Retain comment startup failure and stop remaining admissions

doc/plans/2026-10-26-chat-catalog-eval-progress.md

@@ -7,8 +7,8 @@ Updated: 2026-10-27. This is the single progress record for [the saved goal](202
 - **244 scenarios / 35 areas / 191 capabilities**, frozen inventory digest `9dc9cf6a5426cf1b56bc30a3571851f233f9dd5e93a1292eaee414d33b52df77`. All original queries, contexts and expected outcomes remain unchanged. **196 passes required**; blocked, partial, unsupported and unrun remain in the denominator.
 - **229 authored: 220 without declared coverage gaps, 9 partial, 15 unimplemented** at exact committed-source metadata checkpoint `32b472dfa5640987e199c2e0aa21b2c7c02555c6`. There are 227 concrete lazy descriptors plus two legacy task cases. Actual callbacks, bounds, policies and source dependencies were reconciled from this one Git archive; newer area work remains pending. These are authoring counts, not acceptance.
 - Five partial definitions contain concrete executable supported-surface/context blocker probes: two access grants, subscription provenance, skill-use authority/context and genuine prior-day routine history. Four have unfinished required branches: the Grok origin integration closure, named ChatGPT setup, team installer failures and private-repository after-grant completion. **225 authoring-resolved; 4 unfinished; 15 absent.** Only actual reserved execution can process a concrete blocker; offline probes/calibrations do not establish processing. Incomplete conditions cannot pass.
-- **Five scenarios attempted; six actual measurements; zero first-attempt passes and zero final passes (0/244 for both rates).** Goal-tree is exhausted after two failures. Alignment and purpose each retain one failed initial attempt and one allowed correction/rerun remaining.
-- **No live launcher or provider process is running.** Project creation ordinal 1 completed from immutable `6951f67ecd1aaedec789703dc9c7227bddd2b59a` on the qualified owned-Docker PostgreSQL 18.6 lane. All ten behavior checks passed, but the final persisted-state privacy scan failed on the disposable instance configuration; cleanup passed. Admissions stopped for shared harness diagnosis. Comment-with-reference, broken-link and edit-profile remain unreserved. No rerun or final-B admission occurred.
+- **Six scenarios attempted; seven actual measurements; zero first-attempt passes and zero final passes (0/244 for both rates).** Goal-tree is exhausted after two failures. Alignment and purpose each retain one failed initial attempt and one allowed correction/rerun remaining.
+- **No live launcher or provider process is running.** Comment-with-reference ordinal 1 failed during normal startup doctor from immutable `f73390f925edcddd3af977e337adf16d5818fb41`, before browser/native/model admission: doctor requires a persisted PostgreSQL connection string despite the server supporting `DATABASE_URL`. Exact Docker resources report removed; overall cleanup is failed/unconfirmed and private recovery state is retained. Admissions stopped again. Broken-link and edit-profile remain unreserved. Both project and comment initial failures are preserved; all final retries remain held for coherent B.
 - Current recovery: semaphore cleanup approval is still pending and no set has been removed. Read-only discovery verified an already running local Docker Linux/arm64 engine; an explicit owned PostgreSQL18.6 lane is being qualified. Its one infrastructure-only health check at `772c29dad9` failed before container start because Docker Desktop represents the exact host password bind with `/host_mnt`; no Paperclip, native or model work began. The initial failed cleanup receipt is preserved; separate authorized cleanup verified exact container/volume absence and removed only its password. The separately authorized corrected infrastructure-only health at `325af67e3d` passed PostgreSQL18.6, normal onboarding/migrations/API and zero work; exact owned resources were removed with no cleanup failures. The Docker lane is qualified; host IPC cleanup is no longer required. AgentMail/GitHub read-only discovery is authorized/completed; designated self-email and repository choices remain pending.
 - Production baseline `8373d7867963674ff960d2345d0d28086f799bc7`; branch `codex/chat-catalog-evals`. PR #17794 merged via `2ee36a4`. No eval/core PR has been created. No merge is eligible.
 
