# Proof audit, pass 2

No blocking evidence findings. All six required runtime pairs are present and support their scoped claims. Independent R5 reproduction at the requested head has **zero normalized semantic delta** against the delivered after capture.

Reviewed [#22697](https://git.cafe/pingdotgg/t3code/pull/22697), mirror [#22698](https://github.com/pingdotgg/t3code/pull/22698), branch `fix/issue-22660`, head [27a924b004](https://git.cafe/pingdotgg/t3code/commit/27a924b004e2e67f15935c9e2c6981c3eb9e7af7), pinned base [6a6c84f990](https://git.cafe/pingdotgg/t3code/commit/6a6c84f9906cbdfa7f533fecfc39ce18c2f4c273). The local checkout is clean, the pinned base is the merge-base, and read-only `cafe pr view` confirmed that the current PR head/base and description match this scope. No merge-readiness or CI-watch verdict is implied.

**Provenance qualification:** all original after captures name [eb303fe4b6](https://git.cafe/pingdotgg/t3code/commit/eb303fe4b6458aa2091fbfcba2fcf66bbad3e1ec), not the requested head. This is correctly disclosed in the evidence and current PR body. I independently verified the complete intervening diff: only the committed driver, fixture and two extra error guard cases changed. Both production files are byte-identical. I accept this source equivalence for the six original rows, supplemented by the clean-head independent R5 execution; I do not represent the original captures as executions at the newer SHA. No runtime row is missing on that basis.

| Row | Status | Independently checked evidence |
| --- | --- | --- |
| R1 recovery | PASS | Before: two dispatches, completed/failed, no retry. After: four dispatches including fresh turn, three completed runs. Queue attempt 1, null maximum, 1000 ms, same complete confirmation payload across retries, exactly one successful confirmation response, completed retry item, successful fresh prompt. |
| R2 long busy | PASS | Before: first busy rejection fails without retry. After: 14 dispatches; attempts 1–12, delays 1/2/4/8/16/30/30/30/30/30/30/30 seconds; null maximum throughout; 241.060591302 seconds between first confirmation and accepted retry. Full payload equality, exactly one acceptance, completed notice and both runs completed. |
| R3 Stop in backoff | PASS | Before: follow-up already failed; actual subsequent Stop recorded as accepted. After: cancel frame, interrupted follow-up and retry notice, no failed run. Dispatch count stays 2 for 60.001703550 seconds; no prompt frame in the window; a fresh prompt then completes (3 total). |
| R4 Stop during dispatch | PASS | Before: failed follow-up, no in-flight retry, actual subsequent Stop accepted. After: third prompt held; cancel precedes the matching busy response from the same fixture PID/request ID. Interrupted run/notice without failure. Count stays 3 for 60.005398844 seconds; no prompt in the window; fresh prompt completes (4 total). |
| R5 old root thought | PASS + REBUILT | Before: failed follow-up and emitted late thought, no reasoning node attached in final projection. After: third prompt held, thought produces reasoning while run and queued notice remain running; no premature recovery. Final detail contains exact thought text, reply is persisted, both runs and notice complete. Independent clean-head R5 matches semantically. |
| R6 unrelated error | PASS | Both sides: two dispatches, completed/failed, original `Another internal error`, no retry item or successful confirmation. No retransmission through post-failure windows of 2.219756878 seconds before and 2.218419490 seconds after. |

Read the complete `/tmp/issue-22660/evidence-report.md` and the downloaded required matrix. Downloaded the published index, hash manifest, archive and all six paired NDJSON files afresh. Parsed every paired transcript, including manifests, persisted projections and ACP wire frames, rather than relying on row-result success labels. The matrix's original MISSING labels describe the pre-capture pass; the delivered pairs now satisfy those requirements. Viewports, themes, screenshots, two image diffs and pixel thresholds are inapplicable under the explicit server-only adaptation.

## Integrity

All downloaded bytes match the report/hash manifest:

| Artifact | SHA-256 |
| --- | --- |
| index.md | `31e7f28142bcace55f693b992837e3624ccf10baa93e41b2ccc57c7845b910fa` |
| R1-runtime-pair.ndjson | `4ede8e36e0ff986320f81108278c6e295669ae65a7572d222b1157bd1fc7ffe3` |
| R2-runtime-pair.ndjson | `8999fe1d54e43648693c53210ad0c508b0b564a563726631ab06449d291550ca` |
| R3-runtime-pair.ndjson | `61a04013105427983fb2ad226dccbfd7d62abd2cf787a6e27e46a85bdb17a787` |
| R4-runtime-pair.ndjson | `91c5a7c70f41c932e0f8e32c498275faf0f75541b13361cad2385c8f8e28f87f` |
| R5-runtime-pair.ndjson | `a3ee787eea18a4aef78e025703e6ec8658da2ceb6802939f217fd830a3f5a74e` |
| R6-runtime-pair.ndjson | `452f2a5ee515e153febe2c4253f12bad240cc50d227704879dadbc4bb5e9dab1` |
| runtime-evidence.tar.gz | `a9991bbd58081f905681849059f1c090c84b68090a8e8a18d81d61ed07aa78a1` |

