# Independent proof audit, pass 2

Verdict: **SUFFICIENT for the bounded Linux/systemd sequential claims**. This is an evidence verdict, not unconditional merge approval or concurrency safety.

Reviewed [GitCafe #23247](https://git.cafe/pingdotgg/t3code/pulls/23247), mirrored as [GitHub #23250](https://github.com/pingdotgg/t3code/pull/23250), branch `fix/issue-17490`, exact head [0df1ba9eae](https://git.cafe/pingdotgg/t3code/commit/0df1ba9eaefa23c18c535514cbf0ece4a67aae75). Read all seven changed files and traced installer state/unit writes, launcher pending/commit/failure state writes, parser compatibility, and production prune selection. No source edits, PR edits/comments, pushes, watches, or forge polling.

## Provenance and scope

Downloaded and inspected the [matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9aedb33a737040f5/matrix.md), [new runtime transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/99cb785879ac313c/17490-exact-head-runtime.txt), [reproduction archive](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c4926738e10e131a/17490-reproduction-evidence.tar.gz), and [provenance](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9e929597db93c4f1/provenance.json). Downloaded transcript byte-matches the archive copy; downloaded matrix matches local matrix. Independently SHA256-checked original bundle, original SEA, Node tarball, all five fixture bundles/SEAs/release archives against uploaded provenance. Every fixture bundle differs from original only in the single generated package version declaration. Original bundle SHA256: `040be589ea484d57ed573bfbe7aa6c26d2e5c22784d2753260e54b1e382b1448`. Build log records exact clean head and production build invocation. This audit reused that verified bundle and independently rebuilt affected fixtures; it did not repeat the full source compilation.

The recorded observed base [6318bfc597](https://git.cafe/pingdotgg/t3code/commit/6318bfc597e544679848c4ed816606bacd32a175) is not the correct endpoint for a two-dot seven-file diff after integration. Its merge base with head is [b5a226e49c](https://git.cafe/pingdotgg/t3code/commit/b5a226e49c52ecab4ddc2d678a7012d97e651a6a); the three-dot diff contains exactly seven files, 124 insertions/46 deletions. Reading the 84-file two-dot diff as PR scope would be misleading.

## Matrix verdicts

| Matrix row | Status | Exact observation and claim boundary |
| --- | --- | --- |
| Original failure | ACCEPTED historical | Existing before evidence accepted as instructed; not rerun. It establishes observed A deletion and restart 203/EXEC, not exact-head behavior. |
| Sequential install/update/prune/restart | SUFFICIENT | New row1: A launcher PID620460 persists through authenticated B/C RPC updates. Stopped MainPID0; all sentinels aged two hours; production prune keep C, references omitted, removes control0.1.0 and retains A/B/C. Restart launcher PID624884 executes A; descriptor HTTP200 C, protocol2, probe success. Historical pre-integration after is supplementary only. |
| CLI repoint while launcher alive | SUFFICIENT; independently rerun | New row2: successful production install(start:false) writes B unit/state with A PID626236 unchanged; C/D updates preserve B when it is neither active nor rollback. Stopped/aged prune removes control and A, retains B/C/D. Restart PID630200 executes B and serves HTTP200 D/probe success. Independent reproduction details follow. |
| Failed/rolled-back update | SUFFICIENT for failed-candidate branch | New row3 genuinely removes candidate E executable availability during handoff; state persists failed/candidate-start-failed with launcher A and active C. HTTP200 C/probe succeeds. Stopped/aged prune removes control/B, retains A/C/E. Final restart initially hits manager start-limit; continuation records reset-failed on this owned unit, restart through A PID638160, HTTP200 C/probe success, same failed record. No manual state repair. This does not prove every rollback branch, data integrity, or an uninterrupted automatic restart under manager rate limits. |
| Concurrent successful install/state write | UNRESOLVED; safety claim blocked | Source-confirmed stale-A read/merge/write race remains. Sequential runtime evidence does not test or solve it. |
| Legacy launcher migration | UNVERIFIED | Fixed CLI reinstall and restart into fixed launcher remain required; remote update alone does not migrate an old writer. |
| macOS launchd | UNVERIFIED | Linux/systemd evidence cannot establish launchd behavior. |

The [lead's final-head test log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b37d132df8b48672/final-head-tests.log) records three focused files and 63/63 passed. Independently read, not rerun or represented as this auditor's test execution. No pixel evidence applies to this server-only change.