@@ -239,3 +239,9 @@ Cleanup passed; actual database identity reports the exact pinned PostgreSQL 18.
 The authorized harness-only correction `96058c7e2f5364342917ebeb598089b5195330d9` uses the existing product-supported server `DATABASE_URL` configuration. Seeded Docker config contains no DSN; only the exact receipt-validated server child environment receives it. Ambient URLs remain scrubbed, actual native Codex environment projection excludes both database variables, and the persisted-state scanner is unchanged. Controls reject an arbitrary server URL, undeclared override, persisted DSN, a DB password elsewhere in config, and unrelated provider credentials. The project initial remains failed; no postprocessing changes its outcome or consumes its held final-B retry.
 
 New immutable remaining-three candidate: `f73390f925edcddd3af977e337adf16d5818fb41`, parent `6951f67ecd1aaedec789703dc9c7227bddd2b59a`, with only the six custody paths overlaid. Actual archived E2E typecheck exited 0; 109 targeted controls across four files passed. Production sources/lock still exactly match baseline `8373d7867963674ff960d2345d0d28086f799bc7`; 46 dependency links and copied build/native bytes match prior audited immutable receipts. Read-only Docker preflight confirms the same qualified engine and installed PostgreSQL 18.6 digest. Three fresh case fingerprints and name-only private-input replay receipts are in `results/chat-catalog-campaign/initial-selection-f73390f925.json`; scoped control/provenance summary is `custody-correction-f73390f925.json`. Comment-with-reference, broken-link and edit-profile remain unreserved pending manager admission. No new bootstrap, model/provider calls, canonical launches or reservations occurred during correction.
+
+### Comment initial startup failure (2026-10-27)
+
+Campaign `catalog-initial-2026-10-27T07-15-25-823Z-tasks-comment-with-reference` consumed only comment-with-reference ordinal 1 from reviewed `f73390f925edcddd3af977e337adf16d5818fb41`. Actual CLI doctor reports “PostgreSQL mode selected but no connection string configured” and refuses server start. Source `cli/src/checks/database-check.ts` checks only `config.database.connectionString`; it does not use the server’s `DATABASE_URL` override. The prior custody correction missed this normal-startup contract, so this is an eval-harness startup failure, not feature/model evidence. There were zero browser/scenario/native/model admissions or tokens; the owned PostgreSQL infrastructure did start. No retry was performed.
+
+Original fallback result and logs are retained at `tests/runner-e2e/results/catalog-initial-2026-10-27T07-15-25-823Z-tasks-comment-with-reference/chat-features/runner-codex-subscription/local/tasks.comment-with-reference/attempt-1/`. Result database identity reports pinned PostgreSQL 18.6 and container status `removed`. Overall cleanup nevertheless remains failed/unconfirmed; private root `paperclip-runner-e2e-hZhllt` is retained. This distinction is preserved without inferring all cleanup from Docker removal. Broken-link and profile remain unreserved pending the shared startup/custody correction and explicit admission.

