# Proof audit, pass 2

Findings: no blocking proof gaps or unsupported scope claims found. The supplied runtime package satisfies the pass-1 textual checklist. This is a proof sufficiency audit, not a fresh merge-readiness or CI review.

Reviewed issue [#13239](https://git.cafe/pingdotgg/t3code/issues/13239), base [8d3b061121](https://git.cafe/pingdotgg/t3code/commit/8d3b061121fe65669d5d43d011b48cd3027a4108), head [dd9793b9dc](https://git.cafe/pingdotgg/t3code/commit/dd9793b9dca694d5303dbc35ed90a146af4d9272). Local worktree HEAD equals the full requested head; clean before and after. Both commit objects resolve to the full identities above. All ten recorded source-file SHA-256 values (five per revision) match their Git objects. Package version is 0.1.1 at both revisions. Complete diff: five server files, 74 insertions, 19 deletions.

## Required runtime rows

PASS means supplied output inspected against exact source and accompanying evidence; independently reproduced is explicitly identified.

| Revision | Required row | Status | Evidence |
| --- | --- | --- | --- |
| Base | Preflight protocol 1 | PASS | Blocked, old generic reason, version 0.1.1, exit 0, empty stderr |
| Head | Preflight protocol 1 | PASS; independently reproduced | Blocked, exact expanded recovery text, version 0.1.1, exit 0, empty stderr |
| Base | Preflight protocol 2 | PASS | Blocked, old generic reason, version 0.1.1, exit 0, empty stderr |
| Head | Preflight protocol 2 | PASS | Blocked, supplied protocol 2 and required protocol 3, full recovery text, exit 0, empty stderr |
| Base | Preflight protocol 3 | PASS | Ready JSON with launcherProtocol 3, exit 0, empty stderr |
| Head | Preflight protocol 3 | PASS | Byte-identical ready JSON, exit 0, empty stderr |
| Base | Script install no-op | PASS | Old version-only message; exit 0; unchanged fixture |
| Head | Script install no-op | PASS | Version plus actual src/bin.ts entry; exit 0; unchanged fixture |
| Base | Script update no-op | PASS | Deprecation plus old version-only message; exit 0; unchanged fixture |
| Head | Script update no-op | PASS | Deprecation plus version and src/bin.ts entry; exit 0; unchanged fixture |
| Base | Standalone install no-op | PASS | Native executable invoked directly; old version-only message; exit 0; unchanged fixture |
| Head | Standalone install no-op | PASS | Native executable invoked directly; version plus dist-exe/t3 path; exit 0; unchanged fixture |
| Base | Standalone update no-op | PASS | Direct native invocation; deprecation plus old message; exit 0; unchanged fixture |
| Head | Standalone update no-op | PASS | Direct native invocation; deprecation plus executable path; exit 0; unchanged fixture |

## Evidence and source checks

Fetched and inspected all four supplied artifacts: [pass 1](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/80cec9513f3eb4e6/issue13239-proof-audit-pass1.md), [runtime transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/fb867b9822fc3299/issue13239-runtime-transcript.md), [reproduction/seeder](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/712aecd9f57e0257/issue13239-reproduction.md), and [process traces](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/25b0f62cc5dca838/issue13239-process-traces.txt).

Preflight reasons match the corresponding source, including exact version pinning, version/PATH checks, installer-default service command, and desktop versus CLI explanation. Protocol 3 remains unchanged. The printed path is literally ~/.local/bin/t3, not a fully expanded absolute pathname; the transcript explicitly corrects pass 1's loose terminology. Advice execution and installer success are not claimed.

The unchanged resolver validates a matching npm launcher first, otherwise selects process.execPath for Node SEA and argv[1] for script execution. HostProcess.IsExecutable uses node:sea.isSea(). The transcript clears the launcher variable and captures both distinct branches without relabeling Node argv. Native hashes and version output are recorded, and the reconstruction uses the repository pack/SEA configuration and pinned Node version. This audit inspected that provenance and execution traces; it did not independently rebuild native artifacts, verify their now-discarded bytes, or establish release archive installation. None is needed beyond the requested single independent row.

