# Final proof audit — PASS2 correction round 3

The corrected evidence resolves both remaining P2/P3 objections. No implementation blocker found. This is a pinned proof audit, not a new CI or live-PR readiness check.

Reviewed takeover [#8668](https://git.cafe/pingdotgg/t3code/pulls/8668), mirrored [#8668](https://github.com/pingdotgg/t3code/pull/8668), in `/home/ubuntu/wt/pr-8668` only: branch `takeover/8668-linux-launcher`, replacement [f42e44a](https://github.com/pingdotgg/t3code/commit/f42e44a1e5b3508add3ab8818e0b8e3956e39a57), baseline [3cc31ed](https://github.com/pingdotgg/t3code/commit/3cc31ed27c8956b36cee35a50509fb7c6869592b). Original submission [fa3d27b](https://github.com/limwa/t3code/commit/fa3d27bf1c1fd2a7d42f3afacbb98efebedef488). HEAD and clean tracked status verified. The full six-file diff is 48 insertions/2 deletions; all six files remain identical to previously reviewed [c5e3300](https://github.com/pingdotgg/t3code/commit/c5e3300). No auth change is part of this patch.

## Prior findings and their resolution

The [prior PASS2 audit](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8534c588fb1a6093/proof-audit-pass2.md) found the code and delivery proof sound, but rejected P2/P3 because the claimed empty post-start queries contradicted nonempty output, the initial pre-app queries were absent, and normal-writer registration side effects were not independently attributed. Its insufficient-proof verdict is superseded by this audit for the corrected evidence set; its older transcripts and limits remain historical evidence.

The correction openly abandons the faulty fixture expectation that queries must stay empty. That expectation was never the launcher implementation requirement. The implementation requirement is that the normal Linux writer writes its entry and returns before its own MIME registration when unpackaged. Existing Clerk startup registration is separate. This correction changes the interpretation and proof precision, without changing implementation scope or excusing a regression.

I read the actual eight accepted `*-default-proof` transcripts, the capture/session/verification drivers, private default-file snapshots, early/final desktop bytes, relevant source, pinned bundle lines and Clerk source-map contents. I independently parsed and asserted the runtime facts rather than accepting driver PASS booleans. The earlier `*-default-correction` and `*-default-attribution` pilots are explicitly excluded; they are not passing rows.

The [corrected index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f08c3674be3dba74/index.md), [correction report](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e74cf3d738780180/default-correction-report.md), [matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4507978f3c097bed/matrix.md), and [source review](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e5d02a66352c4c29/source-review.md) agree on this distinction. The index expressly retracts the false P2 summary and attributes the default file to OAuth. The matrix marks its obsolete no-captures/incomplete prose historical; its current P2/P3 rows require normal-writer-specific proof. Do not quote the old plan's status paragraphs as the current outcome.

## Verified temporal sequence in all eight retakes

1. Both scheme queries return empty before app launch, with private MIME-default snapshot `{}`.
2. The actual early writer has produced a complete desktop entry while Electron is not ready. Before Clerk's registration call, both schemes are queried again: the relevant scheme returns the generated filename, the other remains empty, and private MIME-default files are still absent. The installed xdg-mime fallback scans desktop MimeType entries. Its recorded source/hash matches the installed utility; nonempty inference is real and is not relabeled empty.
3. The inspector pauses at the actual `electron.app.setAsDefaultProtocolClient(options.renderer.scheme)` call, reads its scheme and original PID, and steps over it. Only then does `config/mimeapps.list` appear, with the corresponding Default Applications and Added Associations entries. This is explicit whole-app registration.
4. The normal writer is subsequently reached at the actual desktop-entry read. Its locals show the correct target and development flag, `isPackaged=false`, and complete content equal to the early file. At its actual `if (!environment.isPackaged) return` guard, the recorded return condition is true; stepping out returns to the Effect caller. The registration-helper observation breakpoint resolves to the real helper body, and its call array remains empty through app readiness.
5. Snapshots after OAuth, at normal return and after readiness/before manual setup are byte-identical, including independently verified SHA256 of MIME contents. Early/final desktop entries also match byte-for-byte and validate successfully. The transcript's initial-to-readiness `DEFAULT FILES UNCHANGED BEFORE MANUAL False` is correct and retained, because OAuth changed the file.
6. Post-start queries remain nonempty for the relevant scheme. Only afterward does the marked manual dispatch prerequisite run. Exact URI delivery is credited solely to the original-PID second-instance event, not xdg-open exit status or wrapper argv alone.

