Pass-2 proof audit for [#32587](https://git.cafe/pingdotgg/t3code/pull/32587), head [f91433db1f](https://git.cafe/pingdotgg/t3code/commit/f91433db1fcb529d59bde305f555a33a0bb73e0e), against merge-base [d313b2aff3](https://git.cafe/pingdotgg/t3code/commit/d313b2aff31991ab94c8ac80cdc38a54dd575604).

No affected row remains missing or contradicted. The new captures close all four pass-1 blockers: F01, F03, F12b and F19. F07–F10 remain inherited capture gaps, explicitly outside the PASS 2 blockers; they are not silently upgraded to covered.

Nonblocking reporting finding: the current PR description still links only the older evidence and claims the later changes do not reach the older F01/F03 paths. That staleness claim remains inaccurate: their first fresh launch enters the new sibling scan. The [new capture index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6206ced7c07a73d0/index.md) and the rows below supply the missing current-path evidence. This audit makes no PR edits or comments.

Provenance and inspection:

- Checkout is clean and its HEAD is the pinned revision. The merge-base with the locally available origin/main is [d313b2aff3](https://git.cafe/pingdotgg/t3code/commit/d313b2aff31991ab94c8ac80cdc38a54dd575604). The diff from [29975cd79c](https://git.cafe/pingdotgg/t3code/commit/29975cd79ca419625cba29d698c34cc875f9c0a0) to head across packages/ssh is empty, so the retained refreshed after captures remain valid for every packages/ssh file.
- The older before source at [0a9abddaee](https://git.cafe/pingdotgg/t3code/commit/0a9abddaee00ff1495e77a03dd4fafa73c3cd4cb) is byte-identical in tunnel.ts to the current merge-base. Before source SHA256 is e5725d5af406fd27a0ee9b43e7363a4ecc5ab8623f8ab05a62409dfb1b3d8c63; after is 32b509a806d0f78a28eac1bcee8e9ae1acca532176dc7afaf0043cdda3f52d1d. These match the new index.
- Fresh renders through the uploaded renderer and real launchOrReuseRemoteServer API match all four delivered new scripts byte for byte: archive before e8732a2e / after 8846e694, Node before 4436dcd4 / after 24b3bae6. Before rendering used a scratch copy of the committed baseline module and read-only existing dependencies; no checkout or worktree was created or changed. Fresh renders also reproduce retained Node after hash 8ef6f067 and updated archive hash 1624bfa6. Hashes match the actual transcript inputs, not only their revision labels.
- Read all eight new transcript files completely (16 scenarios), all sixteen retained refreshed transcript files, the older combined transcript and embedded drivers, the uploaded capture/renderer/shim/fixture drivers, and relevant current source and tests. Every after assertion agrees with its shown records, PIDs, stdout, trace and lifecycle events. The selected dash traces contain some parent/child interleaving; independent spawn records disambiguate those lines. Structural/hash checks supplement these reads.
- Rechecked the older [6016bfa6a4](https://git.cafe/pingdotgg/t3code/commit/6016bfa6a408c4f4e53fe4fcc57de16dab81cf33) recovery harness against the later diff. F13/F16 execute successful recovery-lock acquisition and the protected owner reread, which are unchanged. The changed failed-acquisition policy is covered by current F15/F17 captures. The older matrix's F15 deletion policy is superseded; current evidence consistently preserves abandoned recovery files and fails with a diagnostic.

Independent rebuild: [complete before/after F19 transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b0a874385f9646ad/F19-independent-rebuild.txt). Ran the uploaded Capture driver with only BASE relocated under this audit's scratch directory; no fixture logic or production timeout changed. At head, the full launch invokes the temporary runner, exits 42, preserves installed runner SHA256 a12bc86f612570bc87c0613e74349f823a2984d1f59599d89eca986580a7cf6a, removes .next, takes no home lock and starts no server. The baseline independently changes that installed hash to 29f0a9c3d3aab0fe7e91a0cf7545b66bff99eb8b799b0e160a4ef8aa848364fe before failing. Both outcomes agree with delivery. Tracked launch PIDs 2709906 and 2714807 have no remaining /proc entries.

