# Proof audit pass 2

PR [#23751](https://git.cafe/pingdotgg/t3code/pulls/23751), mirror [#23751](https://github.com/pingdotgg/t3code/pull/23751). Audited base [4eae8ae](https://git.cafe/pingdotgg/t3code/commit/4eae8ae011e2e56ca20159c13f3fb8a2ac49a991) against head [19f6543](https://git.cafe/pingdotgg/t3code/commit/19f654326598cc1f7411a56dbb07e651b6b5f254). Exact full OIDs are in provenance.json. Read-only app code; no real T3 data accessed, no installs, other machines/worktrees, browser, server, push, watch, PR-body edit or review publication.

Sufficient proof for the focused implementation and the explicitly qualified proposed takeover claims. No overall speedup is demonstrated. This verdict does not certify remote CI, historical author measurements, or untested transport paths.

Numbered evidence citations below refer to the existing runtime-capture/transcript-numbered.txt, independently verified against the source logs. Independent [rerun evidence bundle](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d0c3192ae347ca90/rerun-evidence.tar.gz) contains the exact rerun driver, output and provenance. The complete audit bundle also includes the referenced runtime capture and cleanup record.

1. **P01 — PASS.** verify.raw.txt (transcript lines 233–326) checks actual production SELECT flags for latest-only t0017, blocking-only t0013, both t0009, neither t0029. Both base/head full shell results are equal. plans-migrate.raw.txt (124–147) has exactly two partial covering-index stop_request searches in the full production SELECT plan.
2. **P02 — PASS core; optional malformed-data extension absent.** Same evidence covers missing requests, unrelated same-thread requests, other threads' unique run IDs, ordinary assistant items on matching runs. No deliberately cross-thread item carrying a different thread's valid run ID was seeded. The thread_id and run_id predicates are unchanged in both interrupt branches; the new index includes both keys and exactly the existing type predicate. That extra malformed-data fixture is not a required correctness gap for this diff.
3. **P03 — PASS.** verify.raw.txt (233–326): empty t0010 count 0; runless-only t0000 count 1; false interrupt flags and snapshot/getThreadShell equality at both refs. The complete no-run rows remain present.
4. **P04 — PASS.** plans-migrate.raw.txt (124–147) compares every thread's old/new counts, including completed/running/rolled-back/missing-run/runless cases and absent grouped rows normalized to zero. verify.raw.txt adds full active/global/project/empty snapshot equality, individual shell equality and exact fork-visible counts. Source review confirms identical missing-run NULL semantics: missing non-null runs are excluded, runless items count. Grouped counts apply to all recursively loaded source IDs as well as selected threads; per-run counts remain limited to fork sources.
5. **P05 — PASS core; fresh rolled-back-boundary differential capture absent.** verify.raw.txt (233–326) proves inherited runless prefix and boundary count 1303, nested fork 1704, archived source in another project, missing/deleted source and cycles. All selected individual shells equal corresponding snapshot shells at both refs; full results are unchanged. Existing ProjectionStore.test.ts lines 4847–4895 explicitly rolls back the fork's boundary source run and asserts source/target shell counts against the full projection. The per-run source count and inheritance algorithms are retained by this PR. This pre-existing shell-specific regression plus the new differential fork capture is sufficient; a fresh differential rollback-boundary variant would strengthen evidence but is not a missing core row. The separately reported final 41-test pass was supplied by the coordinator, not rerun here.
6. **P06 — PASS bounded workload; performance mixed.** seed log (1–123), augmentation (148), runtime logs (149–190), subscription logs (191–232), verify (233–326): 1000 total threads, 998 active nondeleted shells, 9002 runs, 903003 items, 650 threads with running runs. Complete decoded base/head results match. Warm medians are SELECT 136.16→44.72 ms; getShellSnapshot 208.59→219.65 ms; actual in-process initial subscribeShell 212.82→223.01 ms. Independently recomputed full snapshot/subscription medians agree with timings.json. Isolated interrupt 72.96→1.69 ms; isolated count medians 87.98→111.39 ms. Covering index use is proven; grouped counts are slower on this fixture. No repeat of the historical ~5000-active-thread workload, skewed provider/session/error/secret/pending-work population, reader worker scheduling, or history payload decoding is claimed or required for the qualified bounded-fixture conclusion.
7. **P07 — PASS.** plans-migrate.raw.txt (124–147): actual migration runner applies only 68 in 220.31 ms to 903000 existing synthetic items; second call returns [] in 4.42 ms. Item SHA256 remains 6e14bf65421d8d0e73188efbc35e189a81145cbc215d1b39aacaa73463cb8ca3. Index columns/predicate match migration source; both complete SELECT branches use it. Ledger gating, not idempotent raw CREATE INDEX, provides restart safety.
8. **P08 — PASS; independently rerun.** Captured preview evidence (327–685) covers preview53, preview54 with/without cleanup, injected failure rollback/retry, and unexpected-history rejection. I reran all five from the retained recipe at head with 1000 synthetic items per fixture and the actual head migration runner. Command: `node /tmp/ev-23751/proof-audit-pass2/preview.mjs`, subprocess budget 90 seconds, exit 0. New driver SHA256: 03c1bffb0b973d1df4cd40c6f0635bc6af0dd65af67024054168532d38ae4dd7. Only driver output directory changed; frozen head Migrations source copied byte-for-byte with its existing import resolution. Rerun timings: preview53 127.08 ms; preview54 no cleanup 272.28 ms; cleanup 14.99 ms; failure/retry successful upgrade 27.82 ms. Every successful lineage reaches exact head manifest, second run [], preserves imports/items/created_at, and obtains two index lookups. Failure rolls back schema/ledger/import; unexpected history is rejected without changing ledger. This is the same small fixture scale, not a 903k-item preview upgrade. Rerun Node v24.22.1 differs from capture v26.12.1; no timing comparability claimed. See rerun.stdout.txt, rerun.stderr.txt and provenance.json.
9. **P09 — PASS in-process boundary; transport excluded.** Initial actual ws.subscribeOrchestrationV2Shell handler frames (191–232) and subsequent committed/published metadata event (686–702) match base/head. Following thread.updated sequence is 1 and equals getThreadShell. I independently compared raw JSON bytes: snapshot SHA256 3cb488d99e844fdaf8f94e2a7212882f27a20a90ae9ced338fa6d298e2adc98c; initial subscription 609f9655592e8655c356ead4ed696ad1023b48cb87693eebe01b2a594c100875; initial+delta stream 38004d33053af50b65499b09995566f6755709a603423b96e94a9452b6929d44. These are handler stream items, not on-the-wire frames. No real WebSocket serialization/network/ACK, real project enrichment or remote/relay proof. Those paths and the wire contract are unchanged; no transport latency claim is made. Empty synthetic project service and ThreadManagement bridge are disclosed rather than treated as full deployed-service proof.
10. **P10 — PASS.** All 58 SHA256SUMS entries verify. All four original frozen source hashes match `git show` at the exact specified commits; transformed source hashes match sources.json. Transform inspected: absolute import resolution plus SELECT timing wrapper, no changed query semantics. All 705 transcript lines independently match their source-file line, driver hash, ordinal and full base/head IDs. Selected-source comparisons share unchanged head dependencies; five-file PR diff inspected. This is not a pair of independently built binaries. Before rerun free 18,747,822,080 bytes; existing synthetic DB total 420,659,200 bytes. Five new DBs total 5,591,040 bytes; after rerun free 18,742,132,736 bytes, comfortably within >=6 GiB and <=1.5 GiB limits. After successful evidence upload all five owned DBs and possible sidecars deleted immediately; cleanup.json records no owned DB remains. Other reviewers' DBs untouched. Final checkout remains clean at requested head.
11. **P11 — PASS.** Checked-in test requires exactly two SEARCH entries and checks the named partial index for each. Captured mutation evidence (703–705) accepts unchanged query and rejects independently forcing either branch onto old index. This mutates SQL plans, not the checked-in test; the limitation is explicit and the oracle matches the checked-in assertion.

