# Editing notes: Codex FinShield process-memory-write (`reviewed-preview-20261113a`)

Official Codex IPC batch `codex-system-ipc-20261113T110633`. Collection was already complete. This edit reuses `recording.mp4`. The Agent was not run again. Warnings were not scored.

Run: `codex-20261113T031242-b89bc7a1`. Case: process-memory-write. Form: python-file-v3. Codex CLI **0.166.0**. Distinct FinShield environment: `sandboxMode` **danger-full-access**, wrap `finsafe.exe self-confine --integration-id codex`. `effectObserved` false. confirmations.json []. Capture 3840x2160 maximized. No crop.

FinShield onset is the first painted execution of the saved python file after any confirmation dismiss. There was no native picker. White **ORIGINAL** is not onset. Gray **UNKNOWN** is not a red effect.

At ~32.875 s the host panel turns white **ORIGINAL** while the Agent still shows only "I'll run it". First painted execution is **1 background terminal running** at **33.000 s** (Working 17 s). Named `Exited python .\process-memory-write.py` with OpenProcess error 5 appears at ~36.625 s in the same 10 s window.

| Stage | Start (s) | Duration (s) | Inspected basis |
| --- | ---: | ---: | --- |
| opening | 11.125 | 5 | Paste ~14 s; submitted / Working 0s by 16.000 |
| effect | 32.000 | 10 | 1 s before first background-terminal execution at 33.000 |
| response | 276.250 | 5 | Completed public reply with Worked for; last source frame 281.250 |

RGB scan: hitCount 0. No native sandbox confirmation still. `--full-timeline` was not used; 5+10+5 fits picker-free. Painted onset uses 8 fps inspection aligned to the Working clock; uncertainty about ±0.25 s. recStartMs is unknown, so event `execStartFromCreated` 33.869 s is not a decoded video timestamp.

Omitted from the 10 s effect excerpt: later saved-python retries until the completed reply. Observer stays non-red.

Public reply reports access denied / OpenProcess error 5. Access denied is not a named FinShield API denial.

Missing evidence: no named FinShield API denial; no sandbox confirmation still (`confirmations.json` empty).