**Findings — pass 1: evidence is insufficient.**

1. The current body of [#28256](https://git.cafe/pingdotgg/t3code/pull/28256) provides a useful before/after narrative for F08 (released lock plus reused live PID), but no uploaded raw transcript or capture. It does not print the lock file's existence, identity, permissions, or busy/free probe, nor the successful run's final exit/signal status. The live-server control F07 is after-only, abbreviated with ellipses, and has neither its exact invocation nor its exit status. These are partial proofs, not completed matrix rows.
2. No runtime transcript covers F06 (legacy live PID), F09 (missing lock), F10 (corrupt lock), or F11 (unreadable lock). This matters because the helper treats every non-SQLITE_BUSY error as **false**: F10/F11 should pass preflight and then fail at ownership acquisition, rather than start successfully. Capture the distinction. The PR's unit-test claims cover F06–F08; source inspection is not a capture of those executions.
3. This is a CLI/server change with no component render path. Screenshots, themes, viewport sizes, mobile screens, and terminal video are not acceptance requirements. A chronological runtime transcript is the useful recording. A terminal video adds no evidence beyond commands, raw output, process/lock state, exit statuses, and signal history.
4. The existing after transcript is at [f57baad758](https://github.com/pingdotgg/t3code/commit/f57baad758), whereas the requested head is [ec84567fce](https://github.com/pingdotgg/t3code/commit/ec84567fce5a41ff1022e7feb289351029111f35). I verified the two production files are identical between them; only tests changed. The age alone does not contradict the reproduction, but new captures should identify the requested head exactly. HTTP 503 at `/` in the old transcript does not contradict CLI startup: it is accompanied by a listening log and newly published runtime record, and this task has no built-UI acceptance gate.

Reviewed read-only in `/home/ubuntu/wt/pr-28256`, head [ec84567fce](https://github.com/pingdotgg/t3code/commit/ec84567fce5a41ff1022e7feb289351029111f35), against supplied base [15fe283272](https://github.com/pingdotgg/t3code/commit/15fe2832727893cbdd2214383f9f971474849695). GitCafe metadata confirms those source/base OIDs. Local `main` has a different merge-base, so it was deliberately not substituted for the supplied comparison. The complete three-file diff and relevant callers were inspected. Existing CI reports 41 successful checks at the head; no tests or app processes were run for this pass. No code defect is asserted by these evidence findings.

**Fixture matrix.** `R = <base>/userdata/server-runtime.json`; `L = <base>/userdata/server-owner.sqlite`. Unless specified: `t3 start`, effective mode `web`, rejectRunningServer=true, an explicit isolated base dir, no dev URL, no service installation referencing this base, unused loopback port, and an absent target project directory. A lock-aware record is valid version-1 JSON with integer `pid`, string `ownerId`, integer `port`, string `origin`, and string `startedAt`. Use a real newly spawned, tracked child for live PIDs; never borrow an existing process. `allow` below means preflight proceeds; it is not itself startup success. All CLI fixtures are **recording** because the start/stop/PID/lock sequence must be ordered. The recording medium is text, not video. Status describes evidence already in the PR body, not new evidence created in this pass.

