# Proof audit, pass 2b — R12 re-check

No remaining R12 evidence blocker. The recapture closes the earlier finding: it observes the fifth service-owned fetch inside the real semaphore's wait queue before caller interruption or service shutdown.

The known aggregate shutdown target miss remains: 4087.134 ms before and 4083.752 ms after exceed the matrix's proposed 1000–2500 ms. The raw events show four serial ~1-second TERM-to-KILL intervals on both revisions. This is disclosed pre-existing parity behavior, not a new regression or a claimed speed improvement.

Reviewed PR [#26601](https://git.cafe/pingdotgg/t3code/pull/26601), before [30eb7e7bb1](https://git.cafe/pingdotgg/t3code/commit/30eb7e7bb1ef103fdd6f54081b6a4acf66b3ee4c), after [3c6d27fa7c](https://git.cafe/pingdotgg/t3code/commit/3c6d27fa7c98ab98a23463891452f761aedbdea8). Refreshed GitCafe metadata confirms source branch `fix/issue-26577`, target `main`, and the full required head. Computing the merge-base against the PR's observed base yields the required full before SHA. The newer local `main` was not substituted.

## R12 integrity and behavior

Read the [recapture transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5ea3d025acd9f24b/R12-transcript.md), both complete selected raw event streams and results, invocation logs, failed observer-bootstrap log, environment records, clean status files, process checks, uploaded driver and fixture, the production fetch/cache path, and installed Effect semaphore/process-spawner code. The archive's initial failed attempt has only its environment event and fails before any fixture git command starts; it is not used as passing evidence.

The uploaded driver SHA-256 is `c0371bd935db8fce6da4b0961271b5000df4e885989b86d35a0f83ea773b3e20`; fixture SHA-256 is `f7f10c819bdb0bbb8a004b05d04b205406b9b64b11e0e9fbfc128f8a39454cf9`. Both match both selected environments. Full head/base SHAs match the brief. All 82 quoted JSONL events (41 per revision) are exact members of the respective 226-event raw streams, in monotonic order. Result payloads match their logged RESULT events after excluding the outer event kind/timestamp; results.json retains the final SNAPSHOT kind/timestamp because the driver spreads that snapshot into the summary. Headline values and table counts agree with raw data. Both supplied invocations select and pass one capture test.

The layer is `GitVcsDriver.layer` (calls `makeGitVcsDriverCore`) with `NodeServices.layer` and `ServerConfig.layerTest`. The observer passes the original command to the native spawner and returns its native handle; process.kill observation delegates the original function. The semaphore prototype wrapper returns native `withPermits` unchanged. Its Set.add/delete observers first perform the real Set operation, then log. No replacement scheduler, clock, platform, permit accounting or process handle is used; tracked source and dependency files are untouched. The Python fixture installs its TERM handler before READY, uses real IPC and native sleep only for its bounded natural lifetime, and supplies real local upload-pack transport.

Installed Effect's `waitForPermits` inserts into the Set only after finding insufficient free permits; it removes a cancelled waiter from the same Set. The span chain identifies `capture.R12.caller4` inside `GitVcsDriver.fetchRemoteForStatus.wait`. Production code resolves upstream/common-dir and calls Cache.get before forking the service-owned fetch. This is an actual fifth fetch waiter past repository preflight, not a requested caller labelled queued.

| R12 observation | Before | After |
|---|---:|---:|
| Fifth native queue insertion, ms | 847.629 | 859.565 |
| Service close requested, ms | 861.322 | 871.764 |
| Waiter removed, ms | 861.863 | 872.109 |
| State at insertion | 4 taken, 0 free, 1 waiter | 4 taken, 0 free, 1 waiter |
| State at removal | 4 taken, 0 free, 0 waiters | 4 taken, 0 free, 0 waiters |
| Caller-only interrupt, ms | 0.937 | 0.893 |
| Live helpers after caller interruption / service close | 4 / 0 | 4 / 0 |
| Fetch-group TERM / KILL counts | 4 / 4 | 4 / 4 |
| Scope close, ms | 4087.134 | 4083.752 |
| Fetch spawns / fifth fetch spawns / fifth READY | 4 / 0 / 0 | 4 / 0 / 0 |
| Independent pooled probe | 1/1 succeeds | 1/1 succeeds |
| Final waiters / markers / live recorded PIDs | 0 / 0 / 0 | 0 / 0 / 0 |

No active fetch group receives TERM before service close. Caller interruption preserves all four writers and the fifth waiter. Removal with all four permits still taken proves cancellation before any slot becomes available; the fifth never spawns through RUN_COMPLETE. Every active fetch group receives TERM then KILL. Supplied post-run checks record 50 driver/fixture PIDs per run, zero live recorded PIDs/group members, no lock files, and clean head/base worktrees.

