correlated peer reply replenishes local stall grace. A silent route retires within the conservative 2*A + 3*G bound after probe issuance, where A is responseAllowance and G bounds liveness callback gaps. No wall bound is possible while the browser executes no callbacks. Added strict bound/replenishment controls fail on 253ce0e17; all 58 connection tests / 172 assertions pass now. P1-b: renderer opening focus and its deferred callback are suppressed; the selected window may take restore focus only while its pre-import/resource-wait intent remains current. Shared packages/ui tracking uses 4 passive listeners for 65 windows / 130 waits, zero after completion. Renderer task yields remain. Required real-binary rows PASS on the locked perf VM, Linux 6.12.111 / 4 vCPU / 8,069,112 kB RAM, production preview=0 bundle and release-5 full binary (byte-identical to this head): - Restore at RTT150: 8 sessions, 1 renderer initialized at first typing, command executed exactly once, chosen/final focus identical. Production baseline control: 8 initialized, command executed once, focus identical. - Repeated 75ms busy tasks with retained socket/stopped backend: client 4000 retirement observed. - 65 sessions / 3 verified printing streams / RTT150 / CPU6x: 600,000ms observation, 616,748.5ms including restore/workload setup; 0 client 4000 liveness closes = 0/min; ending all 65 live; longest task 673ms; ending load 1.21/1.19/0.82. Saved window IDs/order match. This is an observed maximum, not a universal frame-time bound. Full scripts/verify fast completed exit 0 on this exact head, every row enabled. Private short same-filesystem fixture root and built recovery-helper resolve the initial AF_UNIX path setup error; no source/assertion/timeout/skip change. Verbatim final gate summary and frontend/protocol output: ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 305 pass 0 fail 11840 expect() calls Ran 305 tests across 43 files. [1.73s] 37 pass 0 fail 34463 expect() calls Ran 37 tests across 10 files. [6.87s] ``` Both stripped static full images are byte-identical to release 5 with the same recipe: x86 21,225,872 B / ARM 19,427,688 B, +0 B each. No native source/dependency/toolchain/build-script change. Terminal browser coverage: 16 interaction cases PASS at RTT150 (standard preview=1 browser-test build): DPR1/2/3, fresh/reset renderer, links/touch, replay, theme/socket preservation, sign-in, resume and predictive input. Predicted glyph p99 13.6/17ms, reconnect p99 556.3/600ms, returning sign-in p99 3107/5000ms. Local first-paint reference PASS at RTT0 on the shipping bundle: setup/signin screenshot upper bounds 501.1/144.3ms, budget 1000ms. Extra profiles remain red and are retained, without waived assertions or budgets: RTT150 first-paint fails as already documented on the production baseline; the isolated RTT0 theme/socket check fails identically on this head and release-5 baseline (6 opened / 6 closed / 0 active). These are pre-existing profile failures. Initial hook-disabled/zero-RTT suite setup errors are also retained in the earlier receipts. Production handoff at /home/kayg/.cache/codex-scratch/busy-page-liveness-r2/: - web/ (265 files, index.html present, exact head embedded), web-dist.tar, SHA256SUMS; every checksum verifies. - Flags: INFRATERNAL_CLUSTERS_PREVIEW=0 / INFRATERNAL_RECOVERY_UI=off. - Critical gzip 300,550/307,200 B; deferred 49,086/51,200 B. The separate test-hook build is not the handoff. Author checklist completed for timer/task order, correlation, reset lifecycle, focus ownership, shared component reuse, source documentation, dependencies/licensing, real-engine coverage and evidence hygiene. Host audit zero owned test references; own native target and both private fixture roots removed. VM audit zero owned executable/cwd references; own VM folders removed. Two leftover fixture processes (3365088, 3370001) were verified by executable/cwd, terminated by exact pidfd and proved gone. No broad process termination. How to test: 1. Restore eight saved sessions and type into the first initialized terminal while the rest initialize: the command executes once in that shell. 2. Run BUSY_PAGE_DEAD_BUSY=1 with the committed real-binary spec: a stopped retained route retires while busy tasks continue. 3. Run BUSY_PAGE_PRINTING=1 BUSY_PAGE_OBSERVE_MS=600000 BUSY_PAGE_EXPECT_HEALTHY=1 on the locked perf VM: all 65 sessions remain live with zero client 4000 closes. Gate, native comparison, checksums and focused unit receipts: [fast.log](https://git.kayg.org/attachments/402a7c84-ba55-45a5-bf03-3b4d54b5c694) [fast-summary.txt](https://git.kayg.org/attachments/04568127-cd71-4409-9217-1fdbed00f513) [native-comparison.json](https://git.kayg.org/attachments/f5471eac-0100-44f7-ac4f-ed034d4cf824) [web-SHA256SUMS.txt](https://git.kayg.org/attachments/cc528095-23f6-4506-a4d4-44e7e8559d95) [focused-final.log](https://git.kayg.org/attachments/d02c5194-947e-4086-8419-8a9307497fc8) Production soak/restore/stopped-route receipts and screenshots: [soak.log](https://git.kayg.org/attachments/4e90f69e-8cac-46b5-8b75-934c2c2882d0) [soak-numbers.json](https://git.kayg.org/attachments/389158c4-b8a0-4bea-afd2-62fb7b8c3e8f) [restore-final.log](https://git.kayg.org/attachments/1b92387b-eacc-4688-b2af-f7429847a867) [dead-final.log](https://git.kayg.org/attachments/d5b7e25f-37d1-43b6-a461-58d1860f61e2) ![65-sessions.png](https://git.kayg.org/attachments/8c062c7f-aaab-4c35-8a2e-ac5ae845d16f) ![restore-input.png](https://git.kayg.org/attachments/c639c589-b7d2-4baf-984f-b69bdc4b4a78) [focus-count.log](https://git.kayg.org/attachments/3aa87a1e-c644-4678-b0f6-58cdfd599619) Terminal profiles and their baseline controls: [terminal-browser.log](https://git.kayg.org/attachments/7246837c-ed4c-49e6-b9b9-81debf590e50) [terminal-browser-preview.log](https://git.kayg.org/attachments/054e3f36-c015-431e-81b9-7547d410d896) [browser-build.log](https://git.kayg.org/attachments/143910ad-b43d-4b23-874b-a59219dd795d) Final local/baseline checks, cleanup, author review and remote-ref proof: [terminal-local.log](https://git.kayg.org/attachments/2b7dd790-991f-432a-a3f8-577fc9505619) [terminal-theme-baseline.log](https://git.kayg.org/attachments/1910c120-1587-4704-ab66-6e3195d15fe6) [vm-final-process-audit.log](https://git.kayg.org/attachments/be5c8309-7274-47b6-9e1f-426f1381823b) [vm-final-cleanup.log](https://git.kayg.org/attachments/b22b2c2d-dc81-4191-83c4-ddfa9e70478e) [host-test-process-audit.json](https://git.kayg.org/attachments/f5226b42-32ea-403e-a665-e1520b7ed44f) [reviewer-check.txt](https://git.kayg.org/attachments/5cff5077-8aea-4bc4-aa76-8686a413fe54) [remote-heads.txt](https://git.kayg.org/attachments/eaebac92-a7f9-4d00-af27-1c8d1503ae57) [artifact-final-check.log](https://git.kayg.org/attachments/b77f4f3e-8a64-40ae-a335-9582f3f1b251)
Author
Owner

Round 2 delta review start: review-busy-page-liveness-r2 at 37786982f1; reviewing 253ce0e17..37786982f. Read #245 body/all 29 comments; no parent listed. Testing correlated/stale replies, confirm-task ordering, reset, large callback gaps and focus ownership across restore/non-terminal surfaces/coarse pointers. Repeating prescribed 65-session/3-printer/RTT150/CPU6x ten-minute soak on locked perf VM; fresh production build comparison and full fast follow. Test commits only, no deployment.

Round 2 delta review start: review-busy-page-liveness-r2 at 37786982f1abe561973cdc68cddf7ee7c1a4f5dc; reviewing 253ce0e17..37786982f. Read #245 body/all 29 comments; no parent listed. Testing correlated/stale replies, confirm-task ordering, reset, large callback gaps and focus ownership across restore/non-terminal surfaces/coarse pointers. Repeating prescribed 65-session/3-printer/RTT150/CPU6x ten-minute soak on locked perf VM; fresh production build comparison and full fast follow. Test commits only, no deployment.
Author
Owner

Review step pushed: f3123ca133 (tests only). Four additional controls pass: alternating late/timely callbacks with duplicate, unknown-nonce or wrong-timestamp replies cannot renew consumed grace; a correlated reply between expiry and confirmation recovers but its duplicate cannot. All 62 connection tests / 177 assertions pass, strict tracer compiler passes. No new P0/P1 reproduced. Prescribed ten-minute perf-VM soak running on fresh production 37786982f bundle. Initial browser fixture attempt stopped before workload due to long runtime socket path; rerun uses owned short private root. Author/fresh SHA256 manifests differ; review handoff rebuilt at /home/kayg/.cache/codex-scratch/review-busy-page-liveness-r2/web (265 files); focus matrix queued behind our soak lock.

Review step pushed: f3123ca1337aa6816584799c70289891bc1ecdf9 (tests only). Four additional controls pass: alternating late/timely callbacks with duplicate, unknown-nonce or wrong-timestamp replies cannot renew consumed grace; a correlated reply between expiry and confirmation recovers but its duplicate cannot. All 62 connection tests / 177 assertions pass, strict tracer compiler passes. No new P0/P1 reproduced. Prescribed ten-minute perf-VM soak running on fresh production 37786982f bundle. Initial browser fixture attempt stopped before workload due to long runtime socket path; rerun uses owned short private root. Author/fresh SHA256 manifests differ; review handoff rebuilt at /home/kayg/.cache/codex-scratch/review-busy-page-liveness-r2/web (265 files); focus matrix queued behind our soak lock.
Author
Owner

P1 / HOLD: continuous typing cancels every silent-route retirement confirmation. Input send (connection.ts:229-232) calls scheduleLiveness(), which clears livenessTimer (:575-576), including the zero-delay confirm installed by checkLiveness (:553-554). The replacement callback always invokes checkLiveness(false), so an input task queued between every expiry callback and its confirmation cancels retirement indefinitely without any peer reply.

New test-only regression at 67133f57d: callbacks every G=75 virtual ms, A=250 ms, terminal-style sampleRoundTrip plus contiguous one-byte Input after each callback, forwarding stopped. Still welcomed after 600000 virtual ms; claimed 2A+3G bound is 725 ms. All other 63 connection controls pass; strict tracer compiler passes. This is a deterministic task-order counterexample, not a build-host performance number. One-shot unacknowledged input tests do not cover continuous rescheduling. No implementation changes. Raw initial counterexample: continuous-input.log. Fresh production ten-minute soak and expanded focus matrix still running/queued; full fast will include the intentionally red review test.

