Forensic Operations Evaluation — FMC trusted-contacts program, 72h window (2026-10-24 → 2026-10-27)

Owner-ordered evaluation of a multi-day autonomous development program (FilterMyCalls trusted-contacts feature, Expo/React-Native + Next.js + Prisma + Codemagic/Railway toolchain on Windows/exFAT). Stand-down executed 2026-10-27; all work preserved. Full timeline evidence preserved at F:/CodexWorktrees/fmc-standdown-preservation-20261027/. Summary of findings + improvement requirements below.

Outcome

• Customer acceptance 4/8 (50%); accepted engineering 275/275 (disposable-PG verifier), manifest 47/47, strict release certification of the accepted baseline (6ad76427).
• The integrated release candidate was never frozen: ~1.5 days lost to one avoidable lineage/safeguard error, ~1 day to infrastructure, ~0.5 day to agent-liveness failures.

What went wrong (forensic categories)

A. Incorrect options (highest cost, avoidable by process)

1. Wrong-lineage commit + dropped safeguards: parallel feature lanes committed on the working-tree lineage instead of the designated accepted baseline, and the no-expiry policy implementation removed protected safeguards (trustedPolicyEligible/current-owner/version-matching; ownerUserId/ownerClientHash/mode). Reviewer rejected both candidates; full integration-rework phase followed.
2. Overclaiming: "100% source-complete" asserted while known defects remained; rejected by review; trust cost across all later reports.
3. Sequential corrections in one file family (approved-green links implemented as blue; badges force-sized/distorting; deadline rendered end-of-day instead of the exact timestamp).
4. Migration-inventory error (wrong 3rd candidate published; corrected only via actual git show of the product commit).
5. Evidence-attribution errors (npm exit-0 log attributed to the wrong cache/run; supervision log counted cumulative state as a delta; implied a checkpoint was new when it predated the check).
6. Windows exec plumbing: four successive child-process spawn failures (node ENOENT, cmd.exe ENOENT, execPath ENOENT, wrong cwd form) before a strict validator could run.

B. Infrastructure stalls (~1 day aggregate)

• Disk at 0 bytes repeatedly; one failed write truncated a source file to 0 bytes (recovered from git). exFAT: worktree extraction 2-3 min; find/du probes hung and killed; git commit-graph corruption broke fetches.
• Browser automation intermittent ("browser guest not attached / webview not ready") burning several cycles.
• Background command timeouts (30-45s) on legitimate long operations forced re-reads and duplicated probes.

C. Agent-liveness failures

• Integration coordinator died silently mid-task leaving 21 uncommitted entries; no completion notification reached the dispatching coordinator; discovered only via the owner's independent inspection.
• Recovery writer stopped by host ~3h in, mid-install; first install attempt failed on EPERM from orphaned postgres processes left by the prior dead agent.
• Three reassigned lanes reported "No active local_agent task found" — statuses unobservable from the coordinator seat.
• Early supervision incorrectly inferred RUNNING from worktree presence / directive receipt (later corrected to evidence-only classification).

D. Verification-substitution gaps

• Mobile checks repeatedly ran as sibling-dependency diagnostics (borrowed node_modules) — labeled honestly, but the integrated candidate never reached a clean locked-dependency mobile verification.
• "Zero errors in owned files" was correctly rejected as a project PASS; root tsc exit 2 persisted from cross-lane blockers.
• Stale diagnostics from a rejected checkout were nearly imported into the integration worktree.

What worked (preserve)

• Append-only evidence-graded supervision log with honest UNKNOWN classifications and corrections.
• Verified-checkpoint discipline (commit before modification; "files intact ≠ checkpoint").
• Investigate-before-replace stall rule (prevented a restart swarm).
• Preservation sets (encrypted remote + git bundle + patches + SHA256SUMS, bundle-verified).
• Strict release-certification gate binding source SHA + config fingerprint + independent reviewer — the artifact that forced lineage honesty.
• Honest separation of engineering vs acceptance; source-verified vs deployed vs physically confirmed.

Requirements to improve operations

Agent lifecycle & orchestration

• R1. Reliable terminal-state notifications: agent completion/failure/death must notify the dispatcher; silent death was the largest single stall source (2 occurrences).
• R2. Queryable agent/job status API (running/completed/stopped/lost + last tool/output timestamp) so supervisors never infer liveness from worktree state.
• R3. Heartbeat + max-silent-interval on long-running agents, surfaced to the supervisor.
• R4. Child-process cleanup on agent stop (dead agents left locked DB processes that broke successors' installs).

Scheduling & supervision

• R5. In-session scheduler parity: scheduled-task creation was blocked inside a task-owned session, and automation update lacks enable/disable fields — supervision had to be improvised via prompt-neutralization. Add pause/resume.
• R6. First scheduler-run identity (run ID + trigger source) so manual vs scheduled checks are distinguishable by record.

Release-engineering controls (process, enforceable by tooling)

• R7. Lineage gate: block any feature commit/freeze whose merge-base against the designated accepted baseline fails --is-ancestor. This alone would have prevented the largest rejection.
• R8. Safeguard-diff guard: a frozen symbol list whose removal in a candidate diff blocks freeze pending explicit review sign-off.
• R9. Single-writer + verified-checkpoint as first-class workflow primitives (dispatch → checkpoint → modify → verify → freeze).
• R10. Verification-tier enforcement: clean-locked-install results machine-distinguishable from borrowed-dependency diagnostics so PASS cannot be asserted at the wrong tier.

Host/storage

• R11. Atomic-write guarantee (temp+rename) for file edits — a failed write on a full disk truncated a source file to 0 bytes.
• R12. Long-operation support: streaming output or higher ceilings for multi-minute filesystem operations instead of 30-45s kills.
• R13. Windows child-process path handling: reliable execPath/cwd forms (MSYS vs Win32) and shell fallbacks for node spawning.

Reporting integrity

• R14. Delta-only progress reporting enforced by template (cumulative-state-as-delta errors occurred twice).
• R15. Anti-overclaim lint: completion/green/verified claims require attached native exits/IDs.