# Final proof audit PASS 3 — [#14419](https://github.com/pingdotgg/t3code/pull/14419)

Merge recommendation for the requested proof scope: **merge**. No proof blockers remain. This audit authorizes no merge operation and makes no current CI claim.

Reviewed head [66eddc7](https://github.com/pingdotgg/t3code/commit/66eddc7146296220b71ce85c3ba1644d6285a6ee), pinned base [a68e6e9](https://github.com/pingdotgg/t3code/commit/a68e6e97c501d265e1edccb47b96f8365c8e38f4). Local HEAD and merge-base equal those exact requested hashes. Product status clean before and after. No fetch, ref update, main mutation, commit, push, PR write, watch, browser, database or T3 server operation occurred. T3 thread metadata registered the supplied PR and confirms it is linked, unwatched.

## Identity and integrity

Independent comparisons prove staged red source is the exact base git blob, staged green source is the exact head blob, and both staged test files are exact head blobs. SHA256:

- Red implementation: `9ee5f005fa278268015b3ec619f71a2f524b181a64f3f4b79b44fd67db5cd136`.
- Green implementation: `a119e2c3e74c2e6b4af5273ad395cb70c5f69f7ea1ed0d62f506bf2ea8289386`.
- Both tests: `9f0f42b2f87db068f619281fa190aae53e4395e095c5229031a95cf27c897477`.
- Driver: `b18151f95425ae7ac7149d3c6168608e1c60091a70cf8ba8fea393d6032e6676`.

Every SHA256SUMS entry verifies. Every archive inventory file byte-matches its staged file. All 15 replacement public artifacts in capture/upload-output.md, capture/report-upload.md and final-check-uploads.md were downloaded with curl and byte-compared successfully, including the archive, matrix, report and four final check logs. Older artifact URLs are superseded. Draft body hash and exact log contents are recorded in audit-final-transcript.txt.

Runtime is Node v26.12.1 / Linux x86_64, Effect and @effect/vitest 4.0.5. Minimal staged configs select the entire affected test file without repository setup hooks. No imports or implementation bytes were rewritten. Installed Effect internal source independently hashes to `29200eee28c991b77b9f62317831332d4330179d8ab654fec8dea4472732d0af`, matching the supplied source trace.

## Every timing row

Independent assertions inspect events and ordering, actual request/result content, replayed session/protocol headers, cleanup flags and port ownership rather than trusting PASS labels. Ranges below refer to the fresh red-runtime.txt and green-runtime.txt; delayed cleanup socket-close events can extend into the following row's range. Each cell is a separate implementation/path/timing case: 20 total.

| Timing/path | Red transcript lines | Green transcript lines | Verdict |
| --- | --- | --- | --- |
| T1 session | 6–23 | 6–22 | SUFFICIENT both |
| T2 session | 22–41 | 23–41 | SUFFICIENT both |
| T3 session | 40–59 | 40–59 | SUFFICIENT both |
| T4 session | 58–76 | 58–75 | SUFFICIENT both |
| T5 session | 75–93 | 76–93 | SUFFICIENT both |
| T1 stdio | 92–110 | 92–109 | SUFFICIENT both |
| T2 stdio | 109–128 | 110–128 | SUFFICIENT both |
| T3 stdio | 127–146 | 127–146 | SUFFICIENT both |
| T4 stdio | 145–163 | 145–162 | SUFFICIENT both |
| T5 stdio | 162–179 | 163–179 | SUFFICIENT both |

T1/T4: both exports finish initialization before the target tools/call (session) or tools/list (stdio). The endpoint consumes the correlated target request before interruption. Red stays open without abort for 150 ms and is then explicitly released. Green records one signal abort and native fetch AbortError, with target socket and response closure while headersSent=false, released=false, cleanup=false. T4 records two completed interruption requests. One abort event is not a count of abort() invocations; the installed Effect trace establishes one per-operation controller and uninterruptible interruption finalizer. Session DELETE is separate and promptly acknowledged.

T2: native fetch resolves and actual JSON response.text starts before interruption. Both revisions finish interruption without a fetch abort, keep the target open during the observation window, then explicitly release the body. This is unchanged JSON-body lifetime, not SSE proof.

T3/T5: actual {ok:true} result/output is retained, handshake replay succeeds, normal scoped session teardown issues DELETE, and stdio produces exactly one target output. The driver's awaited Fiber.await Success establishes completion before T3 interrupts the completed fiber. No abort or fetch rejection occurs. All 20 cases, both drivers and cleanup pass; no unhandled rejection is recorded through driver end. All 20 captured ports independently confirmed clear.