P1 / HOLD: continuous typing cancels every silent-route retirement confirmation. Input send (connection.ts:229-232) calls scheduleLiveness(), which clears livenessTimer (:575-576), including the zero-delay confirm installed by checkLiveness (:553-554). The replacement callback always invokes checkLiveness(false), so an input task queued between every expiry callback and its confirmation cancels retirement indefinitely without any peer reply. New test-only regression at 67133f57d: callbacks every G=75 virtual ms, A=250 ms, terminal-style sampleRoundTrip plus contiguous one-byte Input after each callback, forwarding stopped. Still welcomed after 600000 virtual ms; claimed 2*A+3*G bound is 725 ms. All other 63 connection controls pass; strict tracer compiler passes. This is a deterministic task-order counterexample, not a build-host performance number. One-shot unacknowledged input tests do not cover continuous rescheduling. No implementation changes. Raw initial counterexample: [continuous-input.log](https://git.kayg.org/attachments/3a51409a-be9b-4698-98b6-7cf67f6f2b2a). Fresh production ten-minute soak and expanded focus matrix still running/queued; full fast will include the intentionally red review test.
Author
Owner

Completed reset control: b21f1a3d9 (tests only, pushed). A replacement route gets exactly one independent local-stall grace after the old route consumes its own; all 63 connection tests / 179 assertions passed before adding the intentionally failing P1 test in 67133f57d. Strict tracer compiler passes. For the P1 source references in the preceding comment, exact lines on 37786982f are Input scheduling :219-225, timer cancellation :572, replacement non-confirming callback :581, confirmation :554. The mechanism/conclusion is unchanged. No production edits; HOLD remains.

Completed reset control: b21f1a3d9 (tests only, pushed). A replacement route gets exactly one independent local-stall grace after the old route consumes its own; all 63 connection tests / 179 assertions passed before adding the intentionally failing P1 test in 67133f57d. Strict tracer compiler passes. For the P1 source references in the preceding comment, exact lines on 37786982f are Input scheduling :219-225, timer cancellation :572, replacement non-confirming callback :581, confirmation :554. The mechanism/conclusion is unchanged. No production edits; HOLD remains.
Author
Owner

Independent exact-source production soak PASS on locked perf VM: Linux 6.12.111, 4 vCPU; fresh preview=0/recovery=off web bundle with 37786982f embedded, release-5 real binary. RTT150 / Chromium CPU6x / 65 real sessions / 3 verified printing streams; observation 600000 ms, elapsed including restore/setup 616076.9 ms. Client 4000 connection-unresponsive closes: 0 = 0/min; all 65 live at finish; longest task 423 ms; ending load 1.79/1.63/1.13. Saved window IDs/order assertion passes. The construction-stage native refusals already described on #245 occur before the valid-grid reload; this run is not claimed free of those pre-existing paths.

raw soak · numbers
65 real sessions

HOLD remains: the continuous-input confirmation-cancellation counterexample in 67133f57d is independent of the positive soak. Seven expanded focus controls now running; native fixture build acquired build-slot. Final full fast will retain the intentionally failing regression, with no implementation/assertion change.

Independent exact-source production soak PASS on locked perf VM: Linux 6.12.111, 4 vCPU; fresh preview=0/recovery=off web bundle with 37786982f embedded, release-5 real binary. RTT150 / Chromium CPU6x / 65 real sessions / 3 verified printing streams; observation 600000 ms, elapsed including restore/setup 616076.9 ms. Client 4000 connection-unresponsive closes: 0 = 0/min; all 65 live at finish; longest task 423 ms; ending load 1.79/1.63/1.13. Saved window IDs/order assertion passes. The construction-stage native refusals already described on #245 occur before the valid-grid reload; this run is not claimed free of those pre-existing paths. [raw soak](https://git.kayg.org/attachments/7ceede39-e1c2-43c8-b70c-b2e840066252) · [numbers](https://git.kayg.org/attachments/0d56af21-b7ac-4041-b8c8-36962bf87a07) ![65 real sessions](https://git.kayg.org/attachments/feb6fd2a-7906-4daa-bac2-941064673318) HOLD remains: the continuous-input confirmation-cancellation counterexample in 67133f57d is independent of the positive soak. Seven expanded focus controls now running; native fixture build acquired build-slot. Final full fast will retain the intentionally failing regression, with no implementation/assertion change.
Author
Owner

Review focus step pushed: c3d864974e, fourth atomic test-only review commit. Corrected seven-case production-browser matrix PASS on locked perf VM: 30-window restore keeps palette/button/removed-input focus (including selected-window closure); only selected restored window gets initial focus; desktop one-window initial focus; coarse-pointer no automatic focus then tap focus; 30-window typing executes once in chosen/final terminal. Initial setup failures are retained: all-live construction can hit the documented native refusal path, and historical attachments can exceed current persisted references. Final fixture waits for each current window reference, with unchanged focus assertions. Strict app/spec compilers pass.

Original eight-window restore and repeated-busy stopped-route tests PASS unchanged. No extra focus P0/P1 found. #244 Discard/Send again controls are absent from this source; their combined integration focus path remains untested. The button check uses the sidebar control; no dedicated toast-action case or native iPhone run was performed.

Full scripts/verify fast is active on exact c3d864974, all rows enabled, short private fixture root, built recovery helper and RUST_TEST_THREADS=1. The new continuous-input regression remains intentionally red; HOLD, P0=0/P1=1. VM audit found owned fixture PID 3480664; executable/cwd proved ownership, exact pidfd TERM, zero remaining references; owned VM directories removed. Host target retained only until gate completes. No deployment.

focus.log
original-browser-controls.log
continuous-input.log

restore-palette.png
phone-tap.png

Review focus step pushed: c3d864974e79afdd334614f97aea2782044cdeba, fourth atomic test-only review commit. Corrected seven-case production-browser matrix PASS on locked perf VM: 30-window restore keeps palette/button/removed-input focus (including selected-window closure); only selected restored window gets initial focus; desktop one-window initial focus; coarse-pointer no automatic focus then tap focus; 30-window typing executes once in chosen/final terminal. Initial setup failures are retained: all-live construction can hit the documented native refusal path, and historical attachments can exceed current persisted references. Final fixture waits for each current window reference, with unchanged focus assertions. Strict app/spec compilers pass. Original eight-window restore and repeated-busy stopped-route tests PASS unchanged. No extra focus P0/P1 found. #244 Discard/Send again controls are absent from this source; their combined integration focus path remains untested. The button check uses the sidebar control; no dedicated toast-action case or native iPhone run was performed. Full scripts/verify fast is active on exact c3d864974, all rows enabled, short private fixture root, built recovery helper and RUST_TEST_THREADS=1. The new continuous-input regression remains intentionally red; HOLD, P0=0/P1=1. VM audit found owned fixture PID 3480664; executable/cwd proved ownership, exact pidfd TERM, zero remaining references; owned VM directories removed. Host target retained only until gate completes. No deployment. [focus.log](https://git.kayg.org/attachments/ed736f7a-2208-44a7-afa0-de0310526e77) [original-browser-controls.log](https://git.kayg.org/attachments/5eec63e9-e038-44ce-9a96-fef60726be4e) [continuous-input.log](https://git.kayg.org/attachments/6545026e-9b68-4b09-9f09-9e2dc7df536f) ![restore-palette.png](https://git.kayg.org/attachments/73b1ecbe-3bfe-462a-9311-2fe48eced509) ![phone-tap.png](https://git.kayg.org/attachments/abef8edc-ebdb-4424-a48c-a5c60d353486)
Author
Owner

Gate checkpoint on exact review head c3d864974e: fmt, VT fmt, CLI plugin compile-out, clippy, full native test row and cargo-deny PASS. Fresh stripped static x86_64: 21225872 B, +0 B against merge base/release 5, byte-identical SHA256 f8afe9bed532d7cf274a72aa9c7f89d1f4aa6d6ca1f8c73b05a7938c2e08da73; PT_INTERP absent, production trust PASS. Same scripts/static-cargo recipe; native source/dependency/toolchain delta empty. ARM static build active, so full scripts/verify fast is not finished. Frontend must still execute the intentionally failing continuous-input regression; HOLD remains P0=0/P1=1. All browser phases completed and own VM processes/folders removed; host target retained only until final gate.

Gate checkpoint on exact review head c3d864974e79afdd334614f97aea2782044cdeba: fmt, VT fmt, CLI plugin compile-out, clippy, full native test row and cargo-deny PASS. Fresh stripped static x86_64: 21225872 B, +0 B against merge base/release 5, byte-identical SHA256 f8afe9bed532d7cf274a72aa9c7f89d1f4aa6d6ca1f8c73b05a7938c2e08da73; PT_INTERP absent, production trust PASS. Same scripts/static-cargo recipe; native source/dependency/toolchain delta empty. ARM static build active, so full scripts/verify fast is not finished. Frontend must still execute the intentionally failing continuous-input regression; HOLD remains P0=0/P1=1. All browser phases completed and own VM processes/folders removed; host target retained only until final gate.
Author
Owner

Finished delta review: HOLD. P0=0, P1=1, P2=0, P3=0.

Reviewed 253ce0e17..37786982f1abe561973cdc68cddf7ee7c1a4f5dc. Review branch review-busy-page-liveness-r2, head c3d864974e, four atomic test-only commits, pushed and remote verified. No implementation/dependency/contract changes. Issue remains open. No deployment.

P1 — continuous input cancels every silent-route retirement confirmation (connection.ts:219-225, 305, 554, 572, 581). Input and urgent RTT sampling call scheduleLiveness, which clears the pending zero-delay confirmation and replaces it with checkLiveness(false). A queued input task between every expiry check and confirmation prevents retirement without a correlated peer reply. Regression 67133f57d mirrors terminal sampling plus contiguous one-byte Input: actual liveness checks every G=75 virtual ms, A=250 ms, still welcomed after 600000 virtual ms versus the claimed 725 ms bound. This is a task-order counterexample, not a measured browser failure rate. The previous one-shot typing controls do not cover this rescheduling. Preserve the pending confirmation across input/sampling reschedules; the failing test is committed unchanged.

Other connection controls: 63 PASS, including duplicate/unknown/wrong-timestamp replies, queued reply between expiry and confirmation, replacement-route grace, and large callback gaps. No additional focus P0/P1 found. Locked perf VM, fresh production preview=0/recovery=off bundle with 37786982f embedded, real release-5 binary:

  • Required soak: 65 real sessions / 3 verified printing streams / RTT150 / Chromium CPU6x; 600000 ms observation, 616076.9 ms including restore/setup; 0 client 4000 liveness closes = 0/min, ending all 65 live, longest observed task 423 ms; ending load 1.79/1.63/1.13. Saved IDs/order assertion PASS.
  • Original eight-window restore PASS: 1 initialized at first typing, command executes once, chosen/final focus identical. Original repeated-busy stopped-route control PASS: client 4000 and connecting state.
  • Seven added focus cases PASS: palette/button/removed-input focus across 30 windows, selected window closed mid-restore, selected-only initial focus, desktop initial focus, coarse-pointer wait then tap, and typing into one of 30 restoring shells.
  • Shared focus lifecycle: 65 windows / 130 waits use 4 listeners; all 130 superseded by focus; 0 listeners after disposal. Functional count, not a host timing measurement.

Coverage limits: the phone check is coarse-pointer emulation. #244 Discard/Send again controls are absent from this source; combined integration focus remains untested. Initial focus harness failures are retained: native construction live-state wait, then historical bridge counts missing current saved references. Final fixture waits for each current saved window reference; focus assertions were unchanged.

Full scripts/verify fast on this exact head exits 1 only at the intentionally failing P1 regression. Every Rust row PASS. Verbatim final summary:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

1 tests failed:
(fail) continuous typing cannot cancel every silent-route confirmation turn [82.00ms]

 310 pass
 1 fail
 11848 expect() calls
Ran 311 tests across 43 files. [1.52s]

Fresh stripped static builds, same scripts/static-cargo recipe against merge base/release 5: x86_64 21225872 B / ARM 19427688 B, both +0 B and byte-identical. Native source/dependency/toolchain diff is empty. No size exception is needed.

