# PASS2 read-only proof audit

PR [#11648](https://git.cafe/pingdotgg/t3code/pulls/11648), mirrored [#11648](https://github.com/pingdotgg/t3code/pull/11648).

Audited checkout: `/home/ubuntu/wt/pr-11648`, branch `takeover/pr-11648`. Base [843f4e3529](https://github.com/pingdotgg/t3code/commit/843f4e35292391897089535e8f1af59b322e70f8); capture and audited HEAD [e90cc01e4b](https://github.com/pingdotgg/t3code/commit/e90cc01e4b95283528d5f65dedaa19a7114a3cd8). Original fork identity [thelonewander3r/t3code](https://github.com/thelonewander3r/t3code/tree/fix/desktop-android-sdk-env), [c4c9ff1](https://github.com/thelonewander3r/t3code/commit/c4c9ff1ee99dd41d53ade45bf47b8295d449de27) is supplied provenance, not independently fetched in this audit. This verdict concerns the supplied replacement proof, not current remote merge readiness or CI.

## Findings

No blocking proof gap for the matrix's synthetic Linux SDK-discovery claim. All 44 original launches have the expected backend tuples, UI status, and selected-root sentinels. One fresh real Electron HEAD A1 reproduction also passes.

1. **Reporting correction, nonblocking:** `runs/C11-after/process-tree.json` is `[]`. The original report's “Final process trees still contain that same backend PID” is false for this capture. `backend.json` records backend 2312739 as direct child of captured Electron 2312435; emulator discovery sentinels have parent 2312739 and select i; its recording and stills show the matching local Device state. `batch.py` calls `stop()` after each batch; a later redundant stop can overwrite the last tree with an empty observation after shutdown. This explains the missing tree but does not independently prove its historical contents. The row remains sufficient through those independent exec-time and downstream records. Do not repeat the universal final-tree claim in the PR body. Preserve trees before shutdown and do not overwrite a nonempty snapshot with an empty one.
2. **SHA attribution:** the PASS1 matrix names [b6c944c9b8](https://github.com/pingdotgg/t3code/commit/b6c944c9b8e36e9a7faddfafaf291677a5663eb9); actual captures use HEAD above. `git diff b6c944c9b8 HEAD` changes only the test file. Production source is identical. Both stored main-bundle sourcemaps contain the exact DesktopShellEnvironment source for the labeled revision. Before uses a source-load substitution of the exact base module; the complete base-to-HEAD production diff contains only that module, so this is production-equivalent before evidence, not a separate full base checkout build.
3. **Claim boundaries:** these are synthetic SDK command fixtures, with no AVD. The observable success is “SDK installed, but no virtual device exists”; no emulator boot, real SDK execution, or Windows/macOS runtime pass is supported. W1/W2 and S1–S6 are source-only controls. The draft's historical 24-test/no-GUI section describes an earlier fork head and must not be presented as replacement-HEAD validation. Replacement proof is 14 focused tests plus the Linux runtime evidence. Draft and original report were left unchanged.

## Row results

U = absent key; E = empty string; W = `space/tab/space`. Tuples are backend exec-time (ANDROID_HOME, ANDROID_SDK_ROOT), before LocalDeviceHost normalizes its child environment. Distinct h/r/i/j and paths containing internal spaces are outside default SDK locations and ordinary executable PATH. “none” corresponds to SDK-not-found UI; selected roots correspond to SDK-installed/no-AVD UI. Every runtime row was checked against independent matrix inputs, rather than trusting results.json's passed field.