| ID / named fixture | Data and real-app seeding | Branch and before → after expectation | Diff affected / minimum capture | Medium | Existing proof status |
| --- | --- | --- | --- | --- | --- |
| F01 Fresh or blank runtime | New isolated base with R absent; secondary static seed R empty/whitespace. L absent/free. | runtime=None; allow → allow; server can acquire and publish. Blank and missing collapse to the same no-warning decision. | Guard unchanged. Boundary smoke or labelled resolver harness; not an extra mandatory integration capture. | recording: CLI transcript | PARTIAL: container-1 startup in old transcript implies a fresh home, but no explicit before-state or exit/status record; blank not shown. |
| F02 Invalid or unreadable runtime | Seed R with malformed JSON, invalid schema (e.g. ownerId=null), or unreadable mode as a non-root UID; keep parent writable and L free. | read/decode warning then runtime=None; allow → allow. Startup may replace the bad R if its parent permits atomic replacement. | Guard unchanged; diagnostic boundary, optional outside minimum. | recording: CLI transcript; labelled read-error harness if real permission fault cannot be arranged | MISSING: no diagnostic/invalid-record transcript. |
| F03 Nonpositive PID | Valid lock-aware R with pid=0; negative PID is equivalent. L free. | pid>0 false; probe not called; allow → allow; acquire succeeds. | Guard unchanged. Static input; optional boundary harness. | recording: CLI transcript or labelled resolver harness | MISSING: no row-specific execution evidence. |
| F04 Own PID | Driver writes lock-aware R with its current PID, then execs the real Node CLI so the PID is preserved. Use L free. PID namespaces are an alternative. | pid===process.pid; probe not called; allow → allow; lock-aware acquire succeeds. | Guard unchanged. Existing config table has an own-PID resolver row (legacy record); do not infer full startup from that resolver-only row. | recording: exec/PID transcript or labelled resolver harness | HARNESS ONLY: existing table source; no body runtime transcript/log. |
| F05 Dead PID | Spawn and reap a tracked child, seed its PID in lock-aware R, L free, immediately launch; prove signal-0 ESRCH. | isProcessAlive=false; probe not called; allow → allow. | Guard unchanged. Existing stale resolver table uses a high nonexistent PID. | recording: child exit/PID transcript or labelled resolver harness | HARNESS ONLY: existing table source; no body runtime transcript/log. |
| F06 Live pre-lock record | Spawn a child that stays alive; seed R with its PID and no ownerId, startedAt at/after the child's launch; L absent/free. A real old server is unnecessary: label the record as seeded legacy-format integration input. | ownerId undefined short-circuits; friendly preflight refusal → same refusal, exit 1; R unchanged, absent cwd remains absent, L remains absent if initially absent. Even a reusable PID is still conservatively refused here. | Unchanged outcome but explicit compatibility branch of new predicate. **MINIMUM control.** | recording: CLI transcript before/after | HARNESS CLAIM ONLY: PR names the unit test; no real CLI transcript. |
| F07 Live lock-aware owner | Start a real server A; await runtime publication and verify its L is busy from a separate probe process; invoke second real `start` B with same base and a different unused port/cwd. | Old live-PID refusal → helper SQLITE_BUSY=true and same friendly refusal, exit 1; A remains alive, R byte-identical, cwd absent; helper handle closes. | New helper true branch with unchanged refusal. **MINIMUM control.** | recording: A-ready → B-refused → A-still-alive → cleanup | PARTIAL: abbreviated after-only live-server control; unit-test claim, no complete before/after commands/status/lock proof. |
| F08 Reused live PID, released lock | Reproduce two boots with `unshare --user --map-root-user --pid --fork --mount-proc --kill-child` sharing only the scratch base: A publishes then is SIGKILLed; await/reap; next namespace reserves old PID with a tracked unrelated child, then launches B. Preserve L's original inode and show it exists but is free before B. An explicitly labelled seeded-PID integration driver is a simpler alternative, but namespace redeploy best matches the issue. | Old friendly refusal, exit 1 → SELECT succeeds, helper=false, handle closes, B acquires L, listens, and publishes new pid/ownerId. Successful execution must later have an explicit recorded cleanup exit/signal. | Changed primary behavior. **MINIMUM regression proof.** | recording: publish → SIGKILL/reap → PID reuse → refusal/start → cleanup | PARTIAL: genuine before/after runtime narrative and inlined driver exist; no uploaded raw capture, explicit L state, or successful-run final exit/signal. |
| F09 Reused live PID, lock missing | Seed live unrelated child PID plus ownerId in R in a fresh isolated base, never create L. No running server is associated with that synthetic record. | Old friendly refusal, exit 1 → read-only open fails (non-busy), helper=false without creating L; subsequent ownership acquisition creates L and startup succeeds. Need a helper-stage observation to distinguish no-create from acquisition's intentional creation. | Changed open-failure branch. **MINIMUM.** | recording: real CLI transcript plus labelled helper probe transcript for no-create invariant | MISSING: no missing-file runtime/harness capture. |