Actual 265-file author/fresh production web trees differ by SHA256 manifest. Fresh 37786982f review bundle retained at /home/kayg/.cache/codex-scratch/review-busy-page-liveness-r2/web (265 files, index.html, exact source head embedded). Its transfer gate passes: critical gzip 300548/307200 B, deferred 49085/51200 B.

The TypeScript protocol row, run separately after the full gate stopped at the intentional frontend failure, passes 37 tests / 0 fail / 34463 assertions. The already-built oracle was reused. The redundant queued production rebuild was cancelled before it started; review commits only change tests, and the exact reviewed production build/transfer and its unchanged 265-file manifest were already verified.

Cleanup complete: VM owned fixture PID 3480664 was verified by executable/cwd and terminated by exact pidfd; zero remaining references and both owned VM folders removed. Host test-reference audit is empty; owned target and short private fixture root removed. Only queued wrapper PID 2508678 and its own sleep child were stopped before any follow-up command started. Web artifact/evidence retained. Reviewer checklist completed.

Gate, hashes, remote ref and audit receipts:
fast.log
fast-summary.txt
native-comparison.json
host-test-processes.json
remote-head.txt

Browser receipts:
soak-short-root.log
soak-numbers.json
65-sessions.png
focus.log
original-browser-controls.log
continuous-input.log
restore-palette.png
phone-tap.png

Web comparison and VM cleanup:
web-comparison.json
author-SHA256SUMS.txt
fresh-SHA256SUMS.txt
vm-process-cleanup.json
vm-cleanup.txt
focus-scale.log

Earlier harness setup attempts:
focus-initial.log
focus-attachments.log

protocol.log
host-cleanup.json
web-final-check.json
reviewer-check.txt
findings.txt

Reproduce the P1: bun test apps/tracer/src/connection. Real-browser review cases: BUSY_PAGE_MEASURE=1 TRACER_TEST_PORT=4298 bun x --bun playwright test -c playwright.real.config.ts real/busy-page-liveness.spec.ts --grep round-2, using the locked perf VM, real binary and production TRACER_DIST. The unchanged original restore/stopped-route/soak selectors are documented in this issue and the committed spec.

Finished delta review: HOLD. P0=0, P1=1, P2=0, P3=0. Reviewed 253ce0e17..37786982f1abe561973cdc68cddf7ee7c1a4f5dc. Review branch review-busy-page-liveness-r2, head c3d864974e79afdd334614f97aea2782044cdeba, four atomic test-only commits, pushed and remote verified. No implementation/dependency/contract changes. Issue remains open. No deployment. P1 — continuous input cancels every silent-route retirement confirmation (connection.ts:219-225, 305, 554, 572, 581). Input and urgent RTT sampling call scheduleLiveness, which clears the pending zero-delay confirmation and replaces it with checkLiveness(false). A queued input task between every expiry check and confirmation prevents retirement without a correlated peer reply. Regression 67133f57d mirrors terminal sampling plus contiguous one-byte Input: actual liveness checks every G=75 virtual ms, A=250 ms, still welcomed after 600000 virtual ms versus the claimed 725 ms bound. This is a task-order counterexample, not a measured browser failure rate. The previous one-shot typing controls do not cover this rescheduling. Preserve the pending confirmation across input/sampling reschedules; the failing test is committed unchanged. Other connection controls: 63 PASS, including duplicate/unknown/wrong-timestamp replies, queued reply between expiry and confirmation, replacement-route grace, and large callback gaps. No additional focus P0/P1 found. Locked perf VM, fresh production preview=0/recovery=off bundle with 37786982f embedded, real release-5 binary: - Required soak: 65 real sessions / 3 verified printing streams / RTT150 / Chromium CPU6x; 600000 ms observation, 616076.9 ms including restore/setup; 0 client 4000 liveness closes = 0/min, ending all 65 live, longest observed task 423 ms; ending load 1.79/1.63/1.13. Saved IDs/order assertion PASS. - Original eight-window restore PASS: 1 initialized at first typing, command executes once, chosen/final focus identical. Original repeated-busy stopped-route control PASS: client 4000 and connecting state. - Seven added focus cases PASS: palette/button/removed-input focus across 30 windows, selected window closed mid-restore, selected-only initial focus, desktop initial focus, coarse-pointer wait then tap, and typing into one of 30 restoring shells. - Shared focus lifecycle: 65 windows / 130 waits use 4 listeners; all 130 superseded by focus; 0 listeners after disposal. Functional count, not a host timing measurement. Coverage limits: the phone check is coarse-pointer emulation. #244 Discard/Send again controls are absent from this source; combined integration focus remains untested. Initial focus harness failures are retained: native construction live-state wait, then historical bridge counts missing current saved references. Final fixture waits for each current saved window reference; focus assertions were unchanged. Full scripts/verify fast on this exact head exits 1 only at the intentionally failing P1 regression. Every Rust row PASS. Verbatim final summary: ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 1 tests failed: (fail) continuous typing cannot cancel every silent-route confirmation turn [82.00ms] 310 pass 1 fail 11848 expect() calls Ran 311 tests across 43 files. [1.52s] ``` Fresh stripped static builds, same scripts/static-cargo recipe against merge base/release 5: x86_64 21225872 B / ARM 19427688 B, both +0 B and byte-identical. Native source/dependency/toolchain diff is empty. No size exception is needed. Actual 265-file author/fresh production web trees differ by SHA256 manifest. Fresh 37786982f review bundle retained at /home/kayg/.cache/codex-scratch/review-busy-page-liveness-r2/web (265 files, index.html, exact source head embedded). Its transfer gate passes: critical gzip 300548/307200 B, deferred 49085/51200 B. The TypeScript protocol row, run separately after the full gate stopped at the intentional frontend failure, passes 37 tests / 0 fail / 34463 assertions. The already-built oracle was reused. The redundant queued production rebuild was cancelled before it started; review commits only change tests, and the exact reviewed production build/transfer and its unchanged 265-file manifest were already verified. Cleanup complete: VM owned fixture PID 3480664 was verified by executable/cwd and terminated by exact pidfd; zero remaining references and both owned VM folders removed. Host test-reference audit is empty; owned target and short private fixture root removed. Only queued wrapper PID 2508678 and its own sleep child were stopped before any follow-up command started. Web artifact/evidence retained. Reviewer checklist completed. Gate, hashes, remote ref and audit receipts: [fast.log](https://git.kayg.org/attachments/3b152f9a-05df-4ed2-b727-266675cc42f4) [fast-summary.txt](https://git.kayg.org/attachments/ab70b573-728e-48b6-a4b3-f4564b278a5e) [native-comparison.json](https://git.kayg.org/attachments/76133bdb-aa23-4dd8-a6e2-1e7ee23e6749) [host-test-processes.json](https://git.kayg.org/attachments/ac6c07f9-770f-4658-9308-ad6888fe2e1c) [remote-head.txt](https://git.kayg.org/attachments/4fa41d59-28b0-465f-88c0-f4444732334c) Browser receipts: [soak-short-root.log](https://git.kayg.org/attachments/7ceede39-e1c2-43c8-b70c-b2e840066252) [soak-numbers.json](https://git.kayg.org/attachments/0d56af21-b7ac-4041-b8c8-36962bf87a07) ![65-sessions.png](https://git.kayg.org/attachments/feb6fd2a-7906-4daa-bac2-941064673318) [focus.log](https://git.kayg.org/attachments/ed736f7a-2208-44a7-afa0-de0310526e77) [original-browser-controls.log](https://git.kayg.org/attachments/5eec63e9-e038-44ce-9a96-fef60726be4e) [continuous-input.log](https://git.kayg.org/attachments/6545026e-9b68-4b09-9f09-9e2dc7df536f) ![restore-palette.png](https://git.kayg.org/attachments/73b1ecbe-3bfe-462a-9311-2fe48eced509) ![phone-tap.png](https://git.kayg.org/attachments/abef8edc-ebdb-4424-a48c-a5c60d353486) Web comparison and VM cleanup: [web-comparison.json](https://git.kayg.org/attachments/2940fa9f-2ee4-426f-b797-7ad43773b91a) [author-SHA256SUMS.txt](https://git.kayg.org/attachments/d8841986-2b41-4da2-b174-374f62c12e54) [fresh-SHA256SUMS.txt](https://git.kayg.org/attachments/53ef6d47-5c67-4418-96bf-7516583224c4) [vm-process-cleanup.json](https://git.kayg.org/attachments/aa93d24c-c94d-431a-907c-8f3af6bdb0b9) [vm-cleanup.txt](https://git.kayg.org/attachments/7762bd8d-822a-4ca8-a3c8-f5df1650a57b) [focus-scale.log](https://git.kayg.org/attachments/2ade3508-6d42-4277-b04c-537043c3729c) Earlier harness setup attempts: [focus-initial.log](https://git.kayg.org/attachments/17d6498d-3f3b-404c-b0a8-682e721647ea) [focus-attachments.log](https://git.kayg.org/attachments/ec86e445-5037-4bc0-a5de-2d5e3221e757) [protocol.log](https://git.kayg.org/attachments/3ee0dffa-767e-4255-8da9-a2ab062ed685) [host-cleanup.json](https://git.kayg.org/attachments/67c6cb6f-b8e2-4757-8a75-9c88a9bd64c0) [web-final-check.json](https://git.kayg.org/attachments/1b538b3d-fd0b-4c64-bbe8-39cb80527ef6) [reviewer-check.txt](https://git.kayg.org/attachments/44021e8e-eeeb-4819-9e3f-cb2a7893b5f1) [findings.txt](https://git.kayg.org/attachments/d318102a-2bb1-4f75-ab98-b05df3ba5666) Reproduce the P1: bun test apps/tracer/src/connection. Real-browser review cases: BUSY_PAGE_MEASURE=1 TRACER_TEST_PORT=4298 bun x --bun playwright test -c playwright.real.config.ts real/busy-page-liveness.spec.ts --grep round-2, using the locked perf VM, real binary and production TRACER_DIST. The unchanged original restore/stopped-route/soak selectors are documented in this issue and the committed spec.
Author
Owner

Start #245 round 3: branch busy-page-liveness-r3, base 37786982f1 (origin/busy-page-liveness). Read all #245 comments; prior reviewers recorded no parent issue. Cherry-picking the four review test commits unchanged, then fixing confirmation scheduling and running focused tests, production build, locked 65-session soak, binary-size comparison and final fast. No deployment.

Start #245 round 3: branch busy-page-liveness-r3, base 37786982f1abe561973cdc68cddf7ee7c1a4f5dc (origin/busy-page-liveness). Read all #245 comments; prior reviewers recorded no parent issue. Cherry-picking the four review test commits unchanged, then fixing confirmation scheduling and running focused tests, production build, locked 65-session soak, binary-size comparison and final fast. No deployment.
Author
Owner

Review controls cherry-picked unchanged as ee900c662, 48b19892d, 8606ae31f and 0391200b5; branch head 0391200b5. Before the implementation change, the exact continuous-input control fails: 0 pass / 1 fail, 600,000 virtual ms elapsed, isWelcomed remains true. Receipt: /home/kayg/.cache/codex-scratch/busy-page-liveness-r3/evidence/continuous-input-before.log. The full connection test set is queued through build-slot.

Review controls cherry-picked unchanged as ee900c662, 48b19892d, 8606ae31f and 0391200b5; branch head 0391200b5. Before the implementation change, the exact continuous-input control fails: 0 pass / 1 fail, 600,000 virtual ms elapsed, `isWelcomed` remains true. Receipt: /home/kayg/.cache/codex-scratch/busy-page-liveness-r3/evidence/continuous-input-before.log. The full connection test set is queued through build-slot.
Author
Owner

Step 1 committed: e0398acfa9. Input/probe scheduling now preserves a pending zero-delay confirmation; reset clears its pending state. The unchanged continuous-input control changes from 0 pass / 1 fail with the route still welcomed after 600,000 virtual ms to 1 pass. apps/tracer bun run check passes. The full connection test set is queued through the shared build slot.

