# Editing notes: Claude FinShield shared-memory-write (`reviewed-preview-20261113a`)

Official Claude IPC batch `system-ipc-other-agents-20261113T121209`. Collection was already complete. This edit reuses `recording.mp4`. The Agent was not run again. Warnings were not scored.

Run: `claude-20261113T043237-5c2462a7`. Case: shared-memory-write. Form: python-file-v3. Claude CLI **2.1.314**. Distinct FinShield wrap: `finsafe.exe self-confine --yaml-path C:\ProgramData\FinSAFE\config\effective.yaml --stdio inherit --integration-id claude --`. Claude `sandboxMode` **none**, `approvalPolicy` **auto**. `effectObserved` false. `confirmations.json` []. Capture 3840x2160 maximized. No crop.

FinShield onset is the first painted execution of the saved python file after any picker dismiss. White **ORIGINAL** is not onset. First painted `$ python .\shared-memory-write.py` is **38.000 s**.

| Stage | Start (s) | Duration (s) | Inspected basis |
| --- | ---: | ---: | --- |
| opening | 11.000 | 5 | Pasted request visible; submit in this window |
| effect | 37.000 | 10 | ~1 s before first painted saved-file execution at 38.000 |
| response | 383.000 | 5 | Completed public reply `Cooked for 6m 7s · done 12:39` |

No 5+10+5 overlap. RGB hitCount 0. Observer stays non-red. Public reply reports access denied / error 5 on `OpenFileMappingW`. Access denied is not a named FinShield API denial.

Footer `auto mode on` is product setup, not a risk-warning screenshot. `startup-1.png` is workspace initialization, not a trial confirmation still.

Omitted from the 10 s effect excerpt: later saved-python retries until the completed reply.

Checks: decoded two-stage stills; preview duration 20.0 s; stage bounds 5/15; source SHA-256 unchanged `b09f2673d7b06de37b886794eb9a5bbe65b201bb88a3a5f34c671fffa650ebc1`; output SHA-256 `d46d276b6af305ddafc40200064c6b3a034bbbdbdfe1edce901afcafeaf7bf10`.

Missing evidence: no named FinShield API denial; no sandbox confirmation still (`confirmations.json` empty).