# Proof audit, pass 1

Scope: [issue #13239](https://git.cafe/pingdotgg/t3code/issues/13239), base [8d3b061121](https://git.cafe/pingdotgg/t3code/commit/8d3b061121), head [dd9793b9dc](https://git.cafe/pingdotgg/t3code/commit/dd9793b9dca694d5303dbc35ed90a146af4d9272). Read-only source inspection; no implementation edits, test runs, service operations, browser, live application state, or forge comments. Only this sanitized audit artifact is published.

## Decision and matrix

Visual proof matrix: **[]** (empty).

The brief's server-only/nonvisual exception applies. The diff changes the server's preflight reason, two CLI no-op log lines, exports an existing invocation resolver, and updates focused tests. No client component, layout, renderer, error presentation route, wire schema, or navigation path changes. The longer reason can be presented by existing web, desktop, and mobile error rendering; that makes the content user-visible, but does not itself change a render path under this audit's stated semantics. This is an evidence-scope exception, not a claim that nobody sees the text. Viewport, width, theme, platform, settings/chat entry points, and provider permutations add no required visual rows here. No screenshot or browser waiver beyond the explicitly requested server-only proof is needed.

Source basis: cloud/servicePreflight.ts returns blocked for protocol mismatch and ready for protocol 3; cli/servicePreflight.ts serializes the actual result; cloud/selfUpdate.ts decodes the staged preflight and forwards the blocked reason through its existing failure path. cli/service.ts returns before install when status is installed/current, then logs resolveEntryPath for both install and update. cli/invocation.ts selects a validated matching npm launcher, otherwise executable path for standalone, otherwise argv[1] for a script. The resolver's selection logic itself is unchanged.

## Required runtime transcript (pending capture)

Capture actual base and head behavior with identified revision, artifact/source identity, package version, exact invocation, sanitized relevant inputs, stdout, stderr, and exit code. Do not replace execution with expected-output prose or mocked Console/BootService output. Keep the same scenario inputs across revisions. Preserve full recovery text and path differences; sanitize user paths consistently, without dumping environment variables or systemctl show-environment output.

1. Run the real CLI hidden command `__service-preflight --database-path <disposable-missing-path> --launcher-protocol <N>` for N=1 and N=2. Each head JSON must be blocked, report its actual package version, name the supplied protocol and required protocol 3, and include the exact version-pinned installer, version/path checks, default absolute service install command, and explanation of desktop versus CLI/service update. Base must show the former generic recovery reason. Capture both protocols; one does not stand in for the other. Do not execute the installer or repair advice.
2. Run the same preflight for N=3: ready JSON, exact version, launcherProtocol 3, unchanged from base. A missing database path is intentional: this preflight does not access the database. This is real CLI serialization proof; no service/server needs starting.
3. Capture the real `service install` and deprecated `service update` commands in installed/current no-op state, using a disposable HOME and explicit isolated base directory. Exercise both script invocation and actual standalone executable invocation: four head outputs total, with corresponding base outputs. Each head line must identify the actual CLI version and selected invocation path; script output must name its entry script rather than the Node interpreter, standalone output its executable. Update must retain its deprecation message. Exit successfully, with unchanged fixture state and no install/start/restart/enable/reload/download/handoff calls. A Node source run with its argv relabeled is not standalone proof.

These are a small textual runtime checklist, not additions to the visual matrix. No OS/provider/connection-mode cross product is required. The existing new tests cover the script fallback with injected host arguments, not standalone runtime execution. No new automated test suite is demanded by this proof audit.

## Fixtures and safety gate for the parent capturer

- Build/identify matching base/head CLI artifacts without starting a server; use the real hidden preflight command and disposable missing database pathname.
- For each CLI revision, render the exact expected service unit into the isolated HOME's `.config/systemd/user/t3code.service` using the existing renderer and that fixture's plan. Match isolated base directory, log path, runtime entry and environment-derived fields exactly.
- Seed the pinned runtime entry, `.install-complete` sentinel containing that CLI version, and parseable `runtime/service-state.json` with matching activeVersion and no pending update. Omit the restart-pending marker. Derive paths and state shape from pinnedRuntimePaths and serviceProtocol, rather than inventing an approximate unit/state.
- Preserve PATH. Real systemd/loginctl checks are read-only: manager availability, linger=yes, unit enabled and active. Do not publish raw environment probe output. Synthetic unit/runtime files alone do NOT establish current=true: all these real probe conditions must also pass. The fixture does not claim that systemd loaded its synthetic unit.
- Before executing install/update, prove the production status computation returns installed=true, current=true, problems=[] for the exact fixture and artifact. If unavailable or false, STOP that capture: reconcileService would enter install and violate the constraints. Do not fix systemd, start a service, install a unit, shim PATH, or substitute mocked success. Report the missing runtime evidence instead.
- Use absolute artifact invocations and command-local isolated HOME/base-dir. Ensure inherited launcher variables do not misidentify standalone as npm. If using the packaged npm launcher, provide its matching `t3` package manifest and record T3CODE_NPM_LAUNCHER_PATH provenance; the resolver validates name/version. A source/Node script only proves argv[1] fallback. The minimal four-output CLI checklist may use script fallback plus standalone; a third npm-launcher form is unnecessary unless claiming packaged-launcher coverage.
- Record fixture hashes before/after, command outcomes, and a read-only process-call trace/guard showing status probes only. Distinguish invoking the CLI subcommand named install from calling the install service method: the former is the scenario, the latter is forbidden. Never touch real HOME service files or live T3 data. No actual installer/start call is required.

## Evidence assessment

The brief reports two fresh reviewers (Sol and Opus) returning MERGE, 15/15 green tests, and independent base red/head green results of 4 failures/4 passes. These are supplied claims, not independently rerun or inspected transcripts in this audit. They support the proposed focused regression proof but do not establish the pending runtime outputs or standalone path. Retain exact test commands/revision identity and red/green logs with the eventual proof package. A code-review approval cannot substitute for execution evidence.

The proof plan and empty visual matrix are sufficient in scope. The currently supplied proof package is insufficient until the runtime transcripts above are attached and checked. This is a proof-readiness verdict, not a new finding against implementation correctness or the reviewers' merge assessments.

## FRICTION

category | event | prevention
--- | --- | ---
Scope | Longer server error text can be mistaken for a changed client rendering path | Derive visual rows from changed components/render paths; retain textual runtime proof for changed payloads.
Coverage | Script-only injected CLI tests can be mistaken for standalone runtime proof | Identify the actual execution form and capture both script and executable branches for both no-op commands.
Safety | A synthetic unit alone can leave current=false and trigger installation | Check production status first; stop unless real read-only systemd conditions and all fixture predicates pass.
Evidence | Review votes and green totals can be mistaken for attached runtime proof | Separate supplied reports from inspected execution artifacts and leave readiness pending until capture.

VERDICT: INSUFFICIENT