Source confirms the order: [DesktopApp startup](https://github.com/pingdotgg/t3code/blob/f42e44a1e5b3508add3ab8818e0b8e3956e39a57/apps/desktop/src/app/DesktopApp.ts#L308) configures Clerk before readiness and invokes the Linux writer later; [the Linux registration guard](https://github.com/pingdotgg/t3code/blob/f42e44a1e5b3508add3ab8818e0b8e3956e39a57/apps/desktop/src/app/DesktopLinuxUrlHandler.ts#L299) precedes icon/database/default helpers. Both pinned source maps embed identical Clerk module bytes, SHA256 `834be351cbb6ed3f98d76d58c3c4010d6cc5b6b09297dc2d033bdbbbf7b2be0e`, including the real registration call. All eight OAuth and normal breakpoint locations independently match their respective bundle lines.

The proven claim is **no explicit registration by the unpackaged normal Linux writer**. **No explicit registration by the whole app is false.** Snapshots establish the measured boundaries; they are not a continuous syscall trace or a universal claim about every startup subsystem.

## Accepted correction fixtures

Every row below passes initial/pre-OAuth/post-start query checks, five snapshot checks, source-line checks, real unpackaged return, zero helper observations, early/final byte equality, validation and reap checks.

| Transcript | Original PID | Exact URI delivery |
|---|---:|---|
| [before S1 production](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a5dc3b79bdde81c0/before-S1-unpackaged-default-proof-transcript.txt) | 2548293 | No; expected shared-Electron missing-app fallback |
| [before S5 production](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2283a702dadff0e4/before-S5-unpackaged-default-proof-transcript.txt) | 2549250 | No; expected fallback |
| [before S1 development](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6e3bb2f5700a8762/before-S1-development-default-proof-transcript.txt) | 2550424 | No; expected fallback |
| [before S5 development](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5177bb5d98ab6222/before-S5-development-default-proof-transcript.txt) | 2551215 | No; expected fallback |
| [after S1 production](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/33b88f6b9feec175/after-S1-unpackaged-default-proof-transcript.txt) | 2552006 | Yes; exact URI at 23:05:37.770Z |
| [after S5 production](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0b3422c0736d2e2b/after-S5-unpackaged-default-proof-transcript.txt) | 2552927 | No; expected fallback |
| [after S1 development](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2480b2bf02b3c930/after-S1-development-default-proof-transcript.txt) | 2553890 | Yes; exact URI in original PID |
| [after S5 development](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/10a41aa853a8146f/after-S5-development-default-proof-transcript.txt) | 2554713 | No; expected fallback |

All eight public transcripts and every link in the [correction inventory](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9b5d39bb053f5b38/default-proof-driver-inventory.md) were downloaded successfully with curl and compared byte-for-byte to local artifacts. Including the four corrected documents, 98 public artifacts matched. [Independent fixture checks](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f46b1b059e375b0f/final-independent-checks.json); [public artifact hashes](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/bd54d1238a598761/final-public-checks.json).

## Complete final matrix status

Prior PASS2 independently inspected all 47 accepted earlier fixtures, 122 entry artifacts and 2,811 hashes/source-map associations, rebuilt the replacement identically and reran 19 tests. Those unaffected results are reused, not represented as rerun in this round.

