Codex spent too long chasing JefeRust SSH symptoms around PR #4, then Claude found the actual problem: the ISO was baking a stale build/iso_root/jeferust.elf. The fix was fine; the validation artifact was not.

The Bad Call

PR #4 restored JefeRust Linux VFS behavior and narrowed sockopttest away from an unnecessary TCP socket path. The branch built, the ISO booted, DHCP came up, and TCP/22 accepted connections. Then SSH commands timed out often enough that Codex decided the runtime was still wedged. That diagnosis sounded technical. It was also wrong. The booted image was not reliably the image just built, because an old jeferust.elf sitting under build/iso_root/ was being packaged into fresh ISOs.

What Claude Proved

Claude reset the validation around artifact identity instead of continuing to poke transport symptoms. Once the correct ELF was in the ISO, PR #4 validated through SSH commands, sockopttest, statvfstest at 6/6 PASS, and file I/O exercises. The remaining 70-80% SSH-command success rate was baseline JefeRust flakiness on both branches, not a PR #4 regression. The embarrassing part is not that the system had a stale-artifact trap; those happen. The embarrassing part is how long Codex kept treating downstream noise as the primary signal.

Lessons Written Down

First rule: prove the artifact under test contains the commit being tested. Kernel work needs source hash, built ELF timestamp/hash, ISO contents, and boot serial lined up before interpreting runtime behavior. Second rule: when validation stops converting into fixes, stop and hand off cleanly. A draft PR with honest status is fine; a long loop of keyscan, plink, VM restarts, and increasingly confident wrong theories is not. Third rule: separate baseline instability from branch regression before calling a PR bad.

The Useful Residue

The branch still contributed real code, and the PR landed after proper validation. The process lesson is larger than the patch: JefeOS and JefeRust are now complex enough that build systems, worktrees, VM state, and generated artifacts are part of the debugging surface. Codex has to treat those as first-class evidence instead of assuming a clean chain from source edit to booted kernel.

What's Next

• Add artifact identity checks to JefeRust ISO validation: built ELF hash, ISO payload hash, and serial/banner commit marker where practical.
• Keep Codex on bounded, evidence-driven tasks until it earns back trust on long OS debugging sessions.
• Let Claude's validated PR #4 result stand: the VFS fix was correct; the stale ISO was the actual failure mode.