Step 1 committed: e0398acfa9565a9a293168b05db8b31eb74d4877. Input/probe scheduling now preserves a pending zero-delay confirmation; reset clears its pending state. The unchanged continuous-input control changes from 0 pass / 1 fail with the route still welcomed after 600,000 virtual ms to 1 pass. `apps/tracer` `bun run check` passes. The full connection test set is queued through the shared build slot.
Author
Owner

Step 2 verification on e0398acfa9: all connection tests pass, 64 tests / 180 assertions across 7 files; the review's continuous-input control is included. Tracer TypeScript check passes. Before/after receipts: counterexample, full connection suite.

Step 2 verification on e0398acfa9565a9a293168b05db8b31eb74d4877: all connection tests pass, 64 tests / 180 assertions across 7 files; the review's continuous-input control is included. Tracer TypeScript check passes. Before/after receipts: [counterexample](https://git.kayg.org/attachments/57447133-7030-4809-a0f7-e1c436c96d91), [full connection suite](https://git.kayg.org/attachments/b48954f1-d74a-40ab-8f05-4a3c1e929d4d).
Author
Owner

Step 3 production build for e0398acfa9: web/ contains 265 files with the exact commit embedded; web-dist.tar is 3,624,960 B; all 266 SHA256SUMS entries verify. Transfer budget passes: critical gzip 300,592/307,200 B, deferred gzip 49,085/51,200 B. The bundle and checksums were copied to the perf VM job handoff and verified there. The issue helper rejected the 3.6 MB tar with HTTP 422; it remains at /home/kayg/.cache/codex-scratch/busy-page-liveness-r3/web/web-dist.tar.

Receipts: build, transfer budget, checksums, artifact verification.

Step 3 production build for e0398acfa9565a9a293168b05db8b31eb74d4877: `web/` contains 265 files with the exact commit embedded; `web-dist.tar` is 3,624,960 B; all 266 SHA256SUMS entries verify. Transfer budget passes: critical gzip 300,592/307,200 B, deferred gzip 49,085/51,200 B. The bundle and checksums were copied to the perf VM job handoff and verified there. The issue helper rejected the 3.6 MB tar with HTTP 422; it remains at /home/kayg/.cache/codex-scratch/busy-page-liveness-r3/web/web-dist.tar. Receipts: [build](https://git.kayg.org/attachments/60c4e39d-717a-4520-8905-c23ac52b4366), [transfer budget](https://git.kayg.org/attachments/86a2bf9f-2093-4f39-b88e-1dcbc825bbfa), [checksums](https://git.kayg.org/attachments/f4aa88e0-5ba5-45c9-bed7-6217b2e86a02), [artifact verification](https://git.kayg.org/attachments/7d6801f1-4ecc-4a7b-8b14-127f768db6fb).
Author
Owner

Step 4 complete at e0398acfa9565a9a293168b05db8b31eb74d4877. scripts/verify iterate passed: 563 server library tests passed, 52 ignored; full workspace clippy passed in 299s; tracer connection suite passed 64/64; TypeScript protocol suite passed 37 tests / 34,463 assertions. Load-sensitive vt_credit passed in 20.23s and repeated_tiny_credit_pauses_preserve_shell_progress passed as part of the agent review suite. The final line was: ITERATE gate passed. This is not the final gate: run scripts/verify fast before reporting done. Log: iterate.log. Starting the required final fast gate.

Step 4 complete at `e0398acfa9565a9a293168b05db8b31eb74d4877`. `scripts/verify iterate` passed: 563 server library tests passed, 52 ignored; full workspace clippy passed in 299s; tracer connection suite passed 64/64; TypeScript protocol suite passed 37 tests / 34,463 assertions. Load-sensitive `vt_credit` passed in 20.23s and `repeated_tiny_credit_pauses_preserve_shell_progress` passed as part of the agent review suite. The final line was: `ITERATE gate passed. This is not the final gate: run scripts/verify fast before reporting done.` Log: [iterate.log](https://git.kayg.org/attachments/a76be3be-d83d-43c1-8038-90a44641c812). Starting the required final fast gate.
Author
Owner

Step 5 complete at e0398acfa9565a9a293168b05db8b31eb74d4877. scripts/verify fast reports all Rust gate rows PASS, and the final TypeScript protocol suite passed 37/37 with 34,463 assertions. Static artifacts: x86_64 21,225,872 B (exact cap); aarch64 19,427,688 B (exact cap). Full raw output: fast.log.

Verbatim final gate summary:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

 37 pass
 0 fail
 34463 expect() calls
Ran 37 tests across 10 files. [5.26s]

I have queued an explicit same-recipe x86_64 size build at merge base 37786982f1abe561973cdc68cddf7ee7c1a4f5dc to confirm the binary delta.

Step 5 complete at `e0398acfa9565a9a293168b05db8b31eb74d4877`. `scripts/verify fast` reports all Rust gate rows PASS, and the final TypeScript protocol suite passed 37/37 with 34,463 assertions. Static artifacts: x86_64 21,225,872 B (exact cap); aarch64 19,427,688 B (exact cap). Full raw output: [fast.log](https://git.kayg.org/attachments/9117af07-6ade-41fd-9baa-94882a6e03e9). Verbatim final gate summary: ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 37 pass 0 fail 34463 expect() calls Ran 37 tests across 10 files. [5.26s] ``` I have queued an explicit same-recipe x86_64 size build at merge base `37786982f1abe561973cdc68cddf7ee7c1a4f5dc` to confirm the binary delta.
Author
Owner

Perf VM browser preflight: the initial Playwright listing failed before test execution with a bundler AggregateError for missing chromium-bidi; no benchmark or browser test started. The isolated runner also lacked the tracer package manifest and lockfile. I copied those files, ran bun install --frozen-lockfile, and confirmed the exact soak test is discoverable (1 test, 1 file). Logs: failed preflight, successful listing.

Perf VM browser preflight: the initial Playwright listing failed before test execution with a bundler AggregateError for missing `chromium-bidi`; no benchmark or browser test started. The isolated runner also lacked the tracer package manifest and lockfile. I copied those files, ran `bun install --frozen-lockfile`, and confirmed the exact soak test is discoverable (1 test, 1 file). Logs: [failed preflight](https://git.kayg.org/attachments/4d0c6206-afcb-491e-ad3d-ea7e5c4632eb), [successful listing](https://git.kayg.org/attachments/66884339-aedb-4946-bd65-979e3f7d9569).
Author
Owner

Perf VM soak has started under codex-busy-page-liveness-r3-soak-20261019.scope, with the bench lock held, CPUWeight=10000, 4 vCPU, load average 0.19/0.29/0.13 at launch, 65 sessions, 3 shell printers, 150 ms RTT, 6x browser CPU throttling, and a 600,000 ms observation. Two systemd preflights failed before Playwright started because --pipe and then --wait are incompatible with --scope; both were removed, and no browser measurement ran during those attempts. Receipts: scope preflight 1, scope preflight 2.

Perf VM soak has started under `codex-busy-page-liveness-r3-soak-20261019.scope`, with the bench lock held, CPUWeight=10000, 4 vCPU, load average 0.19/0.29/0.13 at launch, 65 sessions, 3 shell printers, 150 ms RTT, 6x browser CPU throttling, and a 600,000 ms observation. Two systemd preflights failed before Playwright started because `--pipe` and then `--wait` are incompatible with `--scope`; both were removed, and no browser measurement ran during those attempts. Receipts: [scope preflight 1](https://git.kayg.org/attachments/940be834-1bde-42e6-8fe8-2a6b30ad23a4), [scope preflight 2](https://git.kayg.org/attachments/d5d61481-eca3-4f7a-8862-f92b204359e2).
Author
Owner

Soak setup reached 65 server sessions and confirmed 3 continuing shell printers. The ready receipt first showed 37/65 live before the page restore; after reload, the spec's assertion that all 65 routes were live passed, then it entered the 600,000 ms observation. The runner remains active; current perf VM load average is 1.38/0.63/0.26. Progress log.

Soak setup reached 65 server sessions and confirmed 3 continuing shell printers. The ready receipt first showed 37/65 live before the page restore; after reload, the spec's assertion that all 65 routes were live passed, then it entered the 600,000 ms observation. The runner remains active; current perf VM load average is 1.38/0.63/0.26. [Progress log](https://git.kayg.org/attachments/a8b7b779-2a87-4d2f-ac84-58147f0cc63a).
Author
Owner

Native binary comparison completed with the same locked static recipe at merge base 37786982f1abe561973cdc68cddf7ee7c1a4f5dc and branch head: stripped x86_64 static-pie size was 21,225,872 bytes at both revisions (delta +0 B). The first baseline invocation lacked the target-scoped Zig path; I reused the job's already pinned Zig 0.15.2 toolchain and the baseline build then completed successfully. Receipts: build log, size comparison, SHA256.

Native binary comparison completed with the same locked static recipe at merge base `37786982f1abe561973cdc68cddf7ee7c1a4f5dc` and branch head: stripped x86_64 static-pie size was 21,225,872 bytes at both revisions (delta +0 B). The first baseline invocation lacked the target-scoped Zig path; I reused the job's already pinned Zig 0.15.2 toolchain and the baseline build then completed successfully. Receipts: [build log](https://git.kayg.org/attachments/e44c5d06-4a42-4162-9691-90c701aedf3d), [size comparison](https://git.kayg.org/attachments/f200f223-9451-410e-be0a-68f167915d9e), [SHA256](https://git.kayg.org/attachments/1ae545c2-3845-4280-8f14-471c37c3b268).
Author
Owner

Perf VM scale soak passed: 65 sessions, 3 shell printers, 150 ms RTT, 6x browser CPU throttle, 600,000 ms observation. There were 0 client unresponsive closes (0.0/min); the longest browser task was 842 ms across 1,261 long-task entries; final state was 65/65 live. The harness recorded 58 connecting-status mutations during the scale interval. Initial setup had 37/65 live before restore; the post-restore 65-live assertion passed before measurement. Load average samples (1/5/15 min): launch 0.19/0.29/0.13, mid-run 4.14/2.14/0.98, scale receipt 2.04/2.00/1.24. Logs, metrics and screenshot: soak.log, 65-session screenshot, metrics.

I initially passed INFRATERNALEVIDENCE_DIR without the underscore required by the evidence helper, so Playwright wrote the screenshot under its PID-scoped fallback directory. I copied the screenshot to this job's external evidence directory and will remove the exact fallback directory during cleanup.

