# Passive refresh proof audit — pass 2, final-head refresh

Read-only source review on 2026-10-22. Target base `4619c0bca6`; final HEAD `6b0ce9b0bc70939c7cd1a81a009b0af70077fed5` confirmed locally. Base-to-head diff: two Swift files, 402 insertions/97 deletions. Scratch writes only under `/tmp/issue-14691`. No code edits, commits, pushes, forge comments, PR creation, browser, server, fleet, device access, compiler, build or tests in this refresh.

## Delivered set and SHA coverage

The local `pass1-fixture-matrix.md`, `native-capture-evidence-index.md` and this audit now identify the final HEAD. Historical filenames are retained; they do not imply execution. They are recording plans/blocker inventories, with zero native captures and 0/15 verified rows. No synchronized native request logs, build/install records or Swift test execution results were supplied. Updating the target SHA does not turn source inspection into final-SHA native proof.

The supplied [host transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b6158405819336ba/host-runtime-transcript.txt), read from its existing local copy, targets host main `8d3b061121`. B=20 ms/C=4534 ms and B=27 ms/C=6520 ms demonstrate independent host responses and available renamed B data only. They satisfy none of R1–R15. The 6520 ms host completion does not establish successful Swift shell completion under its default six-second timeout. No hosts were started in this refresh, and no independent download/byte comparison is claimed.

## Final-code delta and limits

R4: the pending tick has a ContinuousClock deadline. A late changed or unchanged-busy answer publishes through the completion path and reschedules only if now + fast interval is strictly earlier than that deadline. Acceptance is the earlier of the existing pending deadline and late completion +5 s, including early shortening and near-expiry preservation. It must not require replacing every pending timer with a fresh five-second wait.

R6: final HEAD replaces decremented tick-duration backoff budgets with absolute ContinuousClock retry deadlines. Transient failure records now +20 s; credential rejection records now +24 h; success removes the deadline. Tick-time filtering requires deadline <= current instant and no owned in-flight load. Deadlines for non-passive IDs are pruned. A tick pulled earlier cannot consume a failure's backoff. Eligibility is not an exact dispatch-time guarantee: retry occurs only at a subsequent qualifying tick. Environment-document failure separately schedules a 20 s wait; it is not this per-environment retry map.

Inspected mock tests, not executed: the near-expiry changed-answer case advances an injected clock 5.8 s and targets preservation of the pending tick. The new mid-wait failure case models failure at 11 s, eligibility at 31 s, no C retry at 25/30 s, and retry at 35 s. The failed-peer test now advances the manual clock and awaits a second failed-shell-read milestone before its final count. This supersedes the prior audit's stale description of tick-decrement backoff and missing final failure milestone. A failed-read transport milestone is not a general proof that every later publication or asynchronous side effect is drained. No passing/race-free test claim is made.

The controllable sleep owns continuations by request ID; cancellation resumes its own continuation. This is helper isolation, not demonstrated production HTTP cancellation. Early-shortening, busy-only late answers, actual stale/canceled tick delivery and native display remain unproved.

Retained review hypotheses, not demonstrated failures: dispatch batches reset cycle work flags and omit cached busy peers still in flight; old completions can affect newer cycles; loaded events use tick-cached environment documents; environment-document loading awaits on the single event consumer. Initial/cache-startup/background aggregate loads still batch. This refresh does not broaden the recurring passive-loop fix or assert these hypotheses are resolved.

