# Evidence index: takeover PR 19738

**11/11 affected matrix rows captured with controls.** Real base and replacement app bundles built and run; no tracked edits remain.

Scope: [#19738](https://git.cafe/pingdotgg/t3code/pulls/19738), [GitHub mirror #19738](https://github.com/pingdotgg/t3code/pull/19738). Base [c4fa4629eb](https://github.com/pingdotgg/t3code/commit/c4fa4629eb645b95aae2beef56c70f705b736049); replacement [9da6ba5f1f](https://github.com/pingdotgg/t3code/commit/9da6ba5f1fe6d66ecc4e734d38276451f0b9ab78); original [7cce90c](https://github.com/aravhawk/t3code/commit/7cce90c9b35e12fd9649cac4d4b3d11ae57c474c).

Linux x86_64 machine fs-03, Node v26.12.1; sole worktree `/home/ubuntu/wt/pr-19738`. Isolated fresh app home `/tmp/ev-19738`; explicit `--home-dir`, `--no-seed`, `T3CODE_DEV_SEED=0`. No live userdata was accessed. All fixture summaries come from a local external GraphQL preload; no real PR was created or modified. No browsers.

## Start here

[evidence-transcript.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/072b5dbe75449980/evidence-transcript.md) — commands, 11-row coverage, environment, limits, and FRICTION.

[base-transcript.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/281cbd0e1a9d41c2/base-transcript.md) — real base before/after capture: regression remains after four logical days.

[head-transcript.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/042c861a250f1acf/head-transcript.md) — replacement settles retention-off open link; retention-on and null-snapshot controls remain unsettled through completed sweeps; restart durability.

[replay.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/611a474b6e37945b/replay.py) — independent rebuild and capture, validated end-to-end for head.

[replay-validation.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1d1041ad28c05731/replay-validation.log) — successful rebuild, runtime, restart, and owned-PID shutdown validation.

## Results and boundaries

- Base unit suite: 23 pass, 2 expected regression failures. Head original suite: 25/25. Final supplemental suite: 33/33 including those original 25, with eight added external matrix tests. Selected lifecycle test: one pass; 86 unselected.
- Original base T0 completed sweep: 2026-10-24 23:57:56.807 UTC, D=3. Post-advance completed sweep: real 23:57:57.696, logical 2026-10-28 23:57:57.696, D=2. All three fixtures remain unsettled.
- Original head T0 completed sweep: 2026-10-24 23:58:17.640 UTC, D=3. Post-advance completed sweep: real 23:58:18.630, logical 2026-10-28 23:58:18.630, D=2. Only proof-open settles; link still open; settledAt/createdAt 23:58:16.347 UTC. Restart RPC assertions passed 23:58:47.832–47.872 UTC.
- Read-only active event store: base has zero settlements, head has one settlement with server:auto-settle command ID; no user-message/run/provider-turn activity. Full RPC and stored receipts included.
- What else changed: ignored server dist and test/build caches generated; dist rebuilt from head. No tracked files changed, no reset/new worktree, no commit/push/comment/watch. All observed owned PIDs exited; fixture port is closed. Real PR registered to this thread only.
- Unverified/N/A: no client rendering, provider turns, remote/tunnel pass, or wall-clock-minute runtime wait. These are unaffected or covered by focused deterministic tests; no affected matrix row remains outstanding. Reviewer MERGE/no-findings verdicts were supplied context, not refreshed here.
- FRICTION resolved: one-day minimum required external clock preload; GraphQL batch aliases require whitespace-tolerant parsing; readiness/direct command schema corrected; optimized bundle diagnostics corrected; process exit barrier fixed restart lock race; SQL extractor uses active event store. Optional external discovery/telemetry requests were blocked. Full details in the transcript.