## Independent reconstruction

On the same `fs-40` machine at the exact required head, ran the uploaded driver with the unchanged fixture. The sole driver change relocates `const scratch` from the lead's capture directory to `/tmp/lead-26601-r1/audit-pass2b`; the one-line diff is archived. Auditor driver SHA-256: `d0bde084e7d43e9ed2b925559da080c6c46284875b110143ffdaf10bf67ca537`.

From the head worktree's apps/server:

```sh
GIT_CONFIG_GLOBAL=/dev/null vp test run src/vcs/scratch26601.auditpass2b.test.ts
```

One test passed, total invocation 6.73 seconds. Environment: Linux 6.1.102, Node v26.13.0, Git 2.43.0, platform-node-shared 4.0.5, 4 available CPUs. The recorded environment contains the full required head SHA.

Service close was **4097.218 ms**, versus delivered head **4083.752 ms**: **+0.329746%**, within the 25% threshold. All compared count/outcome fields agree: fetch spawns 4, fifth spawns/READY 0/0, fetch-group TERM/KILL 4/4, post-caller live helpers 4, final live helpers/markers/waiters 0/0/0, independent probe succeeds, and interrupted caller Exit is identical. Auditor queue insertion 878.681 ms precedes service close request 892.073 ms; queue removal 892.527 ms still has 4 taken and 0 free.

Post-run /proc inspection covers 50 driver/fixture PIDs plus the 4 separately recorded shell-parent PIDs and all four fixture groups: zero live non-zombie processes, zero live group members, and zero remaining lock files. The test process exited and IPC server closed. The temporary untracked driver was removed; `git status --porcelain` is empty and `git diff --exit-code` succeeds. No browser, application server, emulator, lease or extra worktree was started. No production/test source, commits, PR comments, PR body or refs were changed. The lead's scratch root and worktree are preserved; only this auditor's step directory is removed after uploading.

## Full row status

R01–R11, R13 and R14 are carried unchanged from the [earlier pass-2 audit](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ce5dbb3362edabb2/audit-report.md); this pass independently re-checks only R12.

| Row | Status | Basis |
|---|---|---|
| R01 | SUFFICIENT | Carried: one selected red/green regression per revision. |
| R02 | SUFFICIENT | Carried: eight timeouts, queued error/success worktree variants, solo controls and recovery. |
| R03 | SUFFICIENT | Carried: omitted/30000 pooled; 31000/null bypass; recovery. |
| R04 | SUFFICIENT | Carried: native 31000 ms deadline, TERM/KILL and bypass probe. |
| R05 | SUFFICIENT | Carried: default and null cancellation with interrupted Exits and recovery. |
| R06 | SUFFICIENT | Carried: real index.lock cleanup, cooperative TERM and subsequent commit. |
| R07 | SUFFICIENT | Carried: normal/error leaf completion, output/error preservation and probes. |
| R08 | SUFFICIENT | Carried: zero/nonzero exited leaders and surviving-descendant cleanup. |
| R09 | SUFFICIENT | Carried: overflow cleanup and naturally completing truncation control. |
| R10 | SUFFICIENT | Carried: coalesced fetch outlives both five-second callers. |
| R11 | SUFFICIENT | Carried: native 300-second safety timeout, escalation, cooldown and freed-slot fetch. |
| R12 | SUFFICIENT | New audit: actual fifth semaphore waiter, caller isolation, scope cancellation, four-group cleanup, no fifth spawn; independent rerun +0.330%, identical counts. Known serial ~4.1-second parity retained. |
| R13 | SUFFICIENT | Carried: queued pooled caller cancelled with zero spawns and 8/8 recovery. |
| R14 | SUFFICIENT | Carried: linked-worktree config writer serialization and actual successful write. |
| R15 | cannot-verify windows | Accepted limitation; no Windows runtime claim. |

Native macOS remains `cannot-verify macos`, accepted by the brief. Screenshots, viewport and theme are N/A for this server-only proof. Optional “Preparing workspace” UI corroboration could use an isolated real-client thread launch with the same server's git pool saturated; it is not required by this R12 re-check and was not exercised.

FRICTION:
- policy | The execution guard rejected literal-path `rm -f` for the authorized temporary driver, despite the brief allowing it; removed it with literal-path Python Path.unlink instead | align deletion policy with the documented scratch-cleanup command, or document the Python fallback.

VERDICT: SUFFICIENT