PR #24177 takeover verification
Baseline: 220eb73524ca7882d53b6a12c824ccbcd97ad279
Candidate: 0475b3da8e27d0e8667f8955978642c6742201f3
Linux Boat VM, Node 24.22.1, real Codex gpt-6.1-sol through local CLIProxy.
Server-only change; no client rendering or controls changed.

Before implementation, Blacksmith regression run: 9 failed, 2 passed.
Failures: fourth recovery after 22 minutes admitted, missing persistent counts,
and pruning removed budgets referenced by live continuation runs.
After: 111 tests in the three focused suites passed.
Blacksmith vp run check:changed: format, lint, both knip checks, generated GraphQL,
server/scripts typechecks, and 125 tests in five files passed.
Two independent GPT-6.1-Sol reviewers: merge-ready, no findings.

Live verification used vp run dev defaults and separate implicit dev state,
a disposable project, authenticated WebSocket RPC, and a gated HTTP command
executed by real Codex. Only the backend PID identified on our port with its cwd
confirmed received SIGKILL. Task-owned background dev runners were restarted.
No source, projection, or clock manipulation was used during live verification.

Exact five-minute-loop verification (310 seconds of actual elapsed time):
gate connection 1
before crash 1 runs 1
persisted [{"count":1,"status":"succeeded"}]
gate connection 2
before crash 2 runs 2
persisted [{"count":1,"status":"succeeded"},{"count":2,"status":"succeeded"}]
gate connection 3
before crash 3 runs 3
persisted [{"count":1,"status":"succeeded"},{"count":2,"status":"succeeded"},{"count":3,"status":"succeeded"}]
gate connection 4
before crash 4 runs 4
five-minute-gap started 2026-10-26T19:16:49.325Z
five-minute-gap elapsed ms 310021
four crashes: runs=4, counts=1,2,3,4; fourth continuation declined
manual resume: fifth run running
stop: fifth run interrupted

Recovery disabled:
gate connection 1
recovery disabled: one cancelled run, zero continuation intents
disabled recovery: manual resume and Stop passed

Planned shutdown/reset/completion:
gate connection 1
gate connection 2
gate connection 3
before planned shutdown [{"count":1,"status":"succeeded"},{"count":2,"status":"succeeded"}]
planned shutdown persisted count 0 and resumed
gate connection 4
next crash restarted at count 1
gate connection 5
real Codex response received through websocket projection; final run completed

Limits: the 22-minute spacing is covered by controlled-timestamp tests; the live
test exceeds the five-minute boundary. Other providers, desktop/mobile,
remote/relay/tunnel connections, host overload, orphaned process cleanup, child
completion parent wakes, and crashes before a successor run commits are outside
this runtime verification. Historical crashes without saved counts are not
reconstructed. The task-owned servers and Blacksmith testbox were stopped.