Production BootService.status requires exact rendered unit text, pinned entry presence, matching completion sentinel, active version, no pending update/restart marker, and clean manager probes. The seeder derives paths and renders the unit with production helpers. All six production status gates report installed=true, current=true, problems=[]; four artifact CLI status runs corroborate the state. These combine synthetic filesystem state with the existing real user manager; they do not prove the synthetic unit was loaded or running. The documents state this limitation correctly.

All 18 trace sections contain exactly CLI/fixture startup and four manager probe executions: /usr/bin/systemctl --user show-environment, /usr/bin/loginctl show-user 1000 --property=Linger --value, /usr/bin/systemctl --user is-enabled t3code.service, and /usr/bin/systemctl --user is-active t3code.service. PATH-search ENOENT attempts are also present and do not add executed programs. Two interleaved execve entries resume with success. No child command mutates the manager, installs, reloads, downloads, or hands off. Production reconcileService returns before service.install when installed/current is true. This supports the no-op claim without confusing CLI subcommands named install/update with installation effects.

Eight no-op records each attest before=after and publish the same four-file SHA-256 map: service-state, sentinel, synthetic runtime entry, and unit. The maps are internally consistent and identical across all eight rows. Separate raw before/after maps are not published; equality is a capture-program assertion, whose implementation was inspected. The supplied evidence supports fixture equality, not a whole-host filesystem audit. No stronger claim is required.

## Independent runtime reproduction

Ran the real head source CLI with actual installed Node 26.12.1, a disposable command-local HOME/T3CODE_HOME, inherited PATH unchanged, and the launcher override removed:

```text
<installed Node 26.12.1> <head worktree>/apps/server/src/bin.ts __service-preflight --database-path <owned scratch>/missing.sqlite --launcher-protocol 1
```

Exit 0; stderr empty; stdout byte-identical to the captured head-preflight-1 row. Missing database remained absent. No server or browser was started, no manager command was needed, and no printed recovery advice was executed. Actual stdout:

```json
{"status":"blocked","version":"0.1.1","reason":"The installed service launcher speaks protocol 1, but t3@0.1.1 requires protocol 3. On the server machine, install this exact CLI: `curl -fsSL https://t3.codes/install.sh | T3CODE_VERSION=0.1.1 sh`. Check that `t3 --version` prints 0.1.1 and that `which -a t3` lists no older t3 (such as an npm or nvm install) first, then run `~/.local/bin/t3 service install` (the installer's default path). Updating the desktop app does not update this CLI, and `t3 service update` only repairs the service with whichever CLI runs it."}
```

## Visual and fixture scope

Visual matrix: []. Server-only exception applies: no client renderer, layout, navigation, or wire schema changed. Existing clients may show the longer server reason, but no changed visual path requires rebuilding clients or measuring pixel deltas under the agreed scope. No visual verification is claimed.

Public, revision-identified evidence and executable seeder/capture instructions are sufficient for this text-only proof. The user's seeding-script commit rule applies to visual captures; there are no visual rows. Committing PR-only capture machinery would not strengthen this required scope. No fixture commit is needed.

Prior 15/15 tests, base-red/head-green results, and reviewer approvals remain supplied context, not independently audited results. Npm-launcher packaging, release archive installation, real service repair/restart, and desktop update remain outside the evidence claims. No forge access, edits, push, comments, browser/server launch, live T3 access, systemd mutation, PATH change, or delegation occurred during this audit. Owned scratch was removed after upload.

## FRICTION

category | event | prevention
--- | --- | ---
Artifact retrieval | Python urllib received HTTP 403; curl fetched the same public artifacts successfully | Use curl for this evidence endpoint; inspect HTTP status before parsing.
Trace interpretation | Concurrent execve calls split two successful entries across unfinished/resumed lines | Reconcile by PID before counting successful probes; do not treat missing single-line success as failure.
Evidence precision | Pass 1 called a tilde-prefixed path absolute | Preserve literal source output and describe it as the installer-default path.
Scope | A public transcript cannot independently attest discarded native bytes or all host writes | State inspected provenance and independent execution separately; avoid expanding fixture equality into a whole-host claim.

VERDICT: SUFFICIENT all 14 required rows are supported, identities and source text match, and one affected runtime row was independently reproduced.