# Proof audit PASS2 — takeover updater evidence

The evidence is SUFFICIENT for the requested narrow Linux Electron app fixture at the pinned target below. It supports first-confirmed-sidebar failure feedback, unchanged Settings presentation, legacy sidebar, async delivery, repeated retries, native check-only menu wiring, exactly-once diagnostics, later delivery of the same Error, and backend/marker recovery. It does not prove genuine packaged installation or any newer merge.

PR [#15386](https://git.cafe/pingdotgg/t3code/pulls/15386), mirror [#15386](https://github.com/pingdotgg/t3code/pull/15386). Audited target [d8a48b84a8](https://github.com/pingdotgg/t3code/commit/d8a48b84a87ce6a59628b2da2a095647a5862618) against [0840bb209c](https://github.com/pingdotgg/t3code/commit/0840bb209c8a503ba74715167e4ae04c4c0e0c19). Original submission is not the capture target. 2026-10-25 UTC.

Scope: real Linux Electron renderer/preload/IPC/service APP FIXTURE. app.isPackaged, appPath, version, APPIMAGE and check/download setup are overridden. Sync failure executes installed electron-updater 6.8.9 BaseUpdater missing-path branch with in-memory downloadedUpdateHelper=null. There is no genuine packaged download/install, signing, elevation, OS handoff or relaunch proof. Success suppresses the OS boundary.

Evidence root `/tmp/ev-15386`; B=`0840bb209c8a503ba74715167e4ae04c4c0e0c19`, A=`d8a48b84a87ce6a59628b2da2a095647a5862618`, E=`A/extra`. Each run has recording.mp4, trace.jsonl, stdout.log and actions.jsonl. The independent replay is `/tmp/audit-15386-pass2/replay3`. PASS2 inspected extracted frames from all 15 distinct recordings (including failed attempts and eight clips) and all 74 evidence PNGs. PNG inventory also encountered 26 dependency/skill/build images, which are not update evidence. Full videos were sampled, with additional frames around updater calls; this is not a claim to have watched every frame.

## Findings against the actual REPORT.md

The report correctly retracts PASS1's failed=true IPC field, status=error, special retry-tooltip, diagnostic-reason parsers and NoNewPrivs assertions. The final diff is only ElectronUpdater.ts plus its two focused tests. The adapter captures synchronous error emissions, suppresses only service-owned error callbacks during that call, removes the capture listener in finally, returns the first emission as a typed failure, and leaves later events available. Existing recovery and renderer logic explain the observed change without new service/IPC/UI code.

I read the complete report, both fixture variants, driver/launcher/build-before/extraction scripts, exact pinned diff and relevant Settings/sidebar/recovery/installed BaseUpdater source. Trace/diagnostic counts were recalculated independently in trace-audit.json. Before: 2 sync + 1 async + 1 success call, 0 typed / 5 global diagnostics. After main: 4 sync + 1 async + 1 success, 4 typed / 3 globals. Extra: sync + throw + multi, 3 typed / 0 globals. This accounts for every logged error without treating intentional later delivery as a duplicate.

The report's first-click conclusion is supported by continuous source frames and traces, not just the selected stills. My additional first-call frame strips show B confirmation at recording ~67.16s then no toast after ~67.66s; A confirmation through ~69.66s then toast at ~70.46s. The 15fps timing resolution supports the qualitative ordering, not millisecond UI latency. Settings confirms are brief and can disappear between coarse samples; actual confirmation stills, actions and IPC calls corroborate that row.

Precision corrections to preserve in any final PR account:

- Settings hover screenshots do not visibly show a tooltip. The ordinary downloaded wording is supported by source/state; no captured install-error tooltip is established.
- sync-end.png, legacy-end-immediate.png and multi-end.png can precede error presentation. Use the extracted first-call pair/continuous video and logs rather than interpreting those names as proof.
- The native Help menu is genuinely rendered, but the check is driven through its real item's click callback. Do not say an OS mouse click or an up-to-date dialog was demonstrated.
- Before is a controlled reconstruction replacing the adapter with exact base source. It is suitable for this isolated adapter comparison because the pinned production diff is only that file; it is not a separately packaged base binary.
- The live worktree advanced from requested d8a48b84a8 to a newer merge during this audit. All source comparisons and replay here remain pinned to the preserved d8a48b84a8 bundle. No finding extends automatically to that merge.