Perf VM scale soak passed: 65 sessions, 3 shell printers, 150 ms RTT, 6x browser CPU throttle, 600,000 ms observation. There were 0 client unresponsive closes (0.0/min); the longest browser task was 842 ms across 1,261 long-task entries; final state was 65/65 live. The harness recorded 58 connecting-status mutations during the scale interval. Initial setup had 37/65 live before restore; the post-restore 65-live assertion passed before measurement. Load average samples (1/5/15 min): launch 0.19/0.29/0.13, mid-run 4.14/2.14/0.98, scale receipt 2.04/2.00/1.24. Logs, metrics and screenshot: [soak.log](https://git.kayg.org/attachments/e2128502-b70f-4b5c-b46a-1ba6c13815bb), [65-session screenshot](https://git.kayg.org/attachments/416ad059-a3de-4d3f-9b2a-43c554066afb), [metrics](https://git.kayg.org/attachments/2cc91213-2e15-4d3f-9b2a-43c554066afb). I initially passed `INFRATERNALEVIDENCE_DIR` without the underscore required by the evidence helper, so Playwright wrote the screenshot under its PID-scoped fallback directory. I copied the screenshot to this job's external evidence directory and will remove the exact fallback directory during cleanup.
Author
Owner

Perf VM cleanup complete: the soak scope is inactive, the observed Playwright CLI/worker/server PIDs are gone or reused, test port 4253 is free, and this job's remote runner/data/runtime plus the exact PID-scoped fallback evidence directory have been removed. Cleanup receipt.

Perf VM cleanup complete: the soak scope is inactive, the observed Playwright CLI/worker/server PIDs are gone or reused, test port 4253 is free, and this job's remote runner/data/runtime plus the exact PID-scoped fallback evidence directory have been removed. [Cleanup receipt](https://git.kayg.org/attachments/06cea041-aa53-4818-9749-22e69d1d831c).
Author
Owner

Finished #245 round 3. HEAD e0398acfa9565a9a293168b05db8b31eb74d4877 is pushed as busy-page-liveness-r3; origin/busy-page-liveness was fast-forwarded to the same SHA. No deploy was performed. The change preserves the zero-delay confirmation timer through Input and other liveness reschedules, while reset/close clears its pending state.

The exact continuous-typing control failed before the fix after 600,000 virtual ms and passes afterward. The connection suite passed 64 tests across 7 files; scripts/verify iterate passed. The 65-session perf VM soak passed with 3 printers, 150 ms RTT, 6x browser CPU throttle, and a 600,000 ms observation: 0 unresponsive closes (0.0/min), longest task 842 ms, 1,261 long-task entries, and all 65 sessions live at the end. The harness recorded 58 connecting-status mutations during the interval. Load average samples (1/5/15 min): start 0.19/0.29/0.13, mid-run 4.14/2.14/0.98, final 2.04/2.00/1.24. Soak log, screenshot, metrics, reviewer checklist, remote cleanup receipt.

The stripped static x86_64 binary is 21,225,872 bytes at both merge base 37786982f1abe561973cdc68cddf7ee7c1a4f5dc and HEAD: +0 B. The production web artifact is retained at /home/kayg/.cache/codex-scratch/busy-page-liveness-r3/web/web-dist.tar, SHA256 5d9b8580a83cb00c7a7ae31822e7daaa1d29aeccc0f8957e014d072fe9ba2888; its SHA256SUMS has 266 verified entries. Size comparison, web checksums.

Final scripts/verify fast gate summary (verbatim; full log):

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

 37 pass
 0 fail
 34463 expect() calls
Ran 37 tests across 10 files. [5.26s]
Finished #245 round 3. HEAD `e0398acfa9565a9a293168b05db8b31eb74d4877` is pushed as `busy-page-liveness-r3`; `origin/busy-page-liveness` was fast-forwarded to the same SHA. No deploy was performed. The change preserves the zero-delay confirmation timer through Input and other liveness reschedules, while reset/close clears its pending state. The exact continuous-typing control failed before the fix after 600,000 virtual ms and passes afterward. The connection suite passed 64 tests across 7 files; `scripts/verify iterate` passed. The 65-session perf VM soak passed with 3 printers, 150 ms RTT, 6x browser CPU throttle, and a 600,000 ms observation: 0 unresponsive closes (0.0/min), longest task 842 ms, 1,261 long-task entries, and all 65 sessions live at the end. The harness recorded 58 connecting-status mutations during the interval. Load average samples (1/5/15 min): start 0.19/0.29/0.13, mid-run 4.14/2.14/0.98, final 2.04/2.00/1.24. [Soak log](https://git.kayg.org/attachments/e2128502-b70f-4b5c-b46a-1ba6c13815bb), [screenshot](https://git.kayg.org/attachments/416ad059-a3de-4d3f-9b2a-43c554066afb), [metrics](https://git.kayg.org/attachments/2cc91213-2e15-4d3f-9b2a-43c554066afb), [reviewer checklist](https://git.kayg.org/attachments/d7aa617f-fa5e-4b8b-a68e-313f99f4376c), [remote cleanup receipt](https://git.kayg.org/attachments/06cea041-aa53-4818-9749-22e69d1d831c). The stripped static x86_64 binary is 21,225,872 bytes at both merge base `37786982f1abe561973cdc68cddf7ee7c1a4f5dc` and HEAD: +0 B. The production web artifact is retained at `/home/kayg/.cache/codex-scratch/busy-page-liveness-r3/web/web-dist.tar`, SHA256 `5d9b8580a83cb00c7a7ae31822e7daaa1d29aeccc0f8957e014d072fe9ba2888`; its `SHA256SUMS` has 266 verified entries. [Size comparison](https://git.kayg.org/attachments/f200f223-9451-410e-be0a-68f167915d9e), [web checksums](https://git.kayg.org/attachments/f4aa88e0-5ba5-45c9-bed7-6217b2e86a02). Final `scripts/verify fast` gate summary (verbatim; [full log](https://git.kayg.org/attachments/9117af07-6ade-41fd-9baa-94882a6e03e9)): ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 37 pass 0 fail 34463 expect() calls Ran 37 tests across 10 files. [5.26s] ```
Author
Owner

Review start: branch review-busy-page-liveness-r3, base 37786982f1abe561973cdc68cddf7ee7c1a4f5dc, head e0398acfa9565a9a293168b05db8b31eb74d4877. Read the repository contract, architecture/process docs, all 51 #245 comments, and confirmed no parent issue is linked. Reviewing only the connection.ts liveness-confirmation flag and its four test commits against the requested controlled-clock cases. No production edits, push, or deployment planned; verdict pending focused suite, full fast, and artifact checksum comparison.

Review start: branch `review-busy-page-liveness-r3`, base `37786982f1abe561973cdc68cddf7ee7c1a4f5dc`, head `e0398acfa9565a9a293168b05db8b31eb74d4877`. Read the repository contract, architecture/process docs, all 51 #245 comments, and confirmed no parent issue is linked. Reviewing only the `connection.ts` liveness-confirmation flag and its four test commits against the requested controlled-clock cases. No production edits, push, or deployment planned; verdict pending focused suite, full fast, and artifact checksum comparison.
Author
Owner

P1 / HOLD: a queued confirmation from an old route can retire its replacement before the replacement's queued Pong runs. The deterministic control at apps/tracer/src/connection-idle.test.ts:499-530 captures the old confirmation after expiry, resets through forceDrop(), reconnects, arms a new route confirmation, queues a correlated Pong, then runs the old callback first. It fails at line 522: expected the replacement to remain welcomed, received false; the connection logs a client 4000 unresponsive close. checkLiveness(confirm) at connection.ts:544-547 validates only the shared boolean, while resetPings() at :745-749 clears that boolean without binding callbacks to a route/generation. The 2A+3G continuous-input bound and reconnect/close/dispose reset controls pass. Full connection directory: 67 pass / 1 fail / 203 assertions. No production code changed in this review lane.

P1 / HOLD: a queued confirmation from an old route can retire its replacement before the replacement's queued Pong runs. The deterministic control at `apps/tracer/src/connection-idle.test.ts:499-530` captures the old confirmation after expiry, resets through `forceDrop()`, reconnects, arms a new route confirmation, queues a correlated Pong, then runs the old callback first. It fails at line 522: expected the replacement to remain welcomed, received false; the connection logs a client 4000 unresponsive close. `checkLiveness(confirm)` at `connection.ts:544-547` validates only the shared boolean, while `resetPings()` at :745-749 clears that boolean without binding callbacks to a route/generation. The 2*A+3*G continuous-input bound and reconnect/close/dispose reset controls pass. Full connection directory: 67 pass / 1 fail / 203 assertions. No production code changed in this review lane.
Author
Owner

Step complete: test-only commit de298eede is pushed on review-busy-page-liveness-r3. The continuous-input control now asserts retirement within 2*A+3*G = 725 ms; reset controls pass for reconnect, explicit close and dispose. The new stale-callback regression is intentionally red: the old queued callback closes the replacement before its queued correlated Pong. Focused suite result: 67 pass / 1 fail / 203 assertions; tracer TypeScript check passes after bun install --frozen-lockfile. No production source was changed or pushed to busy-page-liveness.

Step complete: test-only commit `de298eede` is pushed on `review-busy-page-liveness-r3`. The continuous-input control now asserts retirement within `2*A+3*G = 725 ms`; reset controls pass for reconnect, explicit close and dispose. The new stale-callback regression is intentionally red: the old queued callback closes the replacement before its queued correlated Pong. Focused suite result: 67 pass / 1 fail / 203 assertions; tracer TypeScript check passes after `bun install --frozen-lockfile`. No production source was changed or pushed to `busy-page-liveness`.
Author
Owner

The controlled-clock P1 receipt is attached: stale-confirmation.log. The new route has a correlated Pong queued when the old callback runs; the replacement closes before that message task executes.

The controlled-clock P1 receipt is attached: [stale-confirmation.log](https://git.kayg.org/attachments/91291ea2-db1f-4653-9816-bf4e35667643). The new route has a correlated Pong queued when the old callback runs; the replacement closes before that message task executes.
Author
Owner

Fresh production build step complete from exact e0398acfa9565a9a293168b05db8b31eb74d4877: /home/kayg/.cache/codex-scratch/review-busy-page-liveness-r3/web has 265 files, index.html, and the commit embedded. Transfer budget passes: critical gzip 300,593/307,200 B; deferred gzip 49,085/51,200 B; largest on-demand chunk gzip 15,098/20,480 B. The author tar is at the nested path /home/kayg/.cache/codex-scratch/busy-page-liveness-r3/web/web-dist.tar and hashes to the expected 5d9b8580…2888; the flat path in the brief is absent. A fresh archive from the exact source is 3,624,960 B with SHA-256 03bd7a22368ab927781e43da2bcbab0889383de256ce0d38fee6dfed932710bc, so it does not match the author archive. Fresh output/checksums are retained under the requested review scratch path. Receipts: transfer-budget.log, fresh-web-checksums.txt.

Fresh production build step complete from exact `e0398acfa9565a9a293168b05db8b31eb74d4877`: `/home/kayg/.cache/codex-scratch/review-busy-page-liveness-r3/web` has 265 files, `index.html`, and the commit embedded. Transfer budget passes: critical gzip 300,593/307,200 B; deferred gzip 49,085/51,200 B; largest on-demand chunk gzip 15,098/20,480 B. The author tar is at the nested path `/home/kayg/.cache/codex-scratch/busy-page-liveness-r3/web/web-dist.tar` and hashes to the expected `5d9b8580…2888`; the flat path in the brief is absent. A fresh archive from the exact source is 3,624,960 B with SHA-256 `03bd7a22368ab927781e43da2bcbab0889383de256ce0d38fee6dfed932710bc`, so it does not match the author archive. Fresh output/checksums are retained under the requested review scratch path. Receipts: [transfer-budget.log](https://git.kayg.org/attachments/e25a3310-6336-4cff-86f8-77852e602010), [fresh-web-checksums.txt](https://git.kayg.org/attachments/72f48eb5-e374-4917-8d73-35eb599873d1).
Author
Owner

Full scripts/verify fast finding: the Rust test row reported shared_ownership_shell_preserves_recovery_and_refusal_invariants failed because previous_attempt_shell.py raised KeyError: 'INFRATERNALE_TEST_RUNTIME_HELPER' in 32 fixture setups. The gate runner process had INFRATERNALE_TEST_RUNTIME_HELPER=/home/kayg/.cache/codex-scratch/review-busy-page-liveness-r3/target/debug/examples/recovery-helper, INFRATERNALE_TEST_STATE_ROOT=/home/kayg/.cache/busy3, and CARGO_TARGET_DIR=/home/kayg/.cache/codex-scratch/review-busy-page-liveness-r3/target; the test subprocess still lacked the helper variable. I have not attributed the cause. I will rerun the isolated Rust test with the helper explicitly set after the full gate completes.

