# PASS2 final-head proof audit

No blocking proof findings. **11/11 groups and 20/20 route-expanded obligations are SUFFICIENT** for [#21092](https://git.cafe/pingdotgg/t3code/pulls/21092) ([#21092](https://github.com/pingdotgg/t3code/pull/21092)), at final takeover head [83ef5cf0b6](https://github.com/pingdotgg/t3code/commit/83ef5cf0b67c915b0db262e8089c84c6eb71a669) against main/base [3cc31ed27c](https://github.com/pingdotgg/t3code/commit/3cc31ed27c8956b36cee35a50509fb7c6869592b).

Full head: `83ef5cf0b67c915b0db262e8089c84c6eb71a669`. Full base: `3cc31ed27c8956b36cee35a50509fb7c6869592b`. Workspace `/home/ubuntu/wt/pr-21092`, branch `takeover/pr-21092`. Original [AnobleSCM/t3code](https://github.com/AnobleSCM/t3code), branch `fix/15542-retry-locked-event-write`.

This verdict validates the pinned implementation with main merged into it; it does not assert that the pull request has landed or replacement CI is green. Replacement CI remains outside this proof audit. Prior findings/resolutions remain nonblocking. The prior [SUFFICIENT verdict](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/75686f9b4f2c7063/verdict.md) was read and its interpretation limits retained.

| Obligation | Result | Final paired evidence verified |
|---|---|---|
| P | SUFFICIENT | Real lock recovery at attempts 2 and 3; production 5000ms pair included. |
| R+ | SUFFICIENT | Matching stored run/status/attempt commits once after recovery. |
| R0 | SUFFICIENT | Missing run, wrong status, wrong attempt separately no-op; holder supersession is rechecked after retry and commits/publishes nothing. |
| O+ | SUFFICIENT | Matching joined owner/run/ordinal; late provider-thread update commits once after recovery. |
| O0 | SUFFICIENT | Missing join, wrong attempt, wrong ordinal separately no-op; concurrent ordinal supersession is rechecked and commits/publishes nothing. |
| S+ | SUFFICIENT | Primary committed before holder acquisition at secondary boundary; only model write retries; one primary and one model event; explicit model options checked. |
| S0 | SUFFICIENT | Origin/null/missing-model/missing-child/equal/locked-recheck branches skip secondary write; repeats add no durable model event or selection change. |
| L-P | SUFFICIENT | Before one attempt; after exactly three actual lock failures, no target event. |
| L-R+ | SUFFICIENT | Matching guard; same three-attempt exhaustion, no target event. |
| L-O+ | SUFFICIENT | Matching guard; same three-attempt exhaustion, no target event. |
| L-S+ | SUFFICIENT | Three secondary failures; primary retained; no model event. |
| E-P | SUFFICIENT | Real scoped SQLite ABORT trigger yields ConstraintError; one attempt. |
| E-R+ | SUFFICIENT | Same non-lock failure at matching run boundary; one attempt. |
| E-O+ | SUFFICIENT | Same non-lock failure at matching owner boundary; one attempt. |
| E-S+ | SUFFICIENT | Secondary non-lock error stops immediately; primary retained. |
| M-P | SUFFICIENT | Before stops at first lock; after lock then real constraint stops at attempt two. |
| M-R+ | SUFFICIENT | Same sequence at matching run boundary; no third attempt. |
| M-O+ | SUFFICIENT | Same sequence at matching owner boundary; no third attempt. |
| M-S+ | SUFFICIENT | Same secondary sequence; primary retained, no model event. |
| C | SUFFICIENT | Four unlocked controls unchanged; empty normalization writes nothing; owner guard takes priority in both directions without fallback. |

E also covers explicitly injected non-SQL and absent-cause failures at each route. M includes separately labeled injected lock-then-non-SQL cases. None of those synthetic errors were accepted as real contention proof.

Downloaded and read the [final index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1328d84b41fa5cb1/index.md), [matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b01f933f14fce6c2/matrix.md), [short pair](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d0cc99725bbff478/before-after.md), all 11 row proofs, full transcript, raw traces/results, public driver/holder/scripts, source provenance, environment, cleanup and test logs. All 34 indexed downloads matched their delivered local copies. All 112 readable row sections match the complete transcript. Parsed all 716 raw records and cross-checked all 112 summary results, revisions, attempts, errors, durable/publication IDs and order, projections and model selection.

Independently confirmed that old main to current main and old takeover head to final head leave orchestration-v2, persistence and nodeSqliteClient byte-identical. Final base-to-head diff is still exactly ProviderEventIngestor.ts and its existing test. Exact before-source bytes and published source/driver hashes match git objects/provenance. Thus the exact base ingestor runs alongside unchanged relevant head dependencies.