| Row | Before backend | After backend | Before / after root | Proof |
|---|---|---|---|---|
| A1 | (U, U) | (h, r) | none / h | PASS, Electron pair |
| A2 | (U, U) | (h, U) | none / h | PASS, Electron pair |
| A3 | (U, U) | (U, r) | none / r | PASS, Electron pair |
| A4 | (E, E) | (h, r) | none / h | PASS, Electron pair |
| A5 | (W, W) | (h, r) | none / h | PASS, Electron pair |
| A6 | (E, U) | (E, r) | none / r | PASS, Electron pair |
| A7 | (U, E) | (h, E) | none / h | PASS, Electron pair |
| A8 | (U, U) | (U, r) | none / r | PASS, Electron pair |
| A9 | (U, U) | (h, U) | none / h | PASS, Electron pair |
| A10 | (U, U) | (home sdk, root sdk) | none / home sdk | PASS, Electron pair |
| A11 | (U, U) | (h, r) | none / h | PASS, Electron pair |
| C1 | (i, j) | (i, j) | i / i | PASS, Electron pair |
| C2 | (i, U) | (i, U) | i / i | PASS, Electron pair |
| C3 | (U, j) | (U, j) | j / j | PASS, Electron pair |
| C4 | (U, j) | (U, j) | j / j | PASS, Electron pair |
| C5 | (i, U) | (i, U) | i / i | PASS, Electron pair |
| C6 | (U, U) | (U, U) | none / none | PASS, Electron pair |
| C7 | (E, j) | (E, j) | j / j | PASS, Electron pair |
| C8 | (i, E) | (i, E) | i / i | PASS, Electron pair |
| C9 | (U, U) | (U, U) | none / none | PASS, Electron pair |
| C10 | (E, W) | (E, W) | none / none | PASS, Electron pair |
| C11 | (padded i, U) | (padded i, U) | i / i | PASS, Electron pair (final tree caveat above) |
| W1 | No inherited SDK, PowerShell profile SDK ignored | unchanged | unchanged | PASS, source only |
| W2 | Inherited pair preserved, PowerShell profile SDK ignored | unchanged | unchanged | PASS, source only |
| S1 | Linux SHELL/user-shell/fallback ordering and deduplication | unchanged | unchanged | PASS, source only |
| S2 | Darwin SHELL/user-shell/zsh fallback ordering and deduplication | unchanged | unchanged | PASS, source only |
| S3 | Missing shell inputs use platform fallback | unchanged | unchanged | PASS, source only |
| S4 | Failed/no-PATH candidate falls through; captures accumulate | unchanged | unchanged | PASS, source only |
| S5 | First captured PATH ends probing even without SDK exports | unchanged | unchanged | PASS, source only |
| S6 | Darwin launchctl fallback supplies PATH only | unchanged | unchanged | PASS, source only |

## Attribution and media audit

The original [public archive](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/84597f12be7e546c/pr-11648-evidence.tar.gz) was independently downloaded. SHA-256 `2b662e8aaec0bef4a7518282daf1289c943b0660c701d654b4a4719ed6a5a8f5` matches the published checksum. A streaming pass verified all 868 indexed file sizes/hashes. All 440 selected runtime artifacts match their local originals byte-for-byte. See archive-stream-check.json.

Each launch's bundle hash matches its revision artifact; each backend is recorded as the owned Electron's direct child. The actual shell-probe argv is `/bin/bash -ilc ...`, observed executable `/usr/bin/bash`, with the row's throwaway HOME and captured Electron parent. Both inherited and profile exports match the matrix exactly, including byte-preserved padded inherited i and independently trimmed shell values. A11's stdout/stderr banner artifacts remain separate from the exact backend tuple. All launches have explicit env-i allowlists, isolated HOME/T3CODE_HOME and seeding disabled. No SDK fixture directory is on launch PATH; absent SDK rows fail discovery, ruling out masking by default SDK/PATH discovery. Local Device hub UI and real local discovery commands are paired with each tuple; no remote/EAS setup is used. Hub-child ANDROID_HOME normalization is not used as proof of the original backend environment.

**Actual visual inspection method:** opened eight labeled still contact sheets covering all 88 original PNGs. Independently decoded all PNGs, compared each 500ms pair pixel-for-pixel and by complete SHA-256, and grouped all 88 by their full-file hashes: 34 SDK-not-found and 54 SDK-installed/no-AVD stills. Opened both distinct states at readable size. The identical hashes justify reusing readable state inspection across every identical still; no uniqueness is claimed for the status-only screenshots.