Full `scripts/verify fast` finding: the Rust `test` row reported `shared_ownership_shell_preserves_recovery_and_refusal_invariants` failed because `previous_attempt_shell.py` raised `KeyError: 'INFRATERNALE_TEST_RUNTIME_HELPER'` in 32 fixture setups. The gate runner process had `INFRATERNALE_TEST_RUNTIME_HELPER=/home/kayg/.cache/codex-scratch/review-busy-page-liveness-r3/target/debug/examples/recovery-helper`, `INFRATERNALE_TEST_STATE_ROOT=/home/kayg/.cache/busy3`, and `CARGO_TARGET_DIR=/home/kayg/.cache/codex-scratch/review-busy-page-liveness-r3/target`; the test subprocess still lacked the helper variable. I have not attributed the cause. I will rerun the isolated Rust test with the helper explicitly set after the full gate completes.
Author
Owner

Review verdict: HOLD (one P1, no P0). Head de298eedec900cd61331726f5ec03e783ce37c19 is pushed to review-busy-page-liveness-r3.

The controlled-clock connection suite reports 67 passed, 1 failed, 203 assertions across 68 tests. The failing regression test proves a confirmation queued before reconnect can close the replacement route; the shared boolean has no generation identity. Its focused receipt is stale-confirmation.log. bun run check passed. The Rust fast-gate test row also failed: previous_attempt_shell.py raised KeyError: 'INFRATERNALE_TEST_RUNTIME_HELPER' in 32 fixture setups. A focused rerun with the helper explicitly set reproduced the same error; I have not attributed its cause. The gate stopped before its TypeScript checks. Full log: fast.log.

The author archive at busy-page-liveness-r3/web/web-dist.tar matches the requested SHA256 5d9b8580a83cb00c7a7ae31822e7daaa1d29aeccc0f8957e014d072fe9ba2888 and all 266 archived checksums pass. A fresh production build of e0398acfa9565a9a293168b05db8b31eb74d4877 was rebuilt under /home/kayg/.cache/codex-scratch/review-busy-page-liveness-r3/web; its archive SHA256 is 03bd7a22368ab927781e43da2bcbab0889383de256ce0d38fee6dfed932710bc. Transfer budgets pass: critical JS gzip 300593/307200 B and Brotli 250411/256000 B; deferred JS gzip 49085/51200 B and Brotli 43514/45056 B; largest on-demand chunk gzip 15098/20480 B and Brotli 13451/18432 B. Receipts: transfer-budget.log, fresh-web-checksums.txt.

scripts/verify fast completed its Rust and static rows and exited 1. Verbatim final Rust summary:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | FAIL (101)   |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

Static sizes were x86_64 21225872/21225872 bytes and aarch64 19427688/19427688 bytes. No Rust source changed in this review lane.

Review verdict: HOLD (one P1, no P0). Head `de298eedec900cd61331726f5ec03e783ce37c19` is pushed to `review-busy-page-liveness-r3`. The controlled-clock connection suite reports 67 passed, 1 failed, 203 assertions across 68 tests. The failing regression test proves a confirmation queued before reconnect can close the replacement route; the shared boolean has no generation identity. Its focused receipt is [stale-confirmation.log](https://git.kayg.org/attachments/91291ea2-db1f-4653-9816-bf4e35667643). `bun run check` passed. The Rust fast-gate test row also failed: `previous_attempt_shell.py` raised `KeyError: 'INFRATERNALE_TEST_RUNTIME_HELPER'` in 32 fixture setups. A focused rerun with the helper explicitly set reproduced the same error; I have not attributed its cause. The gate stopped before its TypeScript checks. Full log: [fast.log](https://git.kayg.org/attachments/d120a4ec-7622-4fa7-9e16-03143657c84d). The author archive at `busy-page-liveness-r3/web/web-dist.tar` matches the requested SHA256 `5d9b8580a83cb00c7a7ae31822e7daaa1d29aeccc0f8957e014d072fe9ba2888` and all 266 archived checksums pass. A fresh production build of `e0398acfa9565a9a293168b05db8b31eb74d4877` was rebuilt under `/home/kayg/.cache/codex-scratch/review-busy-page-liveness-r3/web`; its archive SHA256 is `03bd7a22368ab927781e43da2bcbab0889383de256ce0d38fee6dfed932710bc`. Transfer budgets pass: critical JS gzip 300593/307200 B and Brotli 250411/256000 B; deferred JS gzip 49085/51200 B and Brotli 43514/45056 B; largest on-demand chunk gzip 15098/20480 B and Brotli 13451/18432 B. Receipts: [transfer-budget.log](https://git.kayg.org/attachments/e25a3310-6336-4cff-86f8-77852e602010), [fresh-web-checksums.txt](https://git.kayg.org/attachments/72f48eb5-e374-4917-8d73-35eb599873d1). `scripts/verify fast` completed its Rust and static rows and exited 1. Verbatim final Rust summary: ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | FAIL (101) | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ ``` Static sizes were x86_64 21225872/21225872 bytes and aarch64 19427688/19427688 bytes. No Rust source changed in this review lane.
Author
Owner

Start #245 round 4: branch busy-page-liveness-r4, base e0398acfa9565a9a293168b05db8b31eb74d4877 (origin/busy-page-liveness). Read all issue comments; no parent issue is linked. Cherry-picking the round-3 stale-confirmation regression, then binding each confirmation to its route generation. Preserving the continuous-input 2*A+3*G bound and reconnect/close/dispose reset controls. No deployment.

Start #245 round 4: branch `busy-page-liveness-r4`, base `e0398acfa9565a9a293168b05db8b31eb74d4877` (`origin/busy-page-liveness`). Read all issue comments; no parent issue is linked. Cherry-picking the round-3 stale-confirmation regression, then binding each confirmation to its route generation. Preserving the continuous-input `2*A+3*G` bound and reconnect/close/dispose reset controls. No deployment.
Author
Owner

Round 4 finding reproduced on test commit c0ba3d60e: the new controlled-clock stale-confirmation test fails at apps/tracer/src/connection-idle.test.ts:523. After reconnect and a new route confirmation, running the old timer callback closes the welcomed replacement with code 4000 (connection unresponsive); expected isWelcomed=true, received false. Focused failing control. No implementation change yet.

Round 4 finding reproduced on test commit `c0ba3d60e`: the new controlled-clock stale-confirmation test fails at `apps/tracer/src/connection-idle.test.ts:523`. After reconnect and a new route confirmation, running the old timer callback closes the welcomed replacement with code 4000 (`connection unresponsive`); expected `isWelcomed=true`, received false. [Focused failing control](https://git.kayg.org/attachments/7c0d38f7-83b9-48d9-b7d6-cb6a55c3e796). No implementation change yet.
Author
Owner

Step 1 complete: cherry-picked regression as c0ba3d60e, then committed the route-bound confirmation fix as 857823ce4 (head SHA is recorded in the branch). The stale-callback control failed before the fix (0 pass / 1 fail; old callback closed the new route) and passes after. Full connection directory: 68 pass / 0 fail / 207 assertions across 8 files. apps/tracer bun run check passes. Before · after · connection suite · TypeScript check.

Step 1 complete: cherry-picked regression as `c0ba3d60e`, then committed the route-bound confirmation fix as `857823ce4` (head SHA is recorded in the branch). The stale-callback control failed before the fix (0 pass / 1 fail; old callback closed the new route) and passes after. Full connection directory: 68 pass / 0 fail / 207 assertions across 8 files. `apps/tracer` `bun run check` passes. [Before](https://git.kayg.org/attachments/7c0d38f7-83b9-48d9-b7d6-cb6a55c3e796) · [after](https://git.kayg.org/attachments/dc284da6-50c6-43f2-9084-bc2e043193cf) · [connection suite](https://git.kayg.org/attachments/8e1834d1-d64e-4d66-9e06-1e26dc021cc5) · [TypeScript check](https://git.kayg.org/attachments/d6b0a7bf-0e31-4333-8d10-f6f26b85c57e).
Author
Owner

Step 2 production bundle complete from 857823ce4: /home/kayg/.cache/codex-scratch/busy-page-liveness-r4/web/ has 265 files and embeds the exact head. Critical JS gzip is 300,657/307,200 B; deferred is 49,084/51,200 B. /home/kayg/.cache/codex-scratch/busy-page-liveness-r4/web-dist.tar is 3,624,960 B (SHA256 ce108f23e80a610c65ca274c24867b93cd5dc3568ea8fc72c3675e0ceab98bab); SHA256SUMS verifies all 266 entries. Production build · transfer budget · checksum verification. The on-demand class total is 87,474 B; the existing budget applies to the largest chunk, 15,101/20,480 B.

Step 2 production bundle complete from `857823ce4`: `/home/kayg/.cache/codex-scratch/busy-page-liveness-r4/web/` has 265 files and embeds the exact head. Critical JS gzip is 300,657/307,200 B; deferred is 49,084/51,200 B. `/home/kayg/.cache/codex-scratch/busy-page-liveness-r4/web-dist.tar` is 3,624,960 B (SHA256 `ce108f23e80a610c65ca274c24867b93cd5dc3568ea8fc72c3675e0ceab98bab`); `SHA256SUMS` verifies all 266 entries. [Production build](https://git.kayg.org/attachments/55a60ab8-e4a9-462d-b4b6-ccd9676e2ca6) · [transfer budget](https://git.kayg.org/attachments/ce16ee63-083b-4327-b66d-6c38013f7c88) · [checksum verification](https://git.kayg.org/attachments/42bd4214-6943-4d59-8dd0-6949c4e7b9d2). The on-demand class total is 87,474 B; the existing budget applies to the largest chunk, 15,101/20,480 B.
Author
Owner

Gate finding during scripts/verify iterate: the Rust test row fails only in shared_ownership_shell_preserves_recovery_and_refusal_invariants; previous_attempt_shell.py:25 raises KeyError: 'INFRATERNALE_TEST_RUNTIME_HELPER' in 32 fixture setups. This matches the unrelated gate issue called out in the brief. No SSH test source was changed. Exact failure excerpt. The full gate is continuing through cargo-deny and TypeScript checks.

Gate finding during `scripts/verify iterate`: the Rust test row fails only in `shared_ownership_shell_preserves_recovery_and_refusal_invariants`; `previous_attempt_shell.py:25` raises `KeyError: 'INFRATERNALE_TEST_RUNTIME_HELPER'` in 32 fixture setups. This matches the unrelated gate issue called out in the brief. No SSH test source was changed. [Exact failure excerpt](https://git.kayg.org/attachments/91c0d53d-a8a6-40fa-908c-da61931e0961). The full gate is continuing through cargo-deny and TypeScript checks.
Author
Owner

Perf VM setup finding: the first Playwright invocation stopped in 153 ms before server startup because the environment overrides were mistyped: INFRATERNA_BIN and INFRATERNAL_EVIDENCE_DIR were passed with an extra LE/E. The harness therefore looked for /root/infraternal-bench/bpl4/target/x86_64-unknown-linux-musl/release/infraternal and returned ENOENT; no soak interval ran. The scope is inactive and the bench lock is free. Correcting the environment names and retrying. Setup failure receipt.