Every pair has the expected full before/after SHA and identical fixture/driver hashes. Both archive copies of the executed scripts match committed head bytes:

- Fixture: `b6192ec4170dac12605100e985a7bc3f6616635faf797e2a55d142dba14df659`.
- Driver: `9dfec30fc47ac449e3a82832b1724ddedffcc35f6e8cf00722b7abe52854fae8`.
- Production `AcpSessionRuntime.ts`, equal at captured-after and head: `f33c0f19783cbb4cb6ed6d8b5a6d8cef7bac789b57e62e2ec66ecccf2f850a78`.
- Production `adapter.ts`, equal at captured-after and head: `67b8a4143e5b160ba5ed493c4c5c645a94869281007692f838ef3233256379f5`.

Archived scoped test/lint logs match the verification manifest hashes and report 105 tests passing across three files and successful targeted lint. I inspected these supporting results; I did not rerun the unit suites or scoped typechecks. The proof I independently executed is the real-server R5 lifecycle.

## Independent reproduction

From `/home/ubuntu/wt/issue-22660` at clean requested head:

```sh
node apps/server/scripts/verify-acp-busy-live.mjs --output /tmp/issue-22660/proof-2-rebuild --revision after --rows R5
python3 /tmp/issue-22660/proof-2-check.py
```

Driver exit 0. Same runtime environment: Linux 6.1.102 x86_64, Node v24.21.0, synthetic ACP v1 `t3-synthetic-busy-lifecycle` 1.0.0. Run began 2026-10-21T07:53:04.488Z. The driver launched the real source-mode server with explicit isolated base directory, loopback host, dynamically reserved port and existing desktop bootstrap FD. Authenticated OAuth exchange, WebSocket ticket/RPC, settings registration, project creation, dispatch and persisted projection/detail reads all used existing interfaces. No accounts or user credentials were needed.

Compared the delivered R5 after capture with the rebuild, retaining complete prompt content (including runtime instructions), final user/assistant message content, ordered run statuses, running gate reasoning status, running gate retry failure/title/attempt/delay, completed retry failure/title/attempt/delay, and exact final reasoning detail text. Normalized only session identity in prompt parameters and omitted generated identity/clock fields from the semantic projection. **Zero semantic differences.** The driver additionally asserted full retry payload equality within the rebuild. Generated UUID-derived thread/session/run/item IDs, trace/span IDs, PIDs, home paths, ports, absolute timestamps and monotonic clock origins naturally differ between independent real processes. Subscription snapshot counts and timing can vary with delivery scheduling; these are not user-visible semantic deltas. Wall clocks were not frozen; elapsed timing assertions were checked independently for the delivered long-busy/absence rows.

Rebuild artifacts: `/tmp/issue-22660/proof-2-rebuild/{manifest.json,transcript.ndjson,results.json,server.log,R5/wire.ndjson}`. Comparison script and detailed six-row results: `/tmp/issue-22660/proof-2-check.py` and `/tmp/issue-22660/proof-2-check-results.json`. Fresh downloaded evidence is in `/tmp/issue-22660/proof-2-downloads`.

## Claims, scope and cleanup

The complete production diff is confined to shared ACP busy rejection/retry/cancel lifecycle and retry-notice handling. It checks the exact request error tag, code -32603 and exact recorded message, preserves one request payload, caps backoff at 30 seconds without an attempt maximum, stops the queue through existing cancellation, and prevents old root output from recovering a busy-queue notice. Those claims agree with the evidence. Native non-ACP provider paths are unchanged; shared ACP consumers and existing client retry contracts require no new transport/permission entry point.

I read the complete new driver and fixture. They are standalone verification scripts using existing bootstrap/auth/RPC and local-provider settings, not edits to auth, permissions, modes, sandbox or MCP implementations. `full-access`/`default` select existing modes in launch data. The fixture redacts app-owned MCP configuration from recorded session/new frames; it does not implement or change MCP access. No production sensitive-surface change was introduced to make the capture work.

Current PR claims are supported within the stated exclusions. The finite R2 execution proves 12 retries and the stated real interval; the absence of an attempt limit is additionally established by the loop in the diff, not by pretending a finite transcript proves infinity. The old-output attachment delta is disclosed, and the retry notice may remain active while an accepted prompt answers. Actual oh-my-pi, Windows, other live ACP providers, client presentation, remote/relay/tunnel topology and restart durability remain unverified. This proof audit does not certify those surfaces or independently rerun the claimed prior review rounds.

The independent run stopped its captured server process group. I checked captured server PID 79188 and fixture PIDs 79848, 79849, 79862: all absent in `/proc`. No pattern-based kill, live-state writes, browser, screenshot, production edit, push, comment, review or forge mutation occurred. Only disposable isolated state and audit artifacts were created. PR registration with T3 succeeded using explicit host/repository/number after its singular URL form was rejected; the linked PR list confirmed registration. No further agents were used. Completed within the 60-minute budget.

VERDICT: SUFFICIENT