## Unresolved source finding

[Launcher state merge](https://git.cafe/pingdotgg/t3code/blob/0df1ba9eaefa23c18c535514cbf0ece4a67aae75/apps/server/src/serviceLauncher.ts#L560) reads A's launcherVersion, then later atomically replaces the state. [Installer](https://git.cafe/pingdotgg/t3code/blob/0df1ba9eaefa23c18c535514cbf0ece4a67aae75/apps/server/src/cloud/bootService.ts#L863) can write B, read back B successfully, and repoint unit B between that read and replacement. The late launcher write restores A. Once B leaves active/update references and the service is stopped, production pruning can remove B and break the next restart. Atomic rename does not serialize the read/merge/write with installation. This remains a substantive correctness limitation; it blocks unconditional safety/merge-readiness claims, not acceptance of the bounded sequential demonstrations. A future fix needs shared serialization or an authoritative unit reference strategy plus a deterministic interleaving regression test; no fix was authorized here.

## Forge snapshot

One `cafe pr view` and one `cafe pr status`, no follow-up polling: open, requested head confirmed, 34 successful checks, zero pending/failing checks. Merge status waiting on current-base conflict readiness; cached conflict observation was marked noncurrent. This snapshot is not a current merge guarantee.

## Independent reproduction

[Independent terminal transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a027b1213196598f/independent-row2.log) and [reproduction scripts/build/hash/cleanup evidence](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8f87ec4c6d827b6a/independent-proof.tar.gz).

PASS, 2026-10-22 10:35:04–10:36:21 UTC, uploaded runtime.py scenario two with path/account/port adaptations described below. Rebuilt A-D SEAs and release archives using uploaded fixtures.mjs and verified original generated bundle; all four rebuilt generated bundles match uploaded exact-head hashes. Real production checksum/install, BootService.install(start:false), launcher, authenticated RPC, persisted state, production prune, and systemd restart ran. Only release HTTP transport was mocked.

- A installed and ran as launcher PID663820. Repoint B completed at10:35:32 with the identical launcher PID/executable A and HTTP200 still A, while unit and state named B.
- Remote C then D completed with PID663820 unchanged. State after D: active0.1.4, launcher0.1.2, committed update from0.1.3 to0.1.4. B was neither active nor rollback/target.
- Stop at10:36:05 gave MainPID0/inactive. A/B/C/D/control completion sentinels were aged two hours. Production prune keep=[0.1.4], references omitted, returned removed=[0.1.0,0.1.1]. Executability assertions retained B/C/D; absence assertions confirmed A/control removal.
- systemd daemon-reload/start executed `/home/pr23250audit/.t3/runtime/versions/0.1.2/t3`, PID666268, at10:36:20. Descriptor returned HTTP200, serverVersion0.1.4, orchestrationProtocolVersion2; authenticated server.probe returned Exit Success {}. State still named launcher B. ROW2 PASS.

Cleanup at10:36:31–10:36:36 stopped/disabled the owned service, removed its unit, disabled linger, stopped its owned user manager, and removed account/home/runtime. Release transport closed in finally. Ports17550/17551 had no listeners. Final checkout remained exact requested head with empty git status. Live ~/.t3 was not accessed. Own scratch is removed after successful uploads; original lead artifacts are preserved.

## FRICTION

Uploaded helper scripts have hardcoded scratch paths, account, ports, and UID/GID1001. This audit adapted scratch/account to `/tmp/pr23250-audit` and `pr23250audit`, ports to17550/17551, confirmed its newly created UID/GID1001, and reused existing repository dependency inputs. The fixture generator was restricted to A-D. Production source and bundle logic were not edited. The archived original generator's wrapper layout is correct; previous archive-layout/dependency/setup mistakes are candidly retained in its FRICTION file. Fresh fixture archives need not hash-identically because SEA configuration paths and archive metadata differ; generated bundle identity is the relevant invariant and production checksum manifests are regenerated.

The failed-candidate capture's manager StartLimitBurst issue is a real qualification, not an application regression inferred from a timeout. Its continuation proves restart only after resetting that owned unit's counter. Mocked release transport, handcrafted external dependency closure, absent client assets, Linux-only manager, no legacy migration, and no concurrent interleaving remain explicit limits.

Audit model/harness: GPT-6.1-Sol through Codex in T3 Code.