## Rebuild one affected transcript

Download these files into the corresponding paths under `/tmp/ev-19738`: `replay.py`, `launch.py`, `await-ready.mjs`, `proof-preload.mjs`, `driver.ts`, `sql-evidence.py`, and `bin/gh` (the uploaded file is named `gh`). All are individually linked below. `replay.py` creates the node_modules symlink and generates private auth locally; no credential download is needed. Existing fixture state is archived inside `/tmp/ev-19738/archive`; it is never replaced with live state.

```sh
cd /home/ubuntu/wt/pr-19738
chmod +x /tmp/ev-19738/bin/gh
python3 /tmp/ev-19738/replay.py head
# Or: python3 /tmp/ev-19738/replay.py base
# Read replay-head-*.log, rpc.jsonl, diagnostics.jsonl,
# process lifecycle, and replay-head-sql.json for the new capture.
```

The final launcher waits on the actual spawned process group's PIDs through pidfd before restarting. It never kills by a name/path match. The real app creates projects/threads/links, syncs open summaries, enables settings, automatically settles, and persists the result. The driver never sends a manual settlement command or modifies persisted timestamps.

## All public artifact URLs

Local paths are relative to `/tmp/ev-19738`. Private auth, raw private server logs, databases, caches and compiled binaries are excluded. All seed/driver/preload scripts are public individually, uploaded using `ghdrop upload -m`.