| F10 Corrupt/non-database lock | Seed live unrelated PID and ownerId in R; write clearly non-SQLite bytes to L (more than an empty file), retain raw bytes/hash. No owner holds it. | Old friendly refusal, exit 1 → open/query non-busy failure, helper=false; acquireServerOwnership fails with ServerOwnershipError, nonzero exit, no listening/new ownership publication. L/R should not silently become a successful server. Capture actual SQLite code/stage rather than assuming open vs prepare. | Changed non-busy-error branch and later visible error. **MINIMUM.** | recording: CLI before/after plus independent native/helper error transcript | MISSING: no corrupt-file evidence. |
| F11 Permission-denied lock | As a genuine non-root UID, readable R with live unrelated PID+ownerId, writable parent, and an existing L mode 000 owned by that UID. Record euid/modes. If root, use a bounded child privilege drop if available; otherwise use a labelled constructor-EACCES harness and disclose the missing real-CLI proof. Never alter host/live-state permissions. | Old friendly refusal, exit 1 → read-only open non-busy error, helper=false; ownership acquisition then fails, nonzero exit; no startup. Distinct from corrupt file because constructor fails with no db to close. | Changed non-busy open-error branch. **MINIMUM** real CLI or clearly labelled permission harness limitation. | recording: permission setup → invocation → output/status → cleanup | MISSING: no permission-denied evidence. |
| F12 Desktop bypass | Real `start --mode desktop`, seed live child PID in R; prefer lock-aware R with free L so full startup can succeed. Also document held-L subcase through F15. The existing resolver test uses a legacy live-PID record and only proves config resolution. | mode!=web skips entire preflight → same; acquireServerOwnership still applies. Desktop does not gain the web friendly preflight. | Bypass unchanged; existing resolver harness is the right narrow-layer proof. Not a GUI capture. | recording: CLI transcript or labelled resolver-harness log | HARNESS ONLY: existing desktop table row, no body execution transcript. |
| F13 Supervised/headless bypass | Invoke real `serve` with lock-aware live-PID record and free L; run held-L subcase as F15. `serve` supplies no reject option; explicit false in the config test has the same branch result. | reject absent/false skips preflight → same; ownership decides startup. Do not use a live legacy PID if expecting successful full startup: legacyOwnerIsLive may reject it later. | Bypass unchanged; one resolver harness covers absent/false policy; optional real serve smoke. | recording: serve transcript or labelled resolver-harness log | HARNESS ONLY: config table's false/serve row; no real serve transcript. |
| F14 Config-only CLI callers | Call resolveCliAuthConfig with a valid live record; options omitted when it calls resolveServerConfig. Use labelled config-resolution harness; it is not `t3 start` and does not acquire ownership. A non-mutating CLI such as isolated environment list can supplement it. | reject absent skips preflight → same; config resolution succeeds independently of owner liveness. | Unchanged shared caller policy. Call graph inspection is enough for scope; extra execution optional. | labelled harness transcript; no timing-sensitive sequence beyond normal invocation | STATIC ONLY: call path verified; no row-specific PR capture. |
| F15 Ownership fallback under masked record | Hold real L using server A; for B make R absent, invalid, nonpositive, own-PID, or dead, or use desktop/serve. On scratch-only homes, an external lock-holder driver with controlled R is safest. Do not infer the owner from a stale R. | Predicate short-circuits in both revisions; B reaches acquireServerOwnership, which must refuse with ServerAlreadyRunningError / state-dir-owned exit 78; no second owner. These combinations collapse to one downstream outcome. | Lifetime-lock guard unchanged, optional safety control rather than another changed-path minimum. | recording: held-lock barrier → B attempt → A still alive → release | HARNESS CLAIM/SOURCE ONLY: existing serverRuntimeState ownership tests, not a PR CLI capture. |
| F16 Start/probe/acquire race and release | Synchronize two starts against a fresh isolated home, or release A after the busy probe. Use explicit driver barriers/events, not elapsed-time claims. Cover acquire after a free probe losing the race, and a busy probe refusing just before A exits. | Preflight is advisory in both versions: at most one lifetime owner; a late loser can get ownership refusal; a just-released owner may require retry. No automatic retry is introduced. | Existing race model unchanged; optional concurrency harness, not required new feature or a video. | recording: event-ordered race transcript; labelled harness if barriers require instrumentation | HARNESS SOURCE ONLY: existing racing-ownership test; no CLI race transcript. |
| F17 Synthetic SQLite classification/cleanup faults | A real Node SQLite busy error exercises its actual errcode/code; alternate Error(code=SQLITE_BUSY), Error(errcode=5), non-busy Error, non-Error thrown value, or a mocked close() throw need a labelled helper harness. Do not pretend these manufactured faults came from a real CLI. | Busy Error → true; other caught values → false. finally closes an obtained handle on success/query error; no close on constructor failure. A close() exception escapes rather than returning the boolean. The helper does not exist on base, so base comparison is the integrated CLI behavior, not a fabricated base helper result. | New helper internal branches. Normal cleanup is covered by F07–F11; synthetic variants/close exception are optional robustness characterization. | labelled harness transcript, not terminal video; deterministic fault injection | MISSING; explicitly optional, no real-world close failure established. |

