Fix first: F14 contradicts the “no competing server” acceptance condition.

Proof audit pass 2 for [#23005](https://github.com/pingdotgg/t3code/pull/23005) / [#23007](https://git.cafe/pingdotgg/t3code/pull/23007), reviewed [87ac5b3a34](https://git.cafe/pingdotgg/t3code/commit/87ac5b3a34fe2c12561bf16f6f823e0376fda004) against [8d3b061121](https://git.cafe/pingdotgg/t3code/commit/8d3b061121fe65669d5d43d011b48cd3027a4108). This is a read-only proof audit, not a CI/review-status audit. No worktree edits, pushes, comments, application launches, or new AppImage builds.

1. **P2, fix before accepting F14: HTTP readiness can clear the handoff marker before discovery metadata is published.** [DesktopBackendManager.ts:552](https://git.cafe/pingdotgg/t3code/blob/87ac5b3a34fe2c12561bf16f6f823e0376fda004/apps/desktop/src/backend/DesktopBackendManager.ts#L552) calls onReady after its HTTP probe. [DesktopBackendPool.ts:173](https://git.cafe/pingdotgg/t3code/blob/87ac5b3a34fe2c12561bf16f6f823e0376fda004/apps/desktop/src/backend/DesktopBackendPool.ts#L173) removes the marker before opening the window. Meanwhile [server.ts:755](https://git.cafe/pingdotgg/t3code/blob/87ac5b3a34fe2c12561bf16f6f823e0376fda004/apps/server/src/server.ts#L755) publishes runtime metadata from a separate activation-dependent layer. Activation also releases command readiness; it does not await completion of runtime publication. Therefore HTTP 200 does not guarantee that server-runtime.json exists. The launcher reads the marker, then performs one final adoption attempt at [tunnel.ts:754](https://git.cafe/pingdotgg/t3code/blob/87ac5b3a34fe2c12561bf16f6f823e0376fda004/packages/ssh/src/tunnel.ts#L754). That last attempt can also precede publication and proceed to the managed spawn at line 770.

   The raw traced after run, launcher-after-20261027T053811, supports this sequence:

   | Epoch | File / observation |
   |---|---|
   | 1793079533.090078 | strace.53434: replacement answers the desktop readiness endpoint with HTTP 200. |
   | 1793079533.094695 | strace.53464: replacement runtime JSON written to the temporary contents.tmp. |
   | 1793079533.097256 | strace.53101: update marker unlink succeeds. Its next eventfd write is at .097469. |
   | 1793079533.100219 | strace.53464: runtime rename syscall entry; result eventually 0. The next recorded syscall in this thread is at 1793079536.542119. |
   | 1793079533.116958 | transcript observer reads both marker and runtime as absent. |
   | 1793079533.511016 | process observer records the launcher marker-reader node process. Earlier repeated sleep-1/helper processes show it was actually waiting, not skipping the marker path. |
   | 1793079533.716058 | process observer records the port picker. Exact script control flow puts the final failed runtime discovery before picking a port. |
   | 1793079533.804300 / .805192 | selected launcher syscalls write PID 53723 and managed state. |
   | 1793079533.814591 | selected launcher syscall executes nohup/run-t3.sh serve on port 3775. |
   | 1793079533.823520 | observer still reads no runtime, with managed PID/port now present. |
   | 1793079536.558976 | observer first records replacement runtime PID 53434, port 3774, version 90.23005.1. |
   | 1793079593.997764 | launcher-complete: exit 1, empty stdout, readiness failure on 3775 and ServerAlreadyRunningError. |

   **Confirmed defect:** the competing launch and failed reconnect are directly captured; the desktop keeps ownership. The ownership lock prevents the fallback from becoming a second serving owner. The user-visible failure is a connection attempt waiting about 60 seconds on the wrong port and failing even though the updated desktop backend is available. This remains a defect in the PR's prevention claim, rather than merely missing evidence.

   **Causality limit:** timestamps are syscall-entry timestamps. Do not call this a measured 2.963 ms gap or infer that publication completed at .100219. The snapshots and delayed following syscall are consistent with a publication delayed under tracing. Raw launcher-strace.* files were omitted by the archive filter, and file-open/read syscalls were not selected, so exact launcher read timestamps cannot be directly audited. The precise final-read placement above is an inference from the exact script and process observations. There is no need to assume TTL expiry: fallback begins about 21 seconds after publication of a 60-second marker.

   The normal control, launcher-after-20261027T053348, starts after old PID 48340 exits with a fresh installer-written marker and no runtime, then returns exactly {"remotePort":3774,"serverKind":"external"}; replacement PID 49211 belongs to desktop 48854 and has the target version/hash. No managed PID/log is reported. This is consistent with an ordering race whose window is usually missed; one passing control does not estimate its frequency. “Normal” here means no launcher strace; desktop tracing remains enabled.

   Smallest acceptance repair: make runtime publication precede marker removal, or retain the marker until runtime metadata identifies the ready replacement. Add a deterministic case in which HTTP is ready while publication is held behind a barrier; the launcher must continue waiting and eventually return external without spawning. The existing readiness unit test has no separate runtime-publication milestone and cannot catch this ordering.

2. **Capture qualification / evidence corrections.** The added top banner in launcher-before-20261027T054302-desktop-and-timeline.mp4 covers the heading and upper text of the ownership dialog at roughly 33 seconds onward. Those frames cannot establish the exact dialog heading; the unobscured raw desktop recording and server-child.log establish the ownership refusal. Black startup/update-gap frames and splash/blank-window frames in the other videos are not evidence of readiness; the later connected holds and runtime/transcript evidence establish recovery. I found no ghosting or unrelated settled pixel differences in the final three still pairs.