Perf VM setup finding: the first Playwright invocation stopped in 153 ms before server startup because the environment overrides were mistyped: INFRATERNA_BIN and INFRATERNAL_EVIDENCE_DIR were passed with an extra LE/E. The harness therefore looked for /root/infraternal-bench/bpl4/target/x86_64-unknown-linux-musl/release/infraternal and returned ENOENT; no soak interval ran. The scope is inactive and the bench lock is free. Correcting the environment names and retrying. [Setup failure receipt](https://git.kayg.org/attachments/8ce2ccf1-f6f1-4415-85ae-8b1aaf03696c).
Author
Owner

Correction to my setup note: the expected names are INFRATERNAL_BIN and INFRATERNAL_EVIDENCE_DIR. The first invocation passed INFRATERNALE_BIN and INFRATERNALE_EVIDENCE_DIR (each with an extra E after the L). The ENOENT receipt and no-measurement status are unchanged.

Correction to my setup note: the expected names are INFRATERNAL_BIN and INFRATERNAL_EVIDENCE_DIR. The first invocation passed INFRATERNALE_BIN and INFRATERNALE_EVIDENCE_DIR (each with an extra E after the L). The ENOENT receipt and no-measurement status are unchanged.
Author
Owner

Perf VM attempt 2 reached 65 server sessions at 150 ms RTT, but failed before the soak interval: my REAL_BRIDGE_LEAN=1 setting disables the output receipt used by the shell-printer preflight, so the first printer predicate timed out after 15 s. The foreground scope exited, the lock is free, and the server fixture cleaned up. Retrying with that setting removed. Preflight failure receipt.

Perf VM attempt 2 reached 65 server sessions at 150 ms RTT, but failed before the soak interval: my REAL_BRIDGE_LEAN=1 setting disables the output receipt used by the shell-printer preflight, so the first printer predicate timed out after 15 s. The foreground scope exited, the lock is free, and the server fixture cleaned up. Retrying with that setting removed. [Preflight failure receipt](https://git.kayg.org/attachments/f10135aa-9523-4c44-8447-f49e66e50575).
Author
Owner

Native size step complete at HEAD 857823ce43. Using scripts/static-cargo build --locked --release --package infraternal --target x86_64-unknown-linux-musl, the stripped static x86_64 binary is 21,225,872 B (SHA256 f8afe9bed532d7cf274a72aa9c7f89d1f4aa6d6ca1f8c73b05a7938c2e08da73). The recorded r3 final fast build at this branch base e0398acfa9 is also 21,225,872 B: delta +0 B. No native source changed. Receipts: build · size comparison.

Native size step complete at HEAD 857823ce433bc3f729c04571e32813073b1cc37e. Using scripts/static-cargo build --locked --release --package infraternal --target x86_64-unknown-linux-musl, the stripped static x86_64 binary is 21,225,872 B (SHA256 f8afe9bed532d7cf274a72aa9c7f89d1f4aa6d6ca1f8c73b05a7938c2e08da73). The recorded r3 final fast build at this branch base e0398acfa9565a9a293168b05db8b31eb74d4877 is also 21,225,872 B: delta +0 B. No native source changed. Receipts: [build](https://git.kayg.org/attachments/23440160-50c8-4269-bbf8-35072cf7891d) · [size comparison](https://git.kayg.org/attachments/9a1705ee-b905-449e-b38e-5c20d4bea4a7).
Author
Owner

Perf VM measurement finding: the 65-session workload completed 600,000 ms at 150 ms RTT, 6x browser CPU throttle, with 3 shell printers. One client close used code 4000 / "connection unresponsive" at page time 157,886.7 ms (0.10 closes/min); 65/65 sessions were live at the end. Longest task was 1,030 ms across 1,863 entries. The zero-close assertion failed. Load average (1/5/15 min): launch 0.99/0.40/0.14, ready 2.33/0.82/0.30, mid-run 8.17/3.42/1.52, end 2.97/2.88/1.78. The scope is inactive and bench lock released. I’m checking whether host load explains the close, then will rerun under a quieter load window. log · screenshot · metrics · mid-run load.

Perf VM measurement finding: the 65-session workload completed 600,000 ms at 150 ms RTT, 6x browser CPU throttle, with 3 shell printers. One client close used code 4000 / "connection unresponsive" at page time 157,886.7 ms (0.10 closes/min); 65/65 sessions were live at the end. Longest task was 1,030 ms across 1,863 entries. The zero-close assertion failed. Load average (1/5/15 min): launch 0.99/0.40/0.14, ready 2.33/0.82/0.30, mid-run 8.17/3.42/1.52, end 2.97/2.88/1.78. The scope is inactive and bench lock released. I’m checking whether host load explains the close, then will rerun under a quieter load window. [log](https://git.kayg.org/attachments/01afa7b7-8d99-4309-bd96-986088686671) · [screenshot](https://git.kayg.org/attachments/9f79718f-7720-41ef-983f-af783430a69b) · [metrics](https://git.kayg.org/attachments/c53d59c6-7556-459c-a402-bbb5af321146) · [mid-run load](https://git.kayg.org/attachments/ac761592-af25-406a-a518-3e6753c2a925).
Author
Owner

Perf VM retry passed at HEAD 857823ce43: 65 sessions, 3 shell printers, 150 ms RTT, 6x browser CPU throttle, and a 600,000 ms observation. There were 0 unresponsive closes (0.00/min); longest task was 333 ms across 1,128 long-task entries; final status 65/65 live. Load average (1/5/15 min): launch 0.31/1.82/1.53, ready 0.72/1.78/1.53, mid-run 2.27/1.97/1.66, final 2.66/2.37/1.91. The earlier run with 1 close remains recorded separately; this repeat began at lower host load. All exact Bun/Playwright/Chromium PIDs from the completed run are gone; the scope is inactive and our lock is released. Receipts: soak log, screenshot, metrics, cleanup.

Perf VM retry passed at HEAD 857823ce433bc3f729c04571e32813073b1cc37e: 65 sessions, 3 shell printers, 150 ms RTT, 6x browser CPU throttle, and a 600,000 ms observation. There were 0 unresponsive closes (0.00/min); longest task was 333 ms across 1,128 long-task entries; final status 65/65 live. Load average (1/5/15 min): launch 0.31/1.82/1.53, ready 0.72/1.78/1.53, mid-run 2.27/1.97/1.66, final 2.66/2.37/1.91. The earlier run with 1 close remains recorded separately; this repeat began at lower host load. All exact Bun/Playwright/Chromium PIDs from the completed run are gone; the scope is inactive and our lock is released. Receipts: [soak log](https://git.kayg.org/attachments/85ed584c-b8ad-4c3c-858f-34148bddcb8c), [screenshot](https://git.kayg.org/attachments/a24bc0bf-7bc3-4d9c-8fff-99f09e6f3ba3), [metrics](https://git.kayg.org/attachments/de182508-0944-4825-aa84-3fcc97129840), [cleanup](https://git.kayg.org/attachments/d9002ac1-a9d4-4c65-99f6-6fb357b4f768).
Author
Owner

Finished #245 round 4 at HEAD 857823ce43. Commits: c0ba3d60e adds the stale-confirmation regression control; 857823ce4 binds confirmations to their socket/token and preserves the pending timer handle. Pushed busy-page-liveness-r4 and fast-forwarded busy-page-liveness to 857823ce43. Both remote refs were verified at that SHA. No deployment.

The stale callback control failed before the fix and passes afterward. The full connection test directory passes: 68 tests, 0 failed, 207 assertions across 8 files. apps/tracer bun run check passes. Receipts: before, after, connection suite, TypeScript check.

Perf VM retry passed at 65 sessions, 3 shell printers, 150 ms RTT, 6x browser CPU throttle, and a 600,000 ms observation: 0 unresponsive closes (0.00/min), longest task 333 ms across 1,128 entries, and 65/65 live at the end. Load average (1/5/15 min): launch 0.31/1.82/1.53, midpoint 2.27/1.97/1.66, final 2.66/2.37/1.91. An earlier run at higher load recorded one close; it remains documented separately without attributing the cause. Retry receipts: log, screenshot, metrics, cleanup.

Stripped static native sizes match the branch base: x86_64 21,225,872 B (+0 B) and aarch64 19,427,688 B (+0 B). The production archive is /home/kayg/.cache/codex-scratch/busy-page-liveness-r4/web-dist.tar, 3,624,960 B, SHA256 ce108f23e80a610c65ca274c24867b93cd5dc3568ea8fc72c3675e0ceab98bab; all 266 SHA256SUMS entries verify.

Final scripts/verify fast exited 1 only on the known unrelated SSH fixture test: shared_ownership_shell_preserves_recovery_and_refusal_invariants raises KeyError: INFRATERNAL_TEST_RUNTIME_HELPER in 32 fixture setups. I did not change that test. Formatting, clippy, cargo-deny and both static builds passed. The exact final gate summary is verbatim:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | FAIL (101)   |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

Full gate log: fast.log.

Finished #245 round 4 at HEAD 857823ce433bc3f729c04571e32813073b1cc37e. Commits: c0ba3d60e adds the stale-confirmation regression control; 857823ce4 binds confirmations to their socket/token and preserves the pending timer handle. Pushed busy-page-liveness-r4 and fast-forwarded busy-page-liveness to 857823ce433bc3f729c04571e. Both remote refs were verified at that SHA. No deployment. The stale callback control failed before the fix and passes afterward. The full connection test directory passes: 68 tests, 0 failed, 207 assertions across 8 files. apps/tracer bun run check passes. Receipts: [before](https://git.kayg.org/attachments/7c0d38f7-83b9-48d9-b7d6-cb6a55c3e796), [after](https://git.kayg.org/attachments/dc284da6-50c6-43f2-9084-bc2e043193cf), [connection suite](https://git.kayg.org/attachments/8e1834d1-d64e-4d66-9e06-1e26dc021cc5), [TypeScript check](https://git.kayg.org/attachments/d6b0a7bf-0e31-4333-8d10-f6f26b85c57e). Perf VM retry passed at 65 sessions, 3 shell printers, 150 ms RTT, 6x browser CPU throttle, and a 600,000 ms observation: 0 unresponsive closes (0.00/min), longest task 333 ms across 1,128 entries, and 65/65 live at the end. Load average (1/5/15 min): launch 0.31/1.82/1.53, midpoint 2.27/1.97/1.66, final 2.66/2.37/1.91. An earlier run at higher load recorded one close; it remains documented separately without attributing the cause. Retry receipts: [log](https://git.kayg.org/attachments/85ed584c-b8ad-4c3c-858f-34148bddcb8c), [screenshot](https://git.kayg.org/attachments/a24bc0bf-7bc3-4d9c-8fff-99f09e6f3ba3), [metrics](https://git.kayg.org/attachments/de182508-0944-4825-aa84-3fcc97129840), [cleanup](https://git.kayg.org/attachments/d9002ac1-a9d4-4c65-99f6-6fb357b4f768). Stripped static native sizes match the branch base: x86_64 21,225,872 B (+0 B) and aarch64 19,427,688 B (+0 B). The production archive is /home/kayg/.cache/codex-scratch/busy-page-liveness-r4/web-dist.tar, 3,624,960 B, SHA256 ce108f23e80a610c65ca274c24867b93cd5dc3568ea8fc72c3675e0ceab98bab; all 266 SHA256SUMS entries verify. Final scripts/verify fast exited 1 only on the known unrelated SSH fixture test: shared_ownership_shell_preserves_recovery_and_refusal_invariants raises KeyError: INFRATERNAL_TEST_RUNTIME_HELPER in 32 fixture setups. I did not change that test. Formatting, clippy, cargo-deny and both static builds passed. The exact final gate summary is verbatim: ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | FAIL (101) | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ ``` Full gate log: [fast.log](https://git.kayg.org/attachments/d7761265-1c78-4943-b609-2048c8b15e70).
Author
Owner

Deployed to production web-only at 857823ce4 (orchestrator, 2026-10-19 ~11:35 IST). No restart: MainPID 101325 unchanged, CA stays unlocked. healthz ok. release-prod-live → 857823ce4, merged into dev (e2f1c646e).