- `proof-preload.mjs` — [proof-preload.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d1b9a44a3b9d96c0/proof-preload.mjs) (SHA256 `d49eff1ba133f61029ea13d38706f375f27cb29a7a2f6018f6842f8585092043`)
- `driver.ts` — [driver.ts](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5338d78f59fb823a/driver.ts) (SHA256 `b4676bb65e94e357f0a2c570a601b3aa2ceea4ca31e366364c9d5d1f33ebcaae`)
- `launch.py` — [launch.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/37ea0ae25d6dddfb/launch.py) (SHA256 `4d8a98a7991864e020b8145300747e2cd14444ba7eee139e3b550cf4ef1d7c9f`)
- `await-ready.mjs` — [await-ready.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8dfa45746d9eb860/await-ready.mjs) (SHA256 `aea6a169b660d4fbcc1565b99e2f4511a21f655361e3c8f4859559cbec9fea3a`)
- `bin/gh` — [gh](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/464e2b4d0ec801a3/gh) (SHA256 `44ceceee9f405f308f4c48deee11564701c0a5330b142830bcfdd9ba46dd3820`)
- `replay.py` — [replay.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/611a474b6e37945b/replay.py) (SHA256 `b931a398a64f9f86040bf1344cae1fae2a75d7a764ec62761a53f3ab602c0238`)
- `sql-evidence.py` — [sql-evidence.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/facaed3f8adebad5/sql-evidence.py) (SHA256 `c44fff9c97c0aac0f53100b48163d2799b33f90967bef9cc2ae57611ec5bd893`)
- `supplement.test.ts` — [supplement.test.ts](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7d532354cbf4e839/supplement.test.ts) (SHA256 `cbca1b80b45421b0c0f3175223bd37df259c9c79eafd45e92b18b9248946197c`)
- `vitest.config.ts` — [vitest.config.ts](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/866dcb47993e7a0a/vitest.config.ts) (SHA256 `97389e7995fc0623904db3d6ffe63c88eca8f632482ab76801c6d7ed72c61f9e`)
- `base.ts` — [base.ts](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/fd8e887dbb8d0114/base.ts) (SHA256 `f9e5a968fb46bf0e8463847b4b29f1260aa066579e853ae061156a01d8376677`)
- `head.ts` — [head.ts](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/eceb13cd63116891/head.ts) (SHA256 `d75c8d48aa001bcb82152cd618a2544a1ef3353ae134354d03cdbc4693487355`)
- `manifest.json` — [manifest.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/500087ed6ccccafb/manifest.json) (SHA256 `0530df0ea5c2cc5648d719c4021bea897e79b36862b3454e8f17d6b743499343`)
- `evidence-transcript.md` — [evidence-transcript.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/072b5dbe75449980/evidence-transcript.md) (SHA256 `61ff0f63bd5500c02f073b6942e7d1b0b5f974bbb5b42d7342191aeaabebf8c7`)
- `base-transcript.md` — [base-transcript.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/281cbd0e1a9d41c2/base-transcript.md) (SHA256 `bb8fbe1c80ac0d609db3d4f4794500da50b4ea55b8f2c88fd0e43b08c207db62`)
- `head-transcript.md` — [head-transcript.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/042c861a250f1acf/head-transcript.md) (SHA256 `9ae90e78fb838c4a315855bb33fa8278a34ebad396ec8c44b6cbd76102d8444d`)
- `base-rpc.jsonl` — [base-rpc.jsonl](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8d2b864e36f0f77d/base-rpc.jsonl) (SHA256 `55dc332b55f3a518553b70d28b95c136342cb6d57995812ad7f062538d929084`)
- `head-rpc.jsonl` — [head-rpc.jsonl](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/24061abd4c6e8df1/head-rpc.jsonl) (SHA256 `922c2b77a9ad08e2450a835ad31ab86131019135ec183ed7a9544eadb83071ee`)
- `base-diagnostics.jsonl` — [base-diagnostics.jsonl](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1a31ed564f7b8bcb/base-diagnostics.jsonl) (SHA256 `32d1f42f983bca4993346b6a35fc3c3f7863501c2c61b25e4f6cbadca9ac9ea1`)
- `head-diagnostics.jsonl` — [head-diagnostics.jsonl](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8dae42fb18f9cd7d/head-diagnostics.jsonl) (SHA256 `15f8620006e5153700a2b51466dbed7cd953f13134858f945ec0e6f27c4fad50`)
- `base-sql.json` — [base-sql.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e3b571034514bb1e/base-sql.json) (SHA256 `3e4c514773aab9c38839ff0f47520fa504c93a8062b357d6921d213b31e815a5`)
- `head-sql.json` — [head-sql.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e669ea7149c94559/head-sql.json) (SHA256 `f9559b823ef5acb1dec9036d7a489f4c396758eab6da1248a018ce1172ecbd5f`)
- `base-server-sanitized.log` — [base-server-sanitized.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/62cc34504b90e358/base-server-sanitized.log) (SHA256 `0b53d7598e908fe99133b935a4e038f4406ff291553e23ec403a2f1423bbb411`)
- `head-server-sanitized.log` — [head-server-sanitized.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/821c9d938bc4f633/head-server-sanitized.log) (SHA256 `5b2c414be2bedcf9470ff9e90d7ea14ecfbebee17ff602b23437b14cc351493c`)
- `tests-base.log` — [tests-base.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3eb1794fb7662369/tests-base.log) (SHA256 `b0d159dd4db751c8de7c9f156f4768c9f469deb47470dfa8a21c3755374d5bea`)
- `tests-head.log` — [tests-head.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b5d39f82902024f9/tests-head.log) (SHA256 `08570645be669a9410e39ee2bbc453ce8064b6ee72dd0bcf9f27355def2953b8`)
- `supplement-head.log` — [supplement-head.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6157bc299ac4b9c5/supplement-head.log) (SHA256 `4a82de37e07f8353d33d7f59d84a0349fcedd91c90ff7ab3d5166cdf5f824967`)
- `lifecycle-head.log` — [lifecycle-head.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4b093ca03864dc39/lifecycle-head.log) (SHA256 `c20eecc3f9802cc087e5a0f0e197eabee951773b8d9e128fb353a4ce3e099cac`)
- `build-base.log` — [build-base.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/679e55b84727d211/build-base.log) (SHA256 `bb21bef38f3fc638ed54dc35d3dd53ed96e35a985954c597846adf3354a5e7d6`)
- `build-head.log` — [build-head.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/66c742983830af35/build-head.log) (SHA256 `24b87df4a37c7611d7907612b4771446da3bfb9d081ae9f8e732ad31d84741d4`)
- `build-head-restored.log` — [build-head-restored.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6ee7da92bd9f0f4c/build-head-restored.log) (SHA256 `9d10f5dd013a6e170661949a663bf68cbe4332ed99c8ae10315b2d3817434a47`)
- `replay-validation.log` — [replay-validation.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1d1041ad28c05731/replay-validation.log) (SHA256 `721af3fc74f47f3b337a525d277110d5f6faa9fdafae330517db7860c871aa36`)
- `replay-head-sql.json` — [replay-head-sql.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/aa23b752862a3496/replay-head-sql.json) (SHA256 `1bc1911fed2937fe6d736592975044d25cc751057f4af5fdd202c768efd4f4ad`)
- `process-lifecycle.jsonl` — [process-lifecycle.jsonl](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/75636d5de7de04f3/process-lifecycle.jsonl) (SHA256 `579b72a729ca0e3c82f1550293938f0ce8af1bf0ee264659a92ead3f67bbf2b4`)