The table is the pass-1 branch inventory rechecked against the head diff, with the four new rows integrated. “Covered” states its evidence type: a source or automated-test inspection is not presented as a runtime capture. No suite execution is claimed. No new claims are made for real SSH transport, two desktops, macOS, PIPE/SIGKILL delivery, zombie siblings, missing-Node preflight or UI surfaces. This is a server-only script; UI, desktop and mobile render captures do not apply.

| Row | Fixture / branch | Diff affected | Status | Capture / evidence URL | Audit result |
|---|---|---|---|---|---|
| F01 | Cold archive, same alias, two concurrent launches | Yes | covered | [before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/36113c9abb74916d/F01-before-cold.txt) / [after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ebe0154d479ca09a/F01-after-cold.txt) | Current merge-base/head, fresh HOME without an installed archive. Before starts two children and records dead PID 2694944 instead of live owner 2694925. After starts only PID 2695595; both commands return managed, the record equals the live runtime owner, no ownership error, locks or temporary runner. |
| F02 | Warm archive, same alias | Yes | covered | [before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5537060b4dc90b36/F02-before.txt) / [after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c6b5d8a36e5c375e/F02-after.txt) | Before: two starts, dead recorded PID, reconnect external. After: one start; recorded PID equals live runtime owner; both launches and reconnect managed; locks absent. |
| F03 | Other alias via runtime JSON, including early publication | Yes | covered | [before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e6441904753f9c98/F03-before-cold.txt) / [after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1a8447ecd3e0c55d/F03-after-cold.txt); [early-publication automated fixture](https://git.cafe/pingdotgg/t3code/blob/f91433db1fcb529d59bde305f555a33a0bb73e0e/packages/ssh/src/tunnel.test.ts#L703) | Current cold archive pair replaces the stale older first-launch evidence. Before starts two children and leaves a dead managed alias. After has one managed owner PID 2697485 and one external alias on 3774; trace sets DEFAULT_RUNTIME_INFO, ADOPTED_PID and external without a second spawn. Existing 1.5 s Node fixture covers earlier publication; F12a covers later/absent publication. |
| F04 | Unchanged same-alias managed reuse | Yes: comparison under lock | covered | [before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5537060b4dc90b36/F02-before.txt) / [after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c6b5d8a36e5c375e/F02-after.txt); [older before/after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ccd25db701d72c76/round0-transcripts-and-drivers-6016bfa6a4.md) | After reconnect remains managed on the same live PID and port with no extra start. Saved-port correction and absent-runtime variants are inherited and not separately captured. |
| F05 | Different runner; two concurrent updates | Yes | covered | [before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6fbf36ae374a08fb/F05-before.txt) / [after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/755711441ed793ba/F05-after.txt) | Old real managed server runs the old version. Before A exits 126 with Permission denied; B updates. After both exit 0, old PID stops, exactly one replacement starts on the new version, reconnect stays managed. No before double-restart claim. |
| F06 | Adopt ready default runtime; optional obsolete managed child | No new selection branch; common lock envelope | covered | [before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e6441904753f9c98/F03-before-cold.txt) / [after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1a8447ecd3e0c55d/F03-after-cold.txt); [source](https://git.cafe/pingdotgg/t3code/blob/f91433db1fcb529d59bde305f555a33a0bb73e0e/packages/ssh/src/tunnel.ts#L701) | Current F03 explicitly traces ready-runtime adoption without an obsolete child; adopter skips the sibling scan. Killing a superseded managed child and avoiding a second probe remain inherited uncaptured variants. |
| F07 | Saved external port, no default runtime | No new branch; common lock envelope only | missing | None | No capture isolates external reuse through its saved port. Inherited coverage gap, not a verdict blocker. |
| F08 | Bad default/saved state: invalid/dead/nonloopback runtime; failed default probe; missing/dead/zombie PID or port | No new branch; common lock envelope only | missing | None | No deliberate corrupt-state or failed-adoption fallback capture. Generic fresh start does not prove these inputs. Inherited gap, not a verdict blocker; new sibling rejection is separately F12b. |
| F09 | Unchanged live managed server never ready | No new preservation branch; shared EXIT cleanup changed | missing | [source](https://git.cafe/pingdotgg/t3code/blob/f91433db1fcb529d59bde305f555a33a0bb73e0e/packages/ssh/src/tunnel.ts#L756); [before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/22198a9c039b98b9/F11-before.txt) / [after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dd85abdaa37a99a5/F11-after.txt) | No direct preservation-path capture. F11 verifies the shared new lock cleanup at ordinary exit, but its newly spawned child is intentionally stopped. Inherited preservation behavior is not claimed as captured. |