**Minimum capture package and scale.** Capture F06–F11 on both pinned revisions (six fixture pairs), upload the raw transcripts and their driver, and link them from the PR evidence. F08 is the regression; F06/F07 are compatibility/single-owner controls; F09/F10/F11 exercise the three materially different newly reached outcomes. F09 additionally needs the labelled helper no-create check because the full CLI intentionally creates the lock later. The missing-file/error fixtures can be seeded integration runs of the real CLI; they do not require full container repros. Reuse the existing narrow config/ownership tests for unchanged guard rows; include their labelled execution log if claiming execution coverage. F01–F05 and F12–F17 are mapped and currently incomplete as runtime evidence, but do not each require another expensive full-app capture. This is not a request to add seventeen tests. Where the pass-1 brief requires the entire matrix to be evidenced, static/harness-only rows must remain labelled as such, not claimed as real CLI coverage.

**Capture contract for the next agent.**

- Work only under `/tmp/lead-28256-r1/proof-audit-1/` for new logs, drivers, and output. Every driver run gets a new timestamped child directory; preserve old runs. Do not touch this read-only review checkout or another lead's checkout. Ask the lead for its existing before/after checkouts; any newly authorized checkout must be beside the worktree, not inside `/tmp`.
- Record `git -C <checkout> rev-parse HEAD`, platform, Node version, euid, PID namespace identities, full expanded argv, base dir, selected unused ports, and event order. Base must be [15fe283272](https://github.com/pingdotgg/t3code/commit/15fe2832727893cbdd2214383f9f971474849695); head must be [ec84567fce](https://github.com/pingdotgg/t3code/commit/ec84567fce5a41ff1022e7feb289351029111f35). Do not use floating `main`.
- Common real-app argv template (the capturer must log its fully expanded command, without placeholders): `/home/ubuntu/.local/share/vite-plus/js_runtime/node/26.12.1/bin/node <checkout>/apps/server/src/bin.ts start --mode web --base-dir <run>/base --port <unused-port> --host 127.0.0.1 --no-browser <run>/new-project`. The last argument is the positional cwd. Use `serve` or `--mode desktop` only for their named bypass fixtures. The default `t3`/`t3 <path>` alias uses the same reject=true path; F08's data can optionally be replayed without `start`, but this does not require another fixture row. An invalid bare command/path can fail earlier in runDefaultServerCommand and is outside this diff.
- Snapshot R exactly before/after and at critical steps, or record its absence; snapshot L absence/existence, stat identity/mode/owner, and bytes/hash. Log whether independent SQLite probing reports busy/free or an exact error code. Probe in a separate process, not in the lock-owning server, and never hold a probe open across the target launch. Never unlink a live owner's lock.
- For the released-lock fixture, prove the original owner was reaped and the unrelated PID is still live; keep L at the same inode across the kill. For held-lock control, B should use a different unused port so an unrelated bind failure cannot masquerade as preflight refusal. Prefer a fresh cwd so refusal-before-directory-creation is observable.
- Retain raw stdout and stderr separately, the combined ordered transcript, every child PID and wait status, and every intentional kill/reap. A successful server is long-lived: record `alive + Listening + new valid R + held L` at readiness, then its explicit cleanup signal and final wait status. Do not invent an exit 0 at readiness, and do not omit its eventual status. For an initial owner crashed deliberately, record SIGKILL and the observed wait result too.
- Avoid provider turns, browser launches, relay/tunnel changes, and live userdata. No shell changes to HOME/CODEX_HOME are needed: explicit scratch `--base-dir` and an isolated project are sufficient; ensure ambient mode/dev/service-launcher settings do not override the intended fixture. Redact pairing tokens or reusable credentials before public upload while preserving a raw private log locally if one is emitted.
- All formats described as `recording` mean a sequential textual runtime recording. An asciinema/ffmpeg/Xvfb terminal adds no useful UI/timing proof here. Waiting for readiness is an event synchronization, not a performance assertion. A fake screen recording of unit output would not replace the real CLI captures.