Independent replay used the **downloaded public final driver**, not the delivered runtime output. Only its single scratch constant changed from `/tmp/ev-21092-capture-final` to fresh `/tmp/ev-21092-proof-final`. No revision, case, behavior or assertion substitutions were made. Holder bytes were unchanged. The uploaded replay script hardcodes its occupied capture path, so a separate disclosed wrapper installs the downloaded driver and independently obtains base source with git show. Uploaded summarization/packaging scripts were inspected; the independent audit uses its own parser instead of accepting their conclusions.

```sh
bash /tmp/ev-21092-proof-final/run-replay.sh
# Within that wrapper, from /home/ubuntu/wt/pr-21092:
# git show 3cc31ed27c8956b36cee35a50509fb7c6869592b:apps/server/src/orchestration-v2/ProviderEventIngestor.ts > apps/server/src/orchestration-v2/EvidenceBefore.ts
# vp test run apps/server/src/orchestration-v2/EvidenceCapture.test.ts
# vp test run apps/server/src/orchestration-v2/ProviderEventIngestor.test.ts
python3 /tmp/ev-21092-proof-final/audit.py
```

Independent runtime: **112/112 passed**, 41.10s. Focused suite: **28/28 passed**, 10.53s. All 112 delivered/replayed semantic outcomes match: attempts, primary-write counts, success/failure, returned/persisted/published event types and counts, error chains, projected run/turn/owner state and child model/options. Random IDs, timestamps, PIDs and scratch paths differ as expected. Public driver SHA256: `bd571ecdd3f9545a5e6aaa803e9511e88404ba1223730e07d17ffb2517797fde`.

Independent representative at production busy_timeout=5000ms:

| Observation | Before | After |
|---|---|---|
| Holder acquired to first observed real lock failure | 5.009257s | 5.009780s |
| Target write attempts | 1 | 2 |
| Outcome | ProviderEventPublishError | Success |
| Target returned / persisted / published | 0 / 0 / 0 | 1 / 1 / 1 |
| Target turn projection | Absent | completed |

The real separate Python SQLite process acquires BEGIN IMMEDIATE on the same file; release follows an observed actual error through IPC. Real errors carry EventSinkWriteError → direct SqlError → LockTimeoutError. Supporting cases explicitly use 75ms on the server writer connection. No injected fault satisfies a real-lock row. All 38 holder processes in each capture acknowledged acquired/released/closed and have exited. The subscriber is ready before each initial ingestion and drains through Deferred completion markers; initial publication IDs/types equal durable IDs/types in order without duplicates.

**Publication limit retained:** explicit repeat calls run after subscriber interruption. They verify durable model-event count and unchanged selection only, not repeat-call subscriber delivery. Fixture run remains running even when the provider-turn projection completes; this proves event-write recovery, not whole-run recovery.

**Pixel delta: N/A — server-only runtime transcript exception.** No UI/browser/provider CLI, whole-run/turn-start persistence, orphan cleanup, failed-COMMIT recovery, cancellation batches, client transport delivery, or unchanged warning-only branch metadata follow-up is claimed. Source confirms the narrow lock predicate, two-retry bound, transactional guard rechecks and commit-before-publication.

Independent audit/replay artifacts:

[audit-results.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5e2cf71d61b54938/audit-results.json)
[row-results.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c61839464fc63e33/row-results.json)
[runtime.jsonl](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/de2cd9e01a593ac1/runtime.jsonl)
[runtime-tests.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a664c5a485959dab/runtime-tests.txt)
[focused-tests.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a3ef6a3fd6912b07/focused-tests.txt)
[run-replay.sh](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d82c27f33522d3b6/run-replay.sh)
[audit.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/77a66f415a5082fa/audit.py)
[download-results.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e61b14617609dfaf/download-results.txt)


Cleanup: both temporary adjacent source modules removed by EXIT trap; checkout clean at the pinned final head; all replay holders exited. No tracked source edits, commit, push, PR comment, watch, merge, browser, dev server or live userdata access. All retained audit scratch material is outside the worktree.

FRICTION category|problem|prevention

- tool|No blocking tool failure; ghdrop publication succeeded.|Retain public artifact links and byte-check downloads.
- brief|Repeat durability can be mistaken for repeat subscriber evidence.|Keep the initial-ingestion publication limit explicit.
- runbook|Public replay hardcodes an already occupied scratch directory.|Use a fresh wrapper and disclose the sole driver path substitution.
- infra|Synchronous SQLite waits need independent lock release.|Preserve separate-process IPC milestones and label 5000ms versus 75ms.
- forge|Replacement CI is separate from this pinned proof verdict; thread metadata still describes the original contribution branch.|Do not infer replacement CI or landing from original-branch metadata; no forge mutation was performed.
- policy|UI evidence is inapplicable to these server-only boundaries.|Use the requested runtime transcript exception; no browser launched.
- model|No blocking model friction.|Use full SHA bindings and independently compare every semantic row.
- other|Audit cleanup initially ran before the focused suite wrapper exited; its temporary modules were still present.|Wait for captured replay completion, then rerun cleanup audit; final audit passed cleanly.

Audited by GPT-6.1 Sol through Codex in T3 Code. Publication uses the [ghdrop skill](/home/ubuntu/.codex/skills/ghdrop/SKILL.md).

VERDICT: SUFFICIENT