| F10 | Port picker fails / scan exhausted | No new error branch; shared EXIT cleanup changed | missing | [source](https://git.cafe/pingdotgg/t3code/blob/f91433db1fcb529d59bde305f555a33a0bb73e0e/packages/ssh/src/tunnel.ts#L784); [before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/22198a9c039b98b9/F11-before.txt) / [after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dd85abdaa37a99a5/F11-after.txt) | No direct exhausted-port capture in either mode. New shared EXIT cleanup has F11 proof; inherited archive/Node diagnostics remain uncaptured. |
| F11 | New child fails readiness, then retry | Yes: lock spans error and child wait | covered | [before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/22198a9c039b98b9/F11-before.txt) / [after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dd85abdaa37a99a5/F11-after.txt) | HTTP-503 fixture actually binds its port. Both sides fail around the native 60 s deadline, stop the child and clear records. After holds the lock while unready, releases it on failure, then retry succeeds managed. |
| F12a | Runtime JSON after 10 s or never; healthy sibling adoption | Yes: new deadline and sibling fallback | covered | [before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4254ad9a3e9d5935/F12-before.txt) / [after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6dc925aed13fbf65/F12-after.txt) | Both late15s and never before cases start a losing second child and fail its readiness. Both after cases return managed + external on one port while runtime JSON is absent, with one attempt. Late variant subsequently publishes. Pass-1 rebuild is retained in that report; this pass independently rebuilds F19 instead. |
| F12b | Reject unusable sibling candidates and fall through | Yes | covered | [before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/86135650f5a2c1b6/F12b-before.txt) / [after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1721843106521fa0/F12b-after.txt) | All five pairs read in full: dead PID, external record, missing port, garbage port and HTTP-503 port. After skips dead/external candidates; missing port takes clear-and-break without a probe; garbage/unready ports fail native wait_ready 2000 then clear-and-break. Each starts one healthy managed child, preserves the sibling record and removes launch locks/temporary runner. Zombie handling inside unchanged server_running remains uncaptured; this is not an additional new helper branch. |
| F13 | Dead main-lock owner; available recovery lock | Yes | covered | [older before/after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ccd25db701d72c76/round0-transcripts-and-drivers-6016bfa6a4.md); [current automated fixture](https://git.cafe/pingdotgg/t3code/blob/f91433db1fcb529d59bde305f555a33a0bb73e0e/packages/ssh/src/tunnel.test.ts#L723) | Older extraction harness starts from a dead numeric owner and takes the uncontended recovery lock; successful acquisition/reread/removal path is unchanged. Current full-launch test also seeds 999999999, asserts one owner and no main lock. Test assertions inspected; no new suite execution is claimed. |
| F14 | Empty main lock: grace then recovery | Yes | covered | [before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a57878f02e3e883c/F14-before.txt) / [after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/cb53f6220807504c/F14-after.txt) | Before ignores the empty file. After command audit shows four one-second backoffs, then removal on fifth empty observation under its recovery PID; one managed server; both locks gone. Owner-appears/reset timing is not separately claimed. |
| F15 | Abandoned empty/dead recovery lock | Yes | covered | [before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/39be4ec68db63914/F15-before.txt) / [after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7fb2eacfe1222585/F15-after.txt) | Current policy preserves foreign break files. Both after variants start no server, exit 1 around 82 s, preserve both seeded files, remove .next and name the recovery file. Earlier matrix removal policy is superseded, not evidence for head. |
| F16 | Stale main-lock observation cannot delete successor owner | Yes | covered | [older before/after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ccd25db701d72c76/round0-transcripts-and-drivers-6016bfa6a4.md); [source](https://git.cafe/pingdotgg/t3code/blob/f91433db1fcb529d59bde305f555a33a0bb73e0e/packages/ssh/src/tunnel.ts#L590) | Older extraction harness pauses B, admits A, resumes B under its recovery lock and adds C; records A preserved and later serialized entry. This exercises successful recovery acquisition and mismatching main-owner reread, unchanged in head; the changed failed-break-acquisition branch is not exercised by that interleaving. New failure branches have F15/F17 captures. |