Independently ffprobe-counted and fully ffmpeg-decoded every one of the 44 recordings without error. Extracted five frames per recording (start, quarter, middle, three-quarter, near end), then opened all eight labeled contact sheets covering all 220 samples. All show real Electron startup/onboarding/settings progression ending in the expected Device state, rather than a terminal printenv substitute. This is sampled visual review plus complete decode, not a claim to have watched every frame in real time. Recording hashes are recorded individually in media.json; recordings are not assumed identical. The still hash groups establish identical final screenshots, not identical videos.

## Independent HEAD reproduction

Built desktop bundles from the current checkout using the existing Vite+ Pack config, with output redirected to this audit's /tmp tree and `clean` enabled only for the first entry group (as in the supplied before-build script). No production source plugin or source edits were used. The rebuilt main.cjs is **byte-identical** to the original HEAD evidence main.cjs: SHA-256 `561acd88fce33fd02b94806a8c685fcf6c54ef588ba82ba5306de3deaa19efb0`.

Adapted the supplied launch/profile observer, fixture, CDP drive, and paired-capture scripts into this audit directory, with a dedicated headless-desktop session and CDP port 19349. Ran the installed real Electron 44.9.3 executable (not a Node-only service harness). A1 inherited neither SDK name; throwaway bash profile exported distinct audit h/r roots. Captured Electron PID 2337438 and its backend PID 2338295 at exec. Backend tuple is audit (h,r), local sentinels select h, Settings → Integrations → Device hub → Refresh shows SDK-installed/no-AVD. Its paired stills are pixel-identical and its new recording fully decodes. Build log, scripts, launch allowlist, tuple, shell argv, final live process tree, sentinels, stills and recording are included in the audit bundle.

Only captured owned process groups and descendants were stopped. cleanup.json reports zero remaining recorded live PIDs. No other Xvfb/server was stopped. No live userdata was read or written; no seeding, tracked edits, commits, pushes, posts, or watches. Ignored checkout build outputs were also left alone; fresh build outputs stayed in /tmp. PR registration with this T3 thread is metadata only.

The focused command `vp test run apps/desktop/src/shell/DesktopShellEnvironment.test.ts` independently passes **14/14** at HEAD. No repo-wide checks ran. Source-only controls were checked against exact base/HEAD files: Windows install/capture fields, shared shell ordering, failed probe handling, first-PATH stop, and Darwin PATH-only fallback are unchanged. Desktop backend configuration and LocalDeviceHost are unchanged. Shared desktop-hosted backend behavior reaches its clients; no web/mobile startup or provider-adapter implementation changed. This proof does not certify unrelated entry points or actual emulator interaction.

## Body-ready runtime claim

At the replacement HEAD, 44/44 synthetic Linux Electron discovery captures (A1–A11/C1–C11 before and after) match expected directly spawned backend Android tuples and local SDK selection. PASS2 independently checks capture/source attribution and media, and rebuilds/reproduces A1 in real Electron. W1/W2 and S1–S6 are unchanged source controls. The SDK fixtures have no AVD; real emulator boot and Windows/macOS runtime execution remain unverified. Do not claim every final tree survived shutdown: C11-after relies on exec-time and direct backend-child sentinel attribution.

## Artifacts

Local audit report: `/tmp/audit-11648-pass2/audit-report.md`. All scratch and new proof remain under that directory. Original inputs, draft body, and checkout code are preserved. Upload URLs are recorded in upload-receipts.json after ghdrop publication. The audit bundle includes report, verifier/reproduction scripts, source equivalence and media metadata, all reviewed sheets, focused test transcript, and fresh A1 evidence. It excludes runtime databases, browser profiles, credentials, dependency caches, SDK fixture executable trees and built executables.

FRICTION tool | sequential Pack builds cleaned prior entry groups when clean was unspecified | explicitly set clean only on the first group, then verify the rebuilt main bundle hash.

FRICTION runbook | final stop can overwrite C11-after process-tree with an empty observation | retain the pre-stop nonempty tree and refuse an empty overwrite.

VERDICT: SUFFICIENT