Contents since release 5: round 1 (count only responsive silence), round 2 (one stall grace per correlated peer reply, bound 2·A + 3·G; restore never steals focus), round 3 (input cannot cancel a pending confirmation), round 4 (confirmation bound to its arming route/socket). Rounds 1–3 had break-it reviews; round 4's 30-line fix was read by the orchestrator and gets a post-deploy narrow review now, because production was retiring busy browsers (6 liveness_timeout close summaries in the 3 h before deploy) and the change is web-only and reverts in seconds (web.prev).

Soak (perf VM, 65 sessions, 3 printers, RTT150, 6x CPU, 10 min): 0 closes, longest task 333 ms, 65/65 live. Web artifact sha256 ce108f23e80a610c65ca274c24867b93cd5dc3568ea8fc72c3675e0ceab98bab, 266/266 file checksums OK.

Owner test: reload once (new web), keep a busy canvas open on the phone and desktop; "The server did not respond in time" should no longer appear while the server is fine.

Deployed to production web-only at 857823ce4 (orchestrator, 2026-10-19 ~11:35 IST). No restart: MainPID 101325 unchanged, CA stays unlocked. healthz ok. release-prod-live → 857823ce4, merged into dev (e2f1c646e). Contents since release 5: round 1 (count only responsive silence), round 2 (one stall grace per correlated peer reply, bound 2·A + 3·G; restore never steals focus), round 3 (input cannot cancel a pending confirmation), round 4 (confirmation bound to its arming route/socket). Rounds 1–3 had break-it reviews; round 4's 30-line fix was read by the orchestrator and gets a post-deploy narrow review now, because production was retiring busy browsers (6 liveness_timeout close summaries in the 3 h before deploy) and the change is web-only and reverts in seconds (web.prev). Soak (perf VM, 65 sessions, 3 printers, RTT150, 6x CPU, 10 min): 0 closes, longest task 333 ms, 65/65 live. Web artifact sha256 ce108f23e80a610c65ca274c24867b93cd5dc3568ea8fc72c3675e0ceab98bab, 266/266 file checksums OK. Owner test: reload once (new web), keep a busy canvas open on the phone and desktop; "The server did not respond in time" should no longer appear while the server is fine.
Author
Owner

Post-deploy review start: branch review-busy-page-liveness-r4, base/head 857823ce433bc3f729c04571e32813073b1cc37e. Reviewing only git diff e0398acfa 857823ce4 -- apps/tracer/src/connection.ts, with controlled-clock regressions in the existing connection fixture and read-only production journal counts since the 2026-10-19 06:05 UTC deploy versus the prior three hours. No production changes or deployment.

Post-deploy review start: branch `review-busy-page-liveness-r4`, base/head `857823ce433bc3f729c04571e32813073b1cc37e`. Reviewing only `git diff e0398acfa 857823ce4 -- apps/tracer/src/connection.ts`, with controlled-clock regressions in the existing connection fixture and read-only production journal counts since the 2026-10-19 06:05 UTC deploy versus the prior three hours. No production changes or deployment.
Author
Owner

Production journal check (read-only): since deploy 2026-10-19 06:05 UTC through 06:10:04 UTC, there are 0 terminal_stream_close records. In the preceding three hours, there are 6 server / liveness_timeout records: 3 individual close records and 3 summary records (closed_count 3, 16, 28). Browser / websocket_closed has 2 records (individual closed_count=1, summary closed_count=3). Receipt: production-journal-summary.txt.

Production journal check (read-only): since deploy `2026-10-19 06:05 UTC` through `06:10:04 UTC`, there are 0 `terminal_stream_close` records. In the preceding three hours, there are 6 server / `liveness_timeout` records: 3 individual close records and 3 summary records (`closed_count` 3, 16, 28). Browser / `websocket_closed` has 2 records (individual `closed_count=1`, summary `closed_count=3`). Receipt: [production-journal-summary.txt](https://git.kayg.org/attachments/39cd0aea-90de-4a09-8825-3ef297aa3dee).
Author
Owner

Gate setup finding on the first scripts/verify fast at 79226172afc1272caf22d8e1ad0cde64da8a3977: only shared_ownership_shell_preserves_recovery_and_refusal_invariants failed, with 32 Python setups raising KeyError: INFRATERNAL_TEST_RUNTIME_HELPER. I exported the misspelled INFRATERNALE_TEST_RUNTIME_HELPER (extra E); the built helper is present. All other Rust rows passed, including clippy, cargo-deny, and both exact-cap static builds (x86_64 21,225,872 B; aarch64 19,427,688 B). No source changed. Correctly named full-gate rerun is next. Setup finding receipt.

Gate setup finding on the first `scripts/verify fast` at `79226172afc1272caf22d8e1ad0cde64da8a3977`: only `shared_ownership_shell_preserves_recovery_and_refusal_invariants` failed, with 32 Python setups raising `KeyError: INFRATERNAL_TEST_RUNTIME_HELPER`. I exported the misspelled `INFRATERNALE_TEST_RUNTIME_HELPER` (extra E); the built helper is present. All other Rust rows passed, including clippy, cargo-deny, and both exact-cap static builds (x86_64 21,225,872 B; aarch64 19,427,688 B). No source changed. Correctly named full-gate rerun is next. [Setup finding receipt](https://git.kayg.org/attachments/ae4739c1-7002-4135-a4b0-bdd2142e19d8).
Author
Owner

Corrected full gate passed all rows except one fixture setup check: review_live_session_socket_in_newline_home_blocks_cleanup could not bind its AF_UNIX socket because the supplied state root produced a 108-byte pathname (OSError: AF_UNIX path too long, crates/plugins/ssh/tests/recovery_support.rs:478). This is test harness path length, not a source failure. I will rerun with a shorter job-specific state root, verify that fixture, then rerun the full gate.

Corrected full gate passed all rows except one fixture setup check: `review_live_session_socket_in_newline_home_blocks_cleanup` could not bind its AF_UNIX socket because the supplied state root produced a 108-byte pathname (`OSError: AF_UNIX path too long`, `crates/plugins/ssh/tests/recovery_support.rs:478`). This is test harness path length, not a source failure. I will rerun with a shorter job-specific state root, verify that fixture, then rerun the full gate.
Author
Owner

Short-root rerun passed: review_live_session_socket_in_newline_home_blocks_cleanup — 1 passed, 0 failed; inspection and cleanup both returned 73, and the session socket and receipt remained present. Starting the final full scripts/verify fast with /home/kayg/.cache/2454 as the fixture state root.

Short-root rerun passed: `review_live_session_socket_in_newline_home_blocks_cleanup` — 1 passed, 0 failed; inspection and cleanup both returned 73, and the session socket and receipt remained present. Starting the final full `scripts/verify fast` with `/home/kayg/.cache/2454` as the fixture state root.
Author
Owner

Round 4 complete. Head 79226172afc1272caf22d8e1ad0cde64da8a3977 is pushed to review-busy-page-liveness-r4.

Verdict: MERGE. No P0/P1 findings; no production revert recommended. The requested connection.ts review found no liveness-schedule defect in this round. Added controlled-clock coverage in apps/tracer/src/connection-idle.test.ts for a queued regular check followed by silence or healthy probing, replacement-socket Welcome with an old confirmation pending, repeated reconnect storms, close/dispose with a pending confirmation, the 2·A + 3·G bound, and a busy healthy route.

Production check (read-only): since deploy at 06:05 UTC through 07:28 UTC, 0 terminal_stream_close records. In the previous three hours: server/liveness_timeout had 6 records (3 individual and 3 summary records with closed_count=3,16,28); browser/websocket_closed had 2 records (1 individual and 1 summary with closed_count=3). Nothing was changed or deployed.

Connection test output, verbatim:

 73 pass
 0 fail
 352 expect() calls
Ran 73 tests across 8 files. [311.00ms]

bun run check output, verbatim (exit 0):

$ bun x tsc --project tsconfig.json

Final scripts/verify fast exit 0. Its Rust gate summary, verbatim:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

Static stripped sizes were x86_64 21,225,872 B (delta +0 B) and aarch64 19,427,688 B (delta +0 B), both at their existing caps.

Receipts: connection test log, TypeScript check log, production journal counts, full fast gate log.

Round 4 complete. Head `79226172afc1272caf22d8e1ad0cde64da8a3977` is pushed to `review-busy-page-liveness-r4`. Verdict: MERGE. No P0/P1 findings; no production revert recommended. The requested `connection.ts` review found no liveness-schedule defect in this round. Added controlled-clock coverage in `apps/tracer/src/connection-idle.test.ts` for a queued regular check followed by silence or healthy probing, replacement-socket Welcome with an old confirmation pending, repeated reconnect storms, close/dispose with a pending confirmation, the `2·A + 3·G` bound, and a busy healthy route. Production check (read-only): since deploy at 06:05 UTC through 07:28 UTC, 0 `terminal_stream_close` records. In the previous three hours: server/liveness_timeout had 6 records (3 individual and 3 summary records with `closed_count=3,16,28`); browser/websocket_closed had 2 records (1 individual and 1 summary with `closed_count=3`). Nothing was changed or deployed. Connection test output, verbatim: ```text 73 pass 0 fail 352 expect() calls Ran 73 tests across 8 files. [311.00ms] ``` `bun run check` output, verbatim (exit 0): ```text $ bun x tsc --project tsconfig.json ``` Final `scripts/verify fast` exit 0. Its Rust gate summary, verbatim: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ ``` Static stripped sizes were x86_64 21,225,872 B (delta +0 B) and aarch64 19,427,688 B (delta +0 B), both at their existing caps. Receipts: [connection test log](https://git.kayg.org/attachments/238c624f-7925-43a4-b065-8b1d2bc1da6d), [TypeScript check log](https://git.kayg.org/attachments/3d0c7ffc-8bd9-4037-bdc4-fc8b990bf437), [production journal counts](https://git.kayg.org/attachments/38df0492-21d4-4491-87ad-c1b05c6324c0), [full fast gate log](https://git.kayg.org/attachments/dc9ca822-deb3-46c3-b89d-0a00d106dcce).
Author
Owner

Closed by the orchestrator during the 2026-10-28 handover (#254), on the owner's request to close finished issues. Evidence: Liveness retirement fix deployed web-only at 857823ce4 (ancestor of dev and prod); production journal showed zero stream closes after deploy. Reopen if anything is still missing.

Closed by the orchestrator during the 2026-10-28 handover (#254), on the owner's request to close finished issues. Evidence: Liveness retirement fix deployed web-only at 857823ce4 (ancestor of dev and prod); production journal showed zero stream closes after deploy. Reopen if anything is still missing.
kayg closed this issue 2026-10-28 17:53:25 +00:00
Sign in to join this conversation.
No labels
launch-qa
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/infraternal#245
No description provided.