## Independent reproduction

Own headless-desktop display :99; fresh HOME/config/data/cache/T3 home under /tmp/audit-15386-pass2/replay3. No live userdata read/write. I reused the preserved fixture/driver in my own copies and kept the real bundled renderer, preload, IPC, service and BaseUpdater. Relocation changes only: appPath points to my hard-linked copy of built-after at /tmp/audit-15386-pass2/runtime, plus dependency symlinks to existing workspace node_modules. Main.cjs bytes remain the verified preserved hash. No tracked files were edited.

Two failed setup attempts are retained: original launcher referenced removed worktree dist; then relocated backend lacked @cursor/sdk resolution. Both were shut down through their own fixture quit command. Adding dependency links to my runtime copy fixed replay. No capture-agent session was touched.

After completing real onboarding without importing projects and disabling provider version checks through Settings, I established downloaded fixture events, clicked sidebar Install once and Confirm once. At 00:44:26.476 the first updater call used true,true with 3 listeners. The real missing-path branch emitted at .477. At .484 real IPC returned accepted=true/completed=false, status=downloaded, version=0.1.3, canRetry=true, install context and typed message; neither IPC failed field nor status=error was present. Both markers were absent, listener baseline restored to 2, original backend exited, replacement PID started at .494 and backend-ready followed at 00:44:28.726. DOM capture contains Could not install update. The recording-derived frame at +0.6 seconds shows the toast; immediate synchronous shot was too early.

The fixture reuse command at 00:44:26.898/.902 emitted the saved identical Error followed by a distinct Error; stdout has exactly one typed diagnostic for first request and one background diagnostic for each later event. This independently validates S1/A2 and recovery. All recorded replay Electron/ffmpeg/backend PIDs were confirmed absent after shutdown in cleanup.json. Artifacts remain for parent cleanup.

## Independent uploaded evidence

![independent-toast.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dedde75ceb15d470/independent-toast.png)
[independent-first-click.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/fb94040e8441296f/independent-first-click.mp4)
[trace.jsonl](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5b0f7e6e29da1968/trace.jsonl)
[stdout.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/70a530152e6fb70b/stdout.log)
[trace-audit.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/afb7cd6155571a7c/trace-audit.json)
[source-map-provenance.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/cb37b94a73f86ca0/source-map-provenance.json)
[cleanup.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dbc19c914bc1e26e/cleanup.json)

## Corrected matrix

The companion FINAL-FIXTURE-MATRIX.md reconciles every PASS1 row with report evidence and the final diff. S1/S2/S3/A1/A2/OK1/R1/T1-failure/B1/M1/D1/D2/X1-local and recovery/provenance meet the narrowed required scope. OK2, full C1 duplicate protection, actual-download toast, genuine macOS/Windows/remote install paths remain unproven and excluded.

## FRICTION

category | event | prevention
--- | --- | ---
tool | preserved launcher still points at moved dist and relocated server cannot resolve @cursor/sdk | provide replay launcher with relocated appPath and dependency links or a self-contained runtime
brief | PASS1 required fields/status/diagnostic parsers absent from final implementation | derive final matrix from pinned diff and contract before judging evidence
runbook | immediate screenshots precede paint; Settings/native screenshot names can overstate what is visible | use actual frames plus action/IPC timestamps, label callback-driven menu invocation
infra | worktree HEAD changed while auditing | pin explicit object SHAs and preserved bundle hashes throughout
forge | none | no forge CLI reads/mutations, comments, pushes, commits or watching; app PR link registered only
policy | none | user authorized Electron use; isolated temp homes; only owned captured processes stopped
model | none | no delegation
other | optional duplicate and genuine packaged paths not proved | keep exclusions explicit rather than promoting partial evidence

Read-only source audit by gpt-6.1-sol through Codex in T3 Code. Uploads use the ghdrop skill at /home/ubuntu/.codex/skills/ghdrop/SKILL.md.

VERDICT: SUFFICIENT