Request-class collapse is valid: the session initialization/notification/call classes share send's changed POST site; stdio requests/notifications/client responses share forward's changed POST site. Existing six controls cover parsing, error synthesis, session replay, concurrent SSE response forwarding and protocol cancellation routing. DELETE and input parsing are unchanged. No transport or client contract changes, new permissions, client UI, reverse states, or documentation changes are required by this two-site signal forwarding fix.

## Exact tests and prior missing rows

All four staged test transcripts were inspected in full. Base focused: two named abort tests fail / six skipped, exit 1. Base full: exactly those two fail / six pass, exit 1, at undefined versus true for signal?.aborted. Head focused: two pass / six skipped, exit 0. Head full: all eight pass, exit 0. The fake fetch never settles; these tests prove signal forwarding. Native runtime supplies transport proof and post-handshake tools/call coverage; the session unit test actually blocks initialize.

| Prior missing row | Final evidence | Decision |
| --- | --- | --- |
| B32-lint | final-lint.txt pins exact final head, cwd, UTC and `vp lint apps/server/src/mcp/AcpMcpStdioBridge.ts apps/server/src/mcp/AcpMcpStdioBridge.test.ts`; exit 0 | SUFFICIENT |
| B32-typecheck | final-typecheck.txt pins exact final head and server cwd; `vpr typecheck` runs `tsc --noEmit` with cache disabled; full log ends EXIT 0. Output consists of Effect suggestions, not failing errors | SUFFICIENT |
| B32-main-check | final-main-check.txt records old head, pinned main, successful merge and resulting exact final head, plus clean status. Git independently proves pinned base is an ancestor and merge-base; final merge adds only apps/mobile/src/features/home/ThreadUndoNotice.android.tsx, with zero server diff from first parent | SUFFICIENT |
| Final affected-file tests | final-tests.txt pins final head/server cwd; `vp test run src/mcp/AcpMcpStdioBridge.test.ts`, 8 passed, EXIT 0 | SUFFICIENT |

These are audited supplied exact command transcripts, not claims that this auditor reran lint/typecheck. They close all three pass-2 gaps. No request to remerge a moving main ref is justified by this pinned audit.

## Independent affected T1 session rerun

Ran the report's unmodified commands `node /tmp/ev-14419/capture/runtime.mjs red T1 session` and green equivalent from `/home/ubuntu/wt/pr-14419`. Complete stdout/stderr, command, runtime identities and exits are in audit-final-transcript.txt.

- Red PID 1043599, port 36239: post-handshake target stays open for 150 ms without abort, then explicit release; exit 0.
- Green PID 1043659, port 45715: one abort event, native AbortError, target socket and response close before headers/release/cleanup; exit 0.
- Both owners/cwd checked by driver against ss and /proc. Both processes exited, both listeners closed, both ports independently confirmed clear. No kill command or cleanup-driven cancellation credited.

Only synthetic loopback HTTP endpoints and harmless results were used. No real DB, server, browser, provider runtime or tool side effect. Product remained read-only; audit writes are under /tmp/ev-14419.

## Current draft claims and attribution

The current body correctly states the narrow pre-header effect-interruption behavior and its boundaries. Its 20-case matrix, test totals, source/runtime identities, archive/hash references, final checks and merge description match current evidence. Supplied reviews.md and maintainer context attribute two MERGE rounds to Codex gpt-6.1-sol and Claude Opus 5.5 at the pre-merge revision. Independently verified final server bytes are identical to that revision. Review execution itself is attributed evidence, not independently recreated by this audit. The comment-only follow-up and original contributor ancestry are visible in git; historical absence of rebase/force-push remains the maintainer's process attestation.

Proof-audit and CI pending lines are placeholders, not claims of a pass. This report can replace the proof placeholder; CI requires its own publication/check evidence. The requested verdict concerns proof sufficiency at the pinned revisions, not current forge state or permission to land.

CLI/OS-signal cancellation source, provider-specific behavior, remote rollback, MCP protocol cancellation and SSE body lifetime remain explicitly unverified and outside the claimed fix. Existing body lifetime and DELETE limitations are not introduced by these signal additions. No concrete regression or missing timing row was found.

## FRICTION

- Origin is GitCafe. No forge CLI/API operation, fetch, push, PR write or watch was performed; only mandatory T3 metadata linkage.
- Public download via Python urllib returned `HTTP Error 403: Forbidden`. Curl succeeded; every replacement upload byte-matched. No evidence gap remains from this transport difference.
- Prior pass-2 INSUFFICIENT applied only to absent lint/typecheck/main transcripts. Fresh pinned logs close those rows. Pre-merge review outcomes are attributed at identical final server bytes, not misrepresented as fresh reviewer runs.
- Synthetic fixture processes self-cleaned with captured PID/port/cwd; no real DB/server/browser and no product mutation. No main-ref treadmill.

VERDICT: SUFFICIENT