## Exact missing rows

Every entry below is **UNVERIFIED / cannot-verify ios-swift**, with zero delivered native captures. All require the real Swift app at base and current HEAD, isolated native storage and real disposable A/B/C hosts, production-clock continuous video with correlated sanitized request events, build/device/iOS/viewport/cache/host metadata. Mock unit tests and host-only transcripts cannot substitute.

| Row | Missing proof, including required variants |
|---|---|
| R1 | Healthy update before held peer completion; swapped B/C labels/order; second healthy mutation and next poll; base/current-HEAD recordings. |
| R2 | Initial 5 s, two unchanged 10 s cycles, mutation during idle, then changed-result 5 s cadence on production clock. |
| R3 | C auth/catalog/route load spanning multiple ticks; two B updates, one C owned load without restart, release and eventual C publication. |
| R4 | Changed and unchanged-busy late answers; early shortening and near-expiry deadline preservation; no stale/duplicate tick after cancellation. Acceptance must use the earlier deadline as above. |
| R5 | All seven predicates: session starting, session running, latestTurn running, pending approval, pending input, background working, background monitoring; clear each to idle; cached busy C across later B-only cycles. |
| R6 | Timeout/unreachable with retained rows/disconnected indication and healthy B continuity; absolute failure-handling +20 s deadline, mid-wait failure, no retry on earlier/pulled-forward ticks, later eligible-tick retry and recovery; >20 s timestamps/request counts and all-passives-fail/recover variant. |
| R7 | Credential rejection suppression and re-pair recovery for direct/single-route and managed/multi-route; full-duration 24 h evidence or separately identified scheduler test. A short clip proves only its observed window. |
| R8 | Genuine empty shell clearing stale B only; project/thread create, rename, archive/removal, project-only change, thread removal, and colliding raw B/C IDs with C delayed. |
| R9 | Separate disable/re-enable and remove/add/re-pair segments during pending C reads; release stale results before/after catalog ticks; rows/permissions do not revive, B continues. |
| R10 | Active A→B switch, disconnect/sign-out, route replacement/re-pair during pending reads; release old responses; >10 s ownership/cancellation observation with correct stream/selection/permissions. |
| R11 | Warm/cold startup and reload, startup/first publication distinction, background <10 s and ≥10 s then foreground; continuity without stale replay; rotation during pending load here or R10. |
| R12 | No passive requests with only A/disabled B/C; 10 s idle and enable-B discovery/publication; distinguish empty set from all-passives-in-backoff. |
| R13 | Isolated reliable environment-document storage failure while completions queue, 20 s retry, recovery without stranded work or removed-row revival; synchronized fault log. No seam delivered. |
| R14 | Failed primary/working alternate route with independent B; selected-route recovery and shared-client ownership; real remote/relay/tunnel variants/access or explicit gaps. |
| R15 | Passive B detail routing/live stream during aggregate updates, return home; separately bounded backgroundSnapshot traffic with no persistent passive subscriptions/timers. |

Also missing: compact iPhone/light R1–R8; regular iPad/dark R1 with long colliding titles; pending-response compact/regular rotation; actual point widths; identified iOS 17/current-runtime coverage. Provider-brand permutations may remain collapsed, but the seven work predicates cannot. Web, Electron and React Native evidence does not prove these Swift rows.

## FRICTION

- Linux has no available Xcode/iOS SDK/Swift execution route under the supplied constraints; device access is off. No native access retry, build, tests or capture attempted.
- Final-head source and mock-test changes have no delivered execution evidence. All 15 native rows remain UNVERIFIED / cannot-verify ios-swift, with zero captures.
- Native capture host, disposable fixtures, fault seams, route access and correlated production-clock video/request logs remain missing prerequisites. Host-only independence cannot substitute.
- The explicit user exception permits a cannot-verify ios-swift PR. It waives the opening prerequisite, not proof requirements or this verdict. No independent runbook approval/compliance is asserted. This task creates no PR.
- Only the three sanitized scratch reports are updated/uploaded; no repository or external forge state is changed.

## VERDICT: INSUFFICIENT

0/15 rows verified. Exact missing rows: R1, R2, R3, R4, R5, R6, R7, R8, R9, R10, R11, R12, R13, R14, R15, including all variants above. Zero passing-proof claims. Final-head source inspection supports the described intended deadline/backoff changes but cannot establish native runtime behavior or a passing Swift build/test run.