# Proof audit pass 2

VERDICT: SUFFICIENT

Proof-only review of [#24406](https://git.cafe/pingdotgg/t3code/pulls/24406) ([GitHub mirror](https://github.com/pingdotgg/t3code/pull/24406)). Candidate [f78d4ef](https://git.cafe/pingdotgg/t3code/commit/f78d4efb83406ee495171e1252d176384a5aa582), mergebase [6e79211](https://git.cafe/pingdotgg/t3code/commit/6e792117436662208bf2b6eb71ee8d0d88817e43). Both identities independently verified with git; complete four-file diff inspected. This verdict concerns the pinned evidence, not a later remote revision or general merge readiness.

## Artifact inspection

Read the full 12-row matrix, index, transcript, fixture/driver/replay, generation scripts, commands, four runtime/test logs, both 41-record returned-value JSONs, manifest, upload lists, raw pull/status captures and all 20 raw checks-search payloads. Independently verified all 12 SHA256 entries in manifest.json. All 15 archive members match their local files byte-for-byte. Downloaded all 15 public linked artifacts (13 evidence files, index and bundle) and verified exact byte equality with local copies. Checked each deterministic input against its hand-specified expectation and the actual returned rows, aggregate, own-property presence, request count and no-write observation; not merely row counts. The driver imports the real GitCafePullRequestProvider.make/getChangeRequest and production API/credential layers; only HTTP is replaced. Page termination uses the actual production readPages.

## Independently rerun

Ran `cd /home/ubuntu/wt/pr-24406` then `python3 /tmp/pr24406-pass2-replay/replay.py`, with byte-identical copies of delivered replay/driver/fixtures in that external directory so original evidence remains unchanged. The authorized replay temporarily used the exact base versions of the two production source files while retaining candidate regression tests; it restored candidate bytes before candidate execution. No branch/HEAD changes.

- Base regression run: exit 1, 2 failed / 47 skipped. Both failures are the intended extra stale failure row, with actual assertion diffs; neither is an import/environment failure.
- Base production adapter capture: exit 0 in observation mode.
- Candidate focused suite: exit 0, 49 passed.
- Candidate production adapter replay: exit 0; all fixture assertions pass.
- Independently generated base-runtime.json and candidate-runtime.json each equal the delivered corresponding JSON in all 41 objects, including every returned check pair, state/presence, request count and writes list.

Principal exact delta: R1-cancelled-reverseFalse input cancelled 99, success 100, same identity, counts {total:2,failing:1,pending:0}. Base: checks [[Check,cancelled],[Check,success]], checksState=failing. Candidate: checks [[Check,success]], checksState=passing. Both issue one checks GET and no writes. This is explicitly deterministic stale-count proof.

## Every matrix row

- **R1: sufficient (4 cases).** Failure and cancelled 99 → success 100 in both response orders: before retains both/failing; after success/passing despite failing:1 counts.
- **R2: sufficient (2 cases).** Success 100 → failure 101 in both orders: after failure/failing; negative control preserves the newest failure.
- **R3: sufficient (3 cases).** New queued, in_progress and action_required replace old failure: pending, pending and action-required rows; aggregate pending for all.
- **R4: sufficient (3 cases).** Different app, provider and name each preserve both rows and failing aggregate.
- **R5: sufficient (5 cases).** status-prefixed, missing, null, nondecimal and mixed ordered/unordered IDs preserve failure + success and failing aggregate.
- **R6: sufficient (4 cases).** 9007199254740993 beats 9007199254740992; equal ID keeps first in both orders; absent/null identity groups together. Equal-ID behavior is observed, not an upstream uniqueness guarantee.
- **A1: sufficient (4 cases).** Failure and cancelled each outrank simultaneous pending + success; queued/action_required each outrank success.
- **A2: sufficient (3 cases).** Success + neutral/skipped passes; empty and neutral/skipped-only omit checksState (own-property absence explicitly asserted), overriding contradictory counts.
- **P1: sufficient (1 cases).** Success on page one, older failure on page two: two HTTP requests, one success/passing after completion.
- **P2: sufficient (3 cases).** Ten-page limit, repeated cursor and empty non-null-cursor page: 10/2/1 requests; normalized success/success/empty rows; all remain failing via counts.
- **P3: sufficient (4 cases).** Truncated repeat-cursor listing: counts total=0 omits state, failing+pending fails, pending stays pending, neither passes; two requests each.
- **P4: sufficient (4 cases).** Null head: same four fallback states, empty rows, exactly zero checks requests.

40 deterministic cases across 12/12 rows; no missing rows.

## Real payload and provenance limits

The sanitized real fixture checks object exactly equals raw live-24508-checks.json. Pull fields match raw live-pull.json except the explicitly sanitized author. Merge data and total/pending/failing counts match raw live-status.json. Head and checks commit match [ca3661c](https://git.cafe/pingdotgg/t3code/commit/ca3661c314bc03e2fede54d1c666fd0082694133) from [#24508](https://git.cafe/pingdotgg/t3code/pulls/24508). Auxiliary routes and owner/repo/7 namespace are explicitly synthetic.

Native fingerprint diff has cancelled 120937060075 and success 120937063370 from github/github-actions. Exact independent replay matches delivered base 32 rows → candidate 30 rows; Native fingerprint diff loses only the cancelled predecessor, and a duplicate skipped Macroscope check also collapses. Both aggregates are passing because captured upstream counts already equal {total:30,pending:0,failing:0}. The evidence does not claim a live stale failing aggregate. The other 19 scan payloads are search context, not additional claimed matrix cases. No new live fetch or authentication was needed for this audit.

Server-only exception applies: exact text/JSON deltas provide the requested proof; no images, recording, browser or server was needed. No commits, push, comments, watch or production changes remain. Final HEAD unchanged, git status empty, both temporarily swapped source files equal HEAD byte-for-byte, temporary package test absent.

## Preserved local replay evidence

Independent outputs: `/tmp/pr24406-pass2-replay/{base-regressions.log,base-runtime.log,candidate-tests.log,candidate-runtime.log,base-runtime.json,candidate-runtime.json,commands.json}`. Original evidence retained in `/tmp/pr24406-evidence`. Audit report retained at `/tmp/pr24406-proof-audit-pass2.md`.

FRICTION category|happened|prevention
Public download|Default Python user agent received HTTP 403; browser user agent succeeded|Use a standard user agent for public artifact byte verification.
Evidence preservation|Provided replay overwrites neighboring logs|Copy replay plus fixtures to an external pass-2 directory before executing.
Scope|Base reproduction temporarily swaps production source files|Use the explicitly authorized replay with finally restoration, then verify bytes against HEAD and confirm clean status.

VERDICT: SUFFICIENT