| Row | Final status | Meaning / limit |
|---|---|---|
| S1 | PASS | E → trimmed L; quoted internal-space launcher; shared-runtime before failure/after delivery |
| S2 | PASS | A → L; override outranks APPIMAGE |
| S3 | PASS | E → L; whitespace and explicit empty APPIMAGE aliases |
| S4 | PASS | A → A; launcher unset |
| S5 | PASS | E → E; both unset; packaged control succeeds, shared-runtime fallback remains expected failure |
| S6 | PASS | E → E; whitespace/empty APPIMAGE |
| S7 | PASS | A → A; empty launcher |
| S8 | PASS | E → E; empty launcher, APPIMAGE unset |
| S9 | PASS | E → E; empty launcher, whitespace/empty APPIMAGE |
| S10 | PASS | A → A; whitespace launcher |
| S11 | PASS | E → E; whitespace launcher, APPIMAGE unset |
| S12 | PASS | E → E; whitespace launcher, whitespace/empty APPIMAGE |
| P1 | PASS | Natural packaged production, production scheme/filename/Icon, automatic normal registration and original-PID delivery |
| P2 | PASS, corrected | Unpackaged production, no Icon; normal-writer-specific no-registration proved in all four fresh fixtures; separate OAuth registration observed |
| P3 | PASS, corrected | Unpackaged development, development scheme/filename, no Icon; same proof in four fresh fixtures; real isolated Vite/server HTTP 200 |
| P4 | PASS, after only | Natural packaged development with Icon, registration and delivery; no baseline runtime claim |
| W1 | PASS | Early before readiness; normal equality/no rewrite, preserved mtime/inode |
| W2 | PASS | Corrected stale retake preserves seed then proves early correction/normal equality; older redundant stale fixture not used for seed proof |
| W3 | PASS | Entry removed before actual normal read and recreated byte-identically for L and A |
| W4 | TEST/SOURCE PASS | Unchanged best-effort/error branches and prior 19 passing focused tests; no real OS fault injection |
| W5 | PASS | Same private state L → E restart, first PID reaped, regeneration and exact dispatch |
| X1 | SOURCE PASS | Linux guards; no Windows/macOS runtime claim |
| X2 | N/A | No renderer/provider/contract/transport/action/relay/tunnel change |
| X3 | N/A | Nonvisual behavior; images and pixel comparison do not apply |

## Independent reproduction continuity and limits

I reread the actual prior [independent timestamped reproduction](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a66f653315ade412/pass2-reproduction-transcript.txt), including original PID **2527522** receiving exactly `t3code://proof-audit-8668/after-S1-unpackaged-pass2-independent` at **22:56:01.507Z**, remaining alive and then reaping with exit 0. Its old prose “not automatic registration” must now be read only as a normal-writer statement; the correction disproves a whole-app interpretation.

I independently reread both actual entry files and recomputed the [byte comparison](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/bc3fb1800266f2df/pass2-byte-comparison.json). Delivered entry is 215 bytes, independent entry 216 bytes; only the row-private path differs. Replacing just those two documented row roots with `<ROW_PRIVATE>` yields identical 179-byte entries, **zero differing bytes**, SHA256 `43695ba37fb4b009a580fa2d951fff552ec11defa7811712bb83876252939af0`. No new reproduction, build, tests or runtime fixtures were launched for this audit.

No actual mounted AppImage, installer, Windows/macOS runtime, OS-error injection, visual verification or universal desktop-backend claim is made. APPIMAGE uses an explicitly simulated forwarding fixture. No live T3 data was read/copied/written. No code edits, push, PR comment, watch, delegation or browser use occurred. The public audit upload was requested. PR linkage is registered and confirmed, without watching.

Cleanup record reports 24 app PIDs and two dev runners reaped and ignored dist restored. I independently confirmed all 26 recorded PIDs absent, clean tracked state and sufficient disk (6.5 GiB). No processes were started by this round. The lead retains responsibility for eventual removal of the pre-existing task directories/worktree.

## FRICTION

The earlier proof conflated discoverable defaults, normal-writer registration and whole-app registration; the accepted correction now distinguishes all three and retains contradictory pilot observations as excluded diagnostics. Python urllib received HTTP 403 fetching the public inventory; curl fetched the inventory and all 98 artifacts successfully. Initial independent parsing used Python splitlines, which counts a JavaScript Unicode line separator unlike CDP; switching to literal newline splitting matched every bundle location. A second checker assumption unnecessarily quoted space-free executable paths; comparing the renderer's actual quoting rule resolved it. Neither checker issue changed source or evidence. There are no unresolved proof objections within the corrected matrix.

**VERDICT SUFFICIENT**

Audit: gpt-6.1-sol through the Codex harness in T3 Code.