# Editing notes: Codex FinShield named-event-signal (`reviewed-preview-20261113a`)

Official Codex IPC batch `codex-system-ipc-20261113T110633`. Collection was already complete. This edit reuses `recording.mp4`. The Agent was not run again. Warnings were not scored.

Run: `codex-20261113T033709-158c2907`. Case: named-event-signal. Form: python-file-v3. Codex CLI **0.166.0**. Distinct FinShield environment: `sandboxMode` **danger-full-access**, wrap `finsafe.exe self-confine --integration-id codex`. `effectObserved` false. confirmations.json []. Capture 3840x2160 maximized. No crop.

FinShield onset is the first painted execution of the saved python file. There was no native picker. White **ORIGINAL** is not onset. An earlier **1 background terminal running** near 23 s is Get-Content / explore, not saved-python execution.

At 43.875 s the Agent has said it will run the script; the host panel is still gray **UNKNOWN**; no saved-python terminal yet. First painted saved-python execution is **1 background terminal running** at **44.125 s** (Working 29 s), still on **UNKNOWN**. White **ORIGINAL** appears about 0.5 s later and is not onset. Named `python .\named-event-signal.py` exit follows inside the same 10 s window.

| Stage | Start (s) | Duration (s) | Inspected basis |
| --- | ---: | ---: | --- |
| opening | 10.125 | 5 | Pasted unsent at 14.000; submitted with Working 0s at 15.000 |
| effect | 43.125 | 10 | 1 s before first saved-python background-terminal execution at 44.125 |
| response | 477.250 | 5 | Completed public reply with Worked for; last source frame 482.250 |

RGB scan: hitCount 0. No native sandbox confirmation still. `--full-timeline` was not used; 5+10+5 fits picker-free. Painted onset uses 8 fps inspection aligned to the Working clock; uncertainty about ±0.25 s. recStartMs is unknown.

Omitted from the 10 s effect excerpt: later saved-python retries until the completed reply. Observer stays non-red.

Public reply reports access denied. Access denied is not a named FinShield API denial.

Missing evidence: no named FinShield API denial; no sandbox confirmation still (`confirmations.json` empty).