   The evidence's repeated claim that the *final* sync-before X11 panel stays black is contradicted by its current linked sync-before-20261027T061043-desktop-and-timeline.mp4 and corresponding raw desktop.mp4: it shows reconnecting around 20–25 seconds and connected recovery by about 30 seconds through the final hold. sync-before-20261027T060931/desktop.mp4 is the earlier black, 14.5-second diagnostic take and is rejected as visual proof. Thus F11-sync is sufficient as explicitly injected coverage; it does not need to be rejected on the stale black-panel description.

   Instrumentation prose also says the traced after launcher used strace -ff while before used -D -ff. The after process-observed record at 1793079514.001233566 explicitly has strace -D -ff. Correct that distinction; the fact that launcher tracing perturbs scheduling remains true.

| Row | Before / after coverage | Status |
|---|---|---|
| F10 | success-before-060350 / success-after-060514: both real replacements recorded. Before has no in-progress publication; after writes temporary JSON, renames, then SIGTERMs the recorded old backend. | SUFFICIENT |
| F11-event | event-before-060640 / event-after-060730: valid downloaded image, installed parent chmod 0555, native unlink returns EACCES, same desktop main survives, new old-version backend recovers. After clears restart/in-progress/install files before recovery. Install error and canRetry=true exist in subscribed history. | SUFFICIENT |
| F11-sync | sync-before-061043 / sync-after-060947: same one-shot main-inspector throw at the updater entry log, recovery to 90.23005.0, unchanged image hash, after marker cleanup. Current final video visibly recovers. | SUFFICIENT — explicitly injected, not a natural AppImage failure |
| F13-install | Shares the F10 success pair. Both installed image hashes become the same head-target hash; native relaunch changes desktop/backend identity, runtime reports 90.23005.1, GET / is 200 without redirects. After removes the real marker before expiry. | SUFFICIENT |
| F14 | launcher-before-054302: managed source CLI wins and updated desktop loses ownership. Traced after-053811: desktop wins, launcher still attempts managed start and exits 1. Normal after-053348 adopts external successfully. | INSUFFICIENT — no-competing-launch / unconditional-adoption claim contradicted |
| Prior F1–F9 and F13 | All 26 matrix artifact URLs and both F13 still URLs from the PR body (28 total) were downloaded successfully with the browser User-Agent. No prior behavioral verdict was re-audited. | Prior SUFFICIENT retained; links resolve |

Verification performed independently:

- All nine primary case.json files label the requested before/head correctly. Local HEAD and merge-base match the brief. Recomputed git archive SHA256 for the head is e8957764ebc351832481858f57742814688894de289a4cc1546b9ab91f152aba, exactly provenance.txt. Initial image hashes in all rows follow the recorded baseline-old/head-old identities; successful replacements use e951292baba7a0ba23755ba46b5355c262f4310ba0ab78bec709366bd6a53ade. Error rows retain their initial image hash. This validates the recorded provenance chain despite the head archive builds' unknown commit label; the AppImage bytes themselves are not uploaded for an independent binary hash.
- Regenerated the head node launcher through the reviewed public implementation and compared it to the uploaded script: exact match, 26,891 bytes. The probe uses a fake spawner only to capture the outgoing script, and starts no SSH/server.
- Minimum independent transcript reconstruction completed for F10 from raw strace files, not selected-syscalls.txt: temporary write 1793081143.590710, rename 1793081143.592619, SIGTERM(-74790) 1793081143.605004; JSON expiresAt-startedAt=60000. Marker is later removed by the replacement at 1793081159.277777. Before has no marker publication. See F10-rederived-transcript.txt.
- Opened all six final PNG stills and all six supplied diff images; independently recomputed both diff formats. All three before/after pairs are 1100x780 and pixel-identical: 0 changed pixels at threshold 0 and at maximum RGB channel difference >16/255. Diff0 is absolute RGB difference amplified 8x; DiffT is the binary >16 mask. Uploaded stills also match their original diagnostic final.png bytes. “What else changed” agrees with these settled diffs and the code, subject to the capture/instrumentation corrections above.
- Decoded all nine primary combined recordings with ffmpeg to one-frame-per-second sequences, inspected desktop contact sheets and readable full-resolution terminal milestone frames. Steps are IPC-driven through the real bridge, not recorded mouse clicks; the transcript panels disclose that replay. Also sampled all 29 retained raw desktop takes, including the rejected black/splash attempts. This is frame-based inspection, not a claim to have viewed every frame at 15 fps or separately audited all rejected diagnostic still attempts.
- Read the affected production paths, test assumptions, uploaded build/feed/capture/render/archive scripts, per-case raw runtime/transcripts/syscalls, HTTP-root proof and postrun hash/mode validation. Full AppImage rebuild not attempted: three builds plus capture would be heavy, and the explicitly allowed raw-log reconstruction and exact launcher regeneration provide independent checks. No tests/CI assertions are substituted for the requested runtime proof.

Limits remain disclosed: direct-shell node launcher rather than real SSH transport; AppImage extract-and-run because FUSE mounting is denied; no newly proven archive bootstrap/no-host-Node or other OS behavior. No running application/browser was started for this audit. All audit subprocesses completed; nothing remains to stop. The reviewed worktree remains clean. Final disk availability: 29 GB. Audit artifacts are retained under this timestamped scratch directory.

FRICTION:
- runbook | final-logs.tar.gz omits launcher-strace.* (archive-logs.py only selects strace.* or listed text suffixes); it also lacks file-open/read timestamps | Include launcher-strace.* and file-read/open traces with syscall durations when asserting exact causality.

VERDICT: INSUFFICIENT F14