tests/runner-e2e/chat-campaign-manifest.json

@@ -6013,9 +6013,61 @@
       "readiness": "implemented",
       "executionId": "chat-features.runner-codex-subscription.local.tasks.comment-with-reference",
       "blocker": null,
-      "attempts": [],
-      "qualifyingDefinitionDigest": null,
-      "qualifyingGraderDigest": null,
+      "attempts": [
+        {
+          "ordinal": 1,
+          "outcome": "failed",
+          "executionId": "chat-features.runner-codex-subscription.local.tasks.comment-with-reference",
+          "startedAt": "2026-10-27T07:15:25.823Z",
+          "finishedAt": "2026-10-27T07:17:18.738Z",
+          "sourceRevision": "f73390f925edcddd3af977e337adf16d5818fb41",
+          "workingTreeDigest": "36eb221b1aac43603d0d0491168ef2ad3bc7886b6bafe930cb1fe9b05b1b1a9a",
+          "definitionDigest": "8e9f310d6d71093b705645721c44e93d8dd7f04576091fff15c5a747fdf6221b",
+          "suiteDefinitionDigest": "eb1ebed9782e97b2f456f163d2ab91ed1a97a025f9f7acd6fc9015261c2c3d8c",
+          "graderDigest": "8e9f310d6d71093b705645721c44e93d8dd7f04576091fff15c5a747fdf6221b",
+          "model": "gpt-5.6-sol",
+          "profile": "runner-codex-subscription",
+          "environment": "local",
+          "automaticRetries": 0,
+          "correction": null,
+          "classification": "eval_harness_startup_doctor_requires_persisted_database_dsn",
+          "observedFailure": "Normal onboard doctor rejected postgres config without connectionString despite supported server DATABASE_URL. Actual result: Playwright exited 1 before writing a result; Temporary runner E2E state cleanup failed at /private/var/folders/74/zhncxl_j05xb5_r6_vfbk73h0000gn/T/paperclip-runner-e2e-hZhllt: Preserving private recovery state after unconfirmed cleanup: /private/var/folders/74/zhncxl_j05xb5_r6_vfbk73h0000gn/T/paperclip-runner-e2e-hZhllt",
+          "evidencePaths": [
+            "tests/runner-e2e/results/chat-catalog-campaign/initial-selection-f73390f925.json",
+            "tests/runner-e2e/results/catalog-initial-2026-10-27T07-15-25-823Z-tasks-comment-with-reference/chat-features/runner-codex-subscription/local/tasks.comment-with-reference/attempt-1/result.json",
+            "tests/runner-e2e/results/catalog-initial-2026-10-27T07-15-25-823Z-tasks-comment-with-reference/chat-features/runner-codex-subscription/local/tasks.comment-with-reference/attempt-1/server.log",
+            "tests/runner-e2e/results/chat-catalog-campaign/active-tasks.comment-with-reference.json"
+          ],
+          "usage": {
+            "costUsd": null,
+            "tokens": 0,
+            "coverage": "No scenario/browser/native/model admission; startup doctor failed before serving. Docker infrastructure only."
+          },
+          "cleanup": "failed",
+          "corePrDependencies": [],
+          "databaseLane": {
+            "lane": "owned-docker-postgres",
+            "image": "postgres@sha256:74935e72241653ca55e0414067e6d8763aceb8a810eb51b452253ec3dcfc4336",
+            "imageId": "sha256:74935e72241653ca55e0414067e6d8763aceb8a810eb51b452253ec3dcfc4336",
+            "version": "18.6-1.pgdg13+2"
+          },
+          "productIdentity": {
+            "kind": "source-build",
+            "productionSourceRevision": "8373d7867963674ff960d2345d0d28086f799bc7",
+            "snapshotSourceRevision": "f73390f925edcddd3af977e337adf16d5818fb41",
+            "nativeBinarySha256": "9d8af6b85b836a03092ade2273be6f29f5c2f6ec67ee891d83ee9693ba39d3b4",
+            "workspaceBuildDigest": "222e10a8a2a20d3015ec4470b952e2dd9b927dfe9390c4a5ed1e19d740c0e35b",
+            "receiptPaths": [
+              "tests/runner-e2e/results/chat-catalog-campaign/snapshot-f73390f925.json",
+              "tests/runner-e2e/results/chat-catalog-campaign/snapshot-10d0ce63610.json",
+              "tests/runner-e2e/results/chat-catalog-campaign/snapshot-0fdcb539a8.json"
+            ],
+            "coreCandidate": false
+          }
+        }
+      ],
+      "qualifyingDefinitionDigest": "8e9f310d6d71093b705645721c44e93d8dd7f04576091fff15c5a747fdf6221b",
+      "qualifyingGraderDigest": "8e9f310d6d71093b705645721c44e93d8dd7f04576091fff15c5a747fdf6221b",
       "productPolicy": {
         "lane": "source-build",
         "sourceBaselineRevision": "8373d7867963674ff960d2345d0d28086f799bc7"