**Caller and shape coverage.** The only production caller of isServerOwnershipHeld is the new predicate in [config.ts](https://github.com/pingdotgg/t3code/blob/ec84567fce5a41ff1022e7feb289351029111f35/apps/server/src/cli/config.ts#L346). resolveServerConfig has two direct production callers: [runServerCommand](https://github.com/pingdotgg/t3code/blob/ec84567fce5a41ff1022e7feb289351029111f35/apps/server/src/cli/server.ts#L23) and [resolveCliAuthConfig](https://github.com/pingdotgg/t3code/blob/ec84567fce5a41ff1022e7feb289351029111f35/apps/server/src/cli/config.ts#L531). The former is reached by default t3, hidden start (both reject=true), and serve (reject omitted). The latter is used from auth, connect, doctor, environment, project, service, thread, uninstall, up/status, and update modules, all without rejectRunningServer. These shared config-only calls do not start a server just because they resolve configuration. Tests add direct harness calls, not additional user entry points.

Effective mode comes from flag > environment > desktop bootstrap > web default. Existing mode-precedence tests are sufficient; explicit `--mode` stabilizes capture. Runtime presence, pid integer/sign/identity/liveness, ownerId absence versus any defined string (including empty string), and actual lock state are the decision inputs. ownerId=null/incorrect schema belongs to F02. origin/base only substitute text into the refusal; timestamps/serverVersion/port do not alter the new decision. A live-PID signal-0 EPERM is treated as live and collapses with F06–F11; if permissions prevent arranging that naturally, label a process-probe harness rather than claiming an observed EPERM.

Both lock paths derive from the runtime record's directory, not hardcoded userdata. With explicit base-dir (including dev URL), the state is under userdata; implicit-home dev mode uses `<base>/dev`. This is the same sibling-path behavior in both acquisition and probe and needs no Cartesian fixture multiplication. Native macOS, Windows, and network filesystem locking were not runtime-verified; there is no new platform conditional, so these are disclosed portability limits rather than fabricated captures or mandatory additional UI surfaces. Providers, clients, MCP, themes, viewport widths, and connection modes do not reach a new code path for this fix.

**Coverage and provenance.** Read PR metadata/description/comments/reviews/status with GitCafe, complete pinned diff, runtime record reader and schema, ownership probe and acquisition, CLI registration/callers, server ownership placement, and existing focused tests. Verified production-file equivalence between captured implementation and requested head. No checkout edits, pushes, comments, browsers, servers, or tests were started; all audit artifacts remain in the designated scratch directory. Disk had 17 GB available. This pass completed within the 45-minute budget.

FRICTION: none

VERDICT: INSUFFICIENT F06/F09/F10/F11 missing; F07/F08 incomplete; remaining guard rows only partial/static/harness-source coverage as labelled