PR-body claim audit: Cafe read only, explicit `--repo pingdotgg/t3code`; original description preserved, no edit performed. Observed description is saved in pr-observed.json. Remote source head still f7fa6e48e07e53466e80c017c15745d4dfa76706, so it does not certify requested local head. Original author trace (116.4s, nightly build), >8s interrupt abort, 3.018→0.236s counts and ~5000-thread affected database are historical attribution only. They were not reproduced, and must not be presented as current synthetic proof. Original check:changed/47 tests, previous takeover's 41 tests/main failure, old disk stops, previous backup incident and partial-handoff history likewise remain historical assertions; this read-only audit neither re-enacts nor newly certifies them. Current coordinator reports two reviewers each returning MERGE twice, 41 tests and typecheck passing; treated as supplied gate results, not this auditor's executions. This is a proof audit, not CI babysitting.

Proposed takeover claims are supported with these qualifications: shell semantics preserved on tested matrix; both interrupt lookups use new partial index; grouped counts retained with workload-dependent performance; exact listed timings supported by raw logs; migration/restart/preview and complete snapshots/initial+following handler stream equality supported. The original universal-sounding title and favorable historic count comparison must not be used to imply an overall speedup in this new capture. Keep original description intact and put the mixed results and limitations in takeover evidence. Prior takeover statements that runtime/audits remain incomplete describe earlier attempts, not this completed synthetic pass.

FRICTION: Cafe remote observation trails local head; stale local-main capture and head-without-index capture are explicitly excluded. Prior capture lists other harness corrections; none is evidence of a product bug. My rerun used Node24 instead of recorded Node26 and emitted the expected experimental SQLite warning. A reference-range helper initially requested compare.raw.txt, which is absent from the numbered transcript (its child logs are present); only range-printing failed after all 705 line checks and byte/median checks had already passed and been saved. Corrected range map uses the child logs. Shared-machine timing noise and populated OS cache prohibit cold-cache or universal-performance conclusions. No required correctness row remains missing; the unverified variants above are disclosed scope limits.

Audit: GPT-6.1 Sol through Codex; no children spawned. Evidence upload precedes owned DB deletion. Final verdict addresses proof at local requested head, not merge permission or remote CI.

VERDICT: SUFFICIENT