PR 32038 runtime verification, 2026-11-11, Linux Boat VM
main: f31ce3eeb5f4adbfe7f961403822cf90db05808f
PR: 9b48b2f019327c4c525c07fd60c97bd7608dc814
Browser: repo Playwright 1.64.1, /usr/bin/google-chrome
Provider: Codex gpt-6.1-sol through local proxy
Data: project /home/user/shutdown-proof and threads created in web UI; no fixtures.

MAIN
$ node apps/server/src/bin.ts shutdown --base-dir /home/user/main/.t3 --no-save --timeout 3 --json
exit 1, shutdown absent from listed subcommands; unrecognized flags --no-save, --timeout, --json.
Authenticated POST /api/maintain/graceful-shutdown -> 404.
Web UI provider turn: pwd, git status --short -> BASELINE_OK.

PR: SAVE-WORK / QUEUE ORDER
20:53:43.456 ordinary run ordinal 3 queued while ordinal 2 running.
20:53:43.464 POST /api/maintain/graceful-shutdown
{"scope":{"type":"environment"},"timeoutMs":180000,"reason":"real-codex-verification"}
20:53:44.484 status: draining, activeRunCount=1, saveWorkTurnCount=1.
20:55:18.435 active ordinal 2 completed.
20:55:19.362 save-work ordinal 4 started ahead of queued ordinal 3.
20:55:38.540 save-work ordinal 4 completed.
Real agent committed shutdown-work.txt as ca48740; working tree clean; no remote push.
20:55:39.038 result: quiesced, timedOut=false, activeRunCount=0,
saveWorkPrompted=true, saveWorkTurnCount=1, elapsedMs=115530.
Ordinary ordinal 3 still queued with startedAt=null.
Idle thread retained exactly its two completed runs; no save-work turn added.
20:55:39.611 POST /api/maintain/graceful-shutdown/complete with matching shutdownId -> 200 {}.
20:55:39.630 ordinary ordinal 3 started.
20:56:15.879 ordinary ordinal 3 completed through Codex -> ORDINARY_QUEUE_RESUMED.
20:56:17.238 status: idle, activeRunCount=0.

PR: TIMEOUT MUST NOT STOP SERVER
During another active real Codex turn:
$ node apps/server/src/bin.ts shutdown --base-dir /home/user/pr32038-state --no-save --timeout 1 --stop --json
exit 1
{"shutdownId":"shutdown:1794430615714:3","phase":"timed_out","scope":{"type":"environment"},"timedOut":true,"activeRunCount":1,"saveWorkPrompted":false,"saveWorkTurnCount":0,"elapsedMs":1000}
ShutdownCliError: Graceful shutdown timed out after 1000ms with 1 active run(s) still in scope.
Authenticated GET /api/maintain/graceful-shutdown -> 200, phase=timed_out.
Web UI accepted another message and kept it queued.
$ node apps/server/src/bin.ts shutdown --base-dir /home/user/pr32038-state --complete --json
{"ok":true,"completed":true}
Active turn completed -> TIMEOUT_GUARD_DONE; queued message completed -> TIMEOUT_QUEUE_RESUMED.

PR: PROVIDER SCOPE / OWNERSHIP
$ node apps/server/src/bin.ts shutdown --base-dir /home/user/pr32038-state --provider codex --no-save --timeout 5 --json
{"shutdownId":"shutdown:1794430709202:4","phase":"quiesced","scope":{"type":"provider","providerInstanceId":"codex"},"timedOut":false,"activeRunCount":0,"saveWorkPrompted":false,"saveWorkTurnCount":0,"elapsedMs":2}
Web UI sent message in other Codex thread: ordinal 3 queued, startedAt=null.
Concurrent begin -> GracefulShutdownError: A graceful shutdown is already in progress.
Complete with wrong shutdownId -> GracefulShutdownError: That graceful shutdown is no longer active.
Both returned HTTP 500 with tagged error; active drain ID and scope unchanged.
$ node apps/server/src/bin.ts shutdown --base-dir /home/user/pr32038-state --complete --json
{"ok":true,"completed":true}
Queued message completed through Codex -> PROVIDER_SCOPE_RESUMED; status returned idle.

SETTINGS
Default save-work setting true. Click off, reload -> false. Restore on, reload -> true.

LIMITS
No native mobile/Electron, macOS/Windows, actual package/service update handoff,
other providers, cross-provider scope isolation, explicit session scope, manual queue holds,
relay/tunnel, or actual remote push exercised.
Dev app cannot self-update as a managed installed server.
Task remote check rerun blocked: initial Blacksmith worker queued; replacement became ready,
but sync twice timed out after 2m0s. Direct SSH port 64001 timed out.
No local checks substituted. Existing exact-head GitHub CI checks passed; native jobs skipped.
No PR source changes, commits, or pushes made.