| F17 | Live foreign main owner / live foreign recovery owner; bounded wait | Yes | covered | [before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/20909067242f9802/F17-before.txt) / [after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5aa24a10cd875ff3/F17-after.txt) | Both before variants ignore locks and start. Both after variants exit 1 around 82 s without starts; preserve foreign files and remove .next. Main owner gets held-too-long; recovery owner diagnostic names break file. |
| F18 | HUP / INT / TERM: main owner, recovery owner, waiter | Yes | covered | [before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0ff76ff2b0c3fe79/F18-before.txt) / [after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4c5a87665ad8ec23/F18-after.txt) | All nine after cases exit 1, remove .next and only owned locks, preserve foreign locks. Three comparable before-owner cases leak .next and die by signal; six before waiter/recovery cases have no such milestone and explicitly receive no signal. Gate aborts mutation. PIPE and SIGKILL delivery are not empirically claimed. |
| F19 | Prerequisite/preflight failure before publication | Yes | covered | [before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/24f1c845eff1046a/F19-before-archive-version-failure.txt) / [after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/653398ddbfb8386d/F19-after-archive-version-failure.txt); [independent before/after rebuild](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b0a874385f9646ad/F19-independent-rebuild.txt) | Full-launch archive preflight exits 42. Before replaces installed run-t3.sh (a12bc86f to 29f0a9c3); after leaves a12bc86f unchanged. Both remove .next, acquire no launch lock and start no server. Fresh head render and assigned-scratch before/after rebuild agree. Missing-Node and archive-download failure are not separately claimed as captured. |
| F20 | Absent lock; runner absent/equal/different; normal owned-lock release | Yes | covered | [before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5537060b4dc90b36/F02-before.txt) / [after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c6b5d8a36e5c375e/F02-after.txt); [before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6fbf36ae374a08fb/F05-before.txt) / [after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/755711441ed793ba/F05-after.txt); [before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0ff76ff2b0c3fe79/F18-before.txt) / [after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4c5a87665ad8ec23/F18-after.txt) | F02 creates runner, then equal runner reuses without extra start; F05 replaces a genuinely different runner once; success releases main lock. F18 covers foreign-lock exclusion in cleanup. This is common launch/cleanup proof, not a replacement for F01 cold install. |
| F21 | Launch timeout arithmetic and selection | Yes | covered | [source](https://git.cafe/pingdotgg/t3code/blob/f91433db1fcb529d59bde305f555a33a0bb73e0e/packages/ssh/src/tunnel.ts#L68); [source](https://git.cafe/pingdotgg/t3code/blob/f91433db1fcb529d59bde305f555a33a0bb73e0e/packages/ssh/src/tunnel.ts#L976); [before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/39be4ec68db63914/F15-before.txt) / [after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7fb2eacfe1222585/F15-after.txt); [before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/20909067242f9802/F17-before.txt) / [after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5aa24a10cd875ff3/F17-after.txt) | Source: ceil((60000+2*2000+2*2000+10000+4*1000)/1000)=82 s; Node SSH=172 s; archive=900 s; PID exit=20 ticks. F15/F17 run full native 82 s lock wait. Outer caller timeout is source evidence, not claimed as a rendered-shell runtime measurement. |
| F22 | Tunnel connect keeps 90 s base, then HTTP readiness | Integration constraint; forward behavior inherited from main | covered | [source](https://git.cafe/pingdotgg/t3code/blob/f91433db1fcb529d59bde305f555a33a0bb73e0e/packages/ssh/src/tunnel.ts#L58); [delayed-forward test](https://git.cafe/pingdotgg/t3code/blob/f91433db1fcb529d59bde305f555a33a0bb73e0e/packages/ssh/src/tunnel.test.ts#L393); [never-connect test](https://git.cafe/pingdotgg/t3code/blob/f91433db1fcb529d59bde305f555a33a0bb73e0e/packages/ssh/src/tunnel.test.ts#L466) | Source preserves separate 90 s connect base instead of inheriting 172 s launch budget. Existing TestClock tests cover 25 s delayed forward success and never-connect failure plus tunnel cleanup. Assertions inspected; tests not rerun by this audit. |

All writes and both runtime fixture HOMEs stayed under /tmp/lead-32587-r2/audit-2/. No live T3 home was used. No repository edits, pushes, comments or checkouts. All processes started by this audit exited; no tracked launch remains. Disk space remained above the 5 GB floor (233 GB on final check). Evidence is retained; nothing was deleted.

FRICTION:

other | The PR description still presents the older F01/F03 captures as current-path proof and omits the new four-row index | Link the refreshed capture index and updated audit matrix in the PR